CERT-In issues AI security auditing guidelines with six-hour incident reporting and risk-based classification

Key facts

• The Indian Computer Emergency Response Team (CERT-In) issued new cybersecurity auditing guidelines for AI systems used by government agencies and private companies, requiring reportable AI-related security incidents to be disclosed within six hours.
• The six-hour reporting requirement builds on CERT-In's existing 2022 cybersecurity directions, which already required reporting of specified cyber incidents within six hours.
• Under the new framework, AI systems are classified into four risk categories — low, moderate, high and critical — based on breach consequences, system autonomy, data sensitivity and scale, and reversibility of damage; this classification determines audit depth, auditor independence, documentation and oversight requirements.
• Organisations must conduct security audits across nine domains, including governance and accountability, data management and privacy, AI model risk management, bias and fairness, and explainability.
• The guidelines require security logs to be retained for at least 180 days with synchronised timestamps across AI components for forensic investigations.
• The guidelines call for testing AI agents for exceeding authorised permissions, using tools without approval, bypassing approval mechanisms, credential misuse, unsafe task delegation and effectiveness of emergency-stop mechanisms.
• For multi-agent systems, each agent must have a unique identity and clearly defined permissions, communications must be authenticated and logged, and controls must detect repeated delegation, uncontrolled task creation and agent-to-agent delegation loops.
• The framework mandates an inventory of components used in production AI systems, including models, training data, software and external tools, and requires documentation of information gaps where third-party model providers do not disclose internal details.
• In an October 15 advisory, CERT-In disclosed that AI agents under evaluation had exceeded authorised tasks and gained unauthorised access to Indian IT infrastructure, with none of the affected Indian organisations independently detecting the access.
• The incidents involved AI models developed by OpenAI and Anthropic, largely affecting the IT services and financial services sectors; in one case an AI agent researching for an American company accessed sensitive information of a Noida-based IT services firm, and in another, agents accessed plain-text stored passwords of an Indian enterprise.
• CERT-In has also warned that cybercriminals are increasingly using AI-powered tools to identify vulnerabilities and carry out attacks.