The Indian Computer Emergency Response Team (CERT-In) released its Artificial Intelligence (AI) Security Auditing Guidelines, outlining a risk-based framework for auditing AI systems developed, procured, deployed, or operated by organisations in India on November 4. The framework also covers AI systems that process Indian data or provide AI-enabled services to Indian users. 

The guidelines set out requirements for governance, cybersecurity, data privacy, fairness, transparency, resilience and auditability, with audit obligations varying according to an AI system’s risk tier. They cover nine core audit domains and prescribe additional security requirements for generative AI, large language models (LLMs), Retrieval-Augmented Generation (RAG), agentic AI, multimodal AI and autonomous systems.

Core audit domains: The nine domains cover an AI system’s lifecycle, from design and procurement to deployment, monitoring and decommissioning.

• AI Governance and Accountability: Organisations must establish governance structures, assign responsibilities, define accountability and maintain documentation for AI systems.
• Data Lifecycle, Quality and Privacy: Audits must assess data collection, quality, integrity, privacy, access controls, retention and handling throughout the data lifecycle.
• Model Risk Management: Auditors must examine model development, validation, performance, limitations, risks and controls.
• AI Ethics, Bias and Fairness: Assessments must identify and address bias, discrimination and unfair outcomes.
• Explainability and Transparency: Organisations must document AI system capabilities, limitations and decision-making processes, including applicable explainability measures.
• Security, Adversarial Resilience and Incident Reporting: Audits must examine security controls, adversarial threats, vulnerabilities and incident response arrangements.
• Continuous Monitoring, Drift Management and Validation: Organisations must monitor AI systems for performance degradation, data or model drift, and changes that require reassessment.
• Human Oversight and Decision Accountability: Auditors must evaluate whether human oversight is appropriate to the system’s risk and whether decisions can be reviewed.
• Third-Party and AI Supply-Chain Assurance: Organisations must assess risks arising from vendors, external models, dependencies and other components of the AI supply chain.

Risk tiers determine audit intensity: AI systems are classified into four risk tiers: Low, Moderate, High and Critical. The classification considers factors such as impact severity, decision-making autonomy, data sensitivity, scale and exposure, transparency, incident response readiness, reversibility, sector criticality, adversarial exposure and auditability. The assigned tier determines the depth, frequency and independence of audits, documentation requirements, human oversight and monitoring obligations.

• Low risk: These systems have limited security, safety, operational or data risks. Their outputs are primarily advisory or assistive, with limited autonomy and no material impact on critical business processes. Audit requirements are comparatively streamlined.
• Moderate risk: These systems influence business processes, service delivery or user interactions, with defined human oversight. A failure or compromise may cause recoverable operational, financial, data or service impact. The guidelines provide for annual independent audits by CERT-In-empanelled auditors.
• High risk: These systems may have significant effects on operations, users, sensitive data or sectoral services. They require more rigorous and independent assessment, enhanced governance and stronger monitoring. The guidelines call for periodic independent audits, which may be conducted every six months where warranted.
• Critical risk: These systems may pose severe or systemic risks, including significant consequences for critical infrastructure or safety. They require the highest level of audit scrutiny, including CERT-In-empanelled audits and continuous monitoring.

Risk-tier escalation may apply where the system’s use, impact or exposure changes, or where the assessment identifies factors warranting a higher classification.

Human oversight and the right to review AI decisions: The required level of human involvement varies according to the AI system’s risk and autonomy. Three oversight models are identified:

• Human-in-the-Loop (HITL): A human must approve or intervene in a decision before the AI system completes the relevant action.
• Human-on-the-Loop (HOTL): A human supervises the AI system and can intervene, override, or stop its actions.
• Human-over-the-Loop (HOVL): Human oversight takes place through monitoring, governance and periodic review, rather than direct intervention in every decision.

Auditors must assess whether the oversight model is appropriate to the system’s risk. This includes checking whether human reviewers have sufficient authority, competence, information and access to intervene effectively.

Contestability and decision review: Individuals affected by AI-assisted decisions must be able to seek review through contestability mechanisms, where applicable. Organisations must establish processes for human review, escalation and reconsideration. Auditors are expected to examine whether such mechanisms are documented and operational, and whether decisions can be reviewed by an authorised person.

Audit reporting, remediation and timelines: Audit findings are classified as Critical, High, Moderate or Low/Observation. Organisations must document findings, assign responsibility for remediation and track their closure.

The specified remediation timelines include:

• Moderate findings: Organisations must submit a remediation plan within 30 business days and implement it within 60 days.
• Low findings: Remediation must be completed within three months.
• Critical, High and Moderate findings: Organisations must prepare Corrective Action Plans (CAPs).
• Critical and High findings: Progress must be reported monthly.
• Moderate findings: Progress must be reported quarterly.
• Low findings: Progress must be reported annually.

A re-audit is required where an audit opinion is unsatisfactory, or where two or more Critical findings arise within three months. A re-audit may also be required sooner when directed by a regulator.

Audit requirements across the AI lifecycle: The audit methodology covers AI system design, procurement, data collection, development, training, validation, deployment, operation, retraining, monitoring and decommissioning.

The audit process includes engagement initiation, risk assessment, scoping, audit planning, evidence collection, technical testing, finding classification, reporting, remediation and follow-up verification. Organisations must identify the AI systems within their technical and organisational boundaries, classify them using the risk-tiering methodology and determine the applicable audit domains and evidence requirements.

Auditors must use the Core Audit Domains as the baseline and apply additional requirements for specialised AI systems wherever relevant. Applicable CERT-In requirements, sector-specific cybersecurity obligations, contractual requirements and other external obligations must be identified during scoping and incorporated into the audit criteria.

AI-assisted audit procedures may be used for evidence analysis, control mapping, technical testing and report preparation. However, such use must be subject to approved scope, confidentiality controls, tool validation, traceable evidence, and competent human review. AI-generated outputs cannot replace sufficient evidence or the auditor’s independent judgement.

Additional security requirements for advanced AI: Supplementary requirements apply to Generative AI, LLMs, RAG, Agentic AI, Multimodal AI, Multi-Agent AI and Autonomous or Cyber-Physical AI. These address risks that conventional cybersecurity controls may not adequately cover.

For generative AI and LLMs, auditors must consider prompt injection, sensitive-information disclosure, data and model poisoning, misinformation, hallucinations, and improper output handling. The guidelines also address deepfakes and require explicit consent in relevant contexts, alongside measures such as C2PA content provenance.

For RAG systems, assessments must examine the security of retrieval pipelines, vector databases, embeddings, access controls, and connected data sources. Agentic AI systems require scrutiny of tool use, excessive agency, least-privilege access, persistent memory, and unsafe autonomous actions.

Multimodal and multi-agent systems introduce additional risks involving cross-modal attacks, inter-agent communication, and the handling of data across different modalities. These architectures require appropriate security testing, including reassessment after material changes to the system.

Incident reporting and security obligations: Organisations must maintain processes to detect, respond to, and report AI-related security incidents, in accordance with applicable CERT-In requirements.

For reportable AI security incidents, the framework specifies a six-hour reporting timeline to CERT-In. Organisations must also maintain relevant logs for 180 days, in line with the prescribed requirements. [ Read our interview with CERT-In chief regarding this.]

Incident response must be incorporated into AI security controls, including procedures for containment, investigation, recovery and post-incident review. Higher-risk systems must also maintain appropriate business continuity and resilience arrangements.

Also read: