The Indian Computer Emergency Response Team (CERT-In), on November 04, 2026, developed the Artificial Intelligence (AI) Security Auditing Guidelines to establish a common, risk-based and lifecycle-oriented framework for auditing the governance, security, privacy, fairness, transparency, resilience and auditability of AI systems in India. The framework covers AI systems developed, procured, deployed or operated by organisations in India, as well as systems processing Indian data or providing AI-enabled services to Indian users.
The Guidelines prescribe four risk tiers—Low, Moderate, High and Critical—based on factors such as impact severity, decision-making autonomy, data sensitivity, scale, exposure and sectoral criticality. They establish nine core audit domains covering AI governance and accountability; data lifecycle, quality and privacy; model risk management; ethics, bias and fairness; explainability and transparency; security and adversarial resilience; continuous monitoring and drift management; human oversight; and third-party and AI supply-chain assurance. Additional requirements address Generative AI, RAG, Agentic AI, Multimodal AI, Multi-Agent AI and Autonomous/Cyber-Physical AI systems.
The framework also provides an audit methodology covering risk assessment, audit planning, evidence collection, technical testing, reporting, remediation and follow-up verification. Findings are classified as Critical, High, Moderate and Low/Observation, while a five-level maturity model supports progressive improvement in AI governance. The supplied extract does not specify a statutory commencement date or make the Guidelines mandatory; their applicability and implementation status should therefore not be treated as a binding legal obligation solely on the basis of this extract.
