CERT-In's AI Audit Rules: Six-Hour Breach Clock, Four Risk Tiers

India's CERT-In published its Artificial Intelligence Security Auditing Guidelines on November 4, and the document has teeth: reportable AI security incidents must reach the agency within six hours, with logs retained for 180 days.

The framework applies to organisations that develop, procure, deploy or operate AI systems in India, plus systems that process Indian data or serve Indian users. It sets requirements across governance, cybersecurity, data privacy, fairness, transparency, resilience and auditability, and it scales obligations by risk. Nine core audit domains cover the full lifecycle, from design and procurement through deployment, monitoring and decommissioning.

What are the nine audit domains?

Each domain carries concrete expectations rather than aspirations:

• AI Governance and Accountability — governance structures, assigned responsibilities, maintained documentation.
• Data Lifecycle, Quality and Privacy — collection, integrity, access controls, retention.
• Model Risk Management — development, validation, performance, limitations, controls.
• AI Ethics, Bias and Fairness — identification and mitigation of bias and unfair outcomes.
• Explainability and Transparency — documented capabilities, limitations and decision processes.
• Security, Adversarial Resilience and Incident Reporting — controls, threats, response arrangements.
• Continuous Monitoring, Drift Management and Validation — detection of performance degradation and model drift.
• Human Oversight and Decision Accountability — oversight proportionate to risk, reviewable decisions.
• Third-Party and AI Supply-Chain Assurance — risks from vendors, external models and dependencies.

How do the four risk tiers work?

Systems classify as Low, Moderate, High or Critical based on impact severity, decision-making autonomy, data sensitivity, scale, reversibility, sector criticality, adversarial exposure and auditability. The tier sets audit depth, frequency, independence, documentation and monitoring obligations.

• Low: advisory or assistive outputs, limited autonomy, streamlined audits.
• Moderate: influences business processes; annual independent audits by CERT-In-empanelled auditors.
• High: significant effects on operations or sensitive data; periodic independent audits, potentially every six months.
• Critical: severe or systemic risk to critical infrastructure or safety; CERT-In-empanelled audits plus continuous monitoring.

Escalation applies when a system's use, impact or exposure changes. A tier is not a permanent address.

What does this change for human oversight?

Three oversight models are defined: Human-in-the-Loop, where a person approves each decision; Human-on-the-Loop, where a supervisor can override or stop actions; and Human-over-the-Loop, where oversight runs through monitoring and periodic review. Auditors must check that reviewers hold sufficient authority, competence, information and access to intervene effectively.

Affected individuals get contestability mechanisms — processes for human review, escalation and reconsideration of AI-assisted decisions. Auditors will examine whether these are documented, operational and capable of review by an authorised person.

What are the remediation timelines?

Findings classify as Critical, High, Moderate or Low/Observation. Moderate findings require a remediation plan within 30 business days and implementation within 60 days; Low findings close within three months. Critical, High and Moderate findings require Corrective Action Plans. Progress reporting runs monthly for Critical and High, quarterly for Moderate, annually for Low.

A re-audit follows an unsatisfactory opinion or two or more Critical findings within three months — sooner if a regulator directs it.

What about generative AI and agentic systems?

Supplementary requirements cover Generative AI, LLMs, RAG, agentic AI, multimodal AI, multi-agent AI and autonomous or cyber-physical systems. For generative AI and LLMs, auditors must consider prompt injection, sensitive-information disclosure, data and model poisoning, misinformation, hallucinations and improper output handling. The guidelines address deepfakes, require explicit consent in relevant contexts and reference C2PA content provenance.

RAG assessments must examine retrieval pipelines, vector databases, embeddings, access controls and connected data sources. Agentic systems face scrutiny of tool use, excessive agency, least-privilege access, persistent memory and unsafe autonomous actions. Multimodal and multi-agent setups add cross-modal attack and inter-agent communication risks, with reassessment after material changes.

Can AI audit itself?

Partly. AI-assisted procedures may support evidence analysis, control mapping, technical testing and report preparation — under approved scope, confidentiality controls, tool validation, traceable evidence and competent human review. AI-generated outputs cannot replace sufficient evidence or the auditor's independent judgement. The audit process itself spans engagement initiation, risk assessment, scoping, planning, evidence collection, technical testing, finding classification, reporting, remediation and follow-up verification.

Incident response must sit inside AI security controls, covering containment, investigation, recovery and post-incident review. Higher-risk systems must also maintain business continuity and resilience arrangements. Compliance teams in India now have a document to map against, and a six-hour clock to rehearse for.