CERT-In’s AI guidelines do not ask every Indian company that uses AI to hire an outside auditor. They ask it to list its AI systems, score each one on eight risk factors and let the total decide the audit. A system scoring 8 to 12 can be checked by the company itself. Anything scoring 13 or more needs an independent audit by a CERT-In empanelled auditing organisation, at least once a year.
That is the core of the Artificial Intelligence (AI) Security Auditing Guidelines, version 1.0, which the Indian Computer Emergency Response Team listed as CISG-2026-04 on 4 November 2026. The 107-page PDF was prepared by a working group on Indian standards for cybersecurity auditing. Below is who it covers, how the scoring works, and three worked examples that show where common workplace AI tools could land.
Who the guidelines cover
The framework applies to AI systems “developed, procured, deployed or operated by organisations in India”, and to AI systems that process Indian data or provide AI-enabled services to Indian users (executive summary, page 4). Table 5 lists MSMEs, large companies, government bodies and PSUs, startups, and Indian and foreign AI service providers selling to Indian customers.
It does not matter where the model came from. A chatbot built on a foreign provider’s API, an open-source model hosted in-house and a tool bought as SaaS are all in scope.
Section 4.9 (page 20) sets out three exclusions:
- Academic research AI used only inside recognised research institutions, not deployed in production and not making decisions about individuals. It enters full scope once it moves to a pilot or production.
- Purely rule-based automation, such as traditional RPA with no machine learning. Hybrid systems that mix rules with ML are in scope.
- Consumer personal-use AI, meaning tools individuals use for personal, non-commercial purposes. The providers of those tools in India remain in scope.
For employers, the third point is the one to read carefully. An employee asking a chatbot for a recipe at home is outside the framework. The same chatbot rolled out by a company to answer customers or screen job applicants is a system the company operates.
How the scoring works
Each AI system is scored from 1 (low) to 4 (critical) on eight factors, “without taking credit for claimed control effectiveness” (Section 5.3, page 23). In other words, the score reflects the system’s inherent risk, not how good the company believes its safeguards are.
| Factor | What it asks |
|---|---|
| F1 Impact severity | What a wrong, compromised or unsafe output could cost |
| F2 Autonomy and actionability | What the system can do before a human approves |
| F3 Data sensitivity | Public, personal, financial or health, biometric or classified data |
| F4 Scale and exposure | Internal use, controlled external use or population scale |
| F5 Reversibility | How hard the harm is to undo |
| F6 Operational or sector criticality | Supporting use, regulated operation or critical infrastructure |
| F7 Adversarial exposure | Isolated, controlled, internet-facing or actively targeted |
| F8 Complexity and auditability | How opaque the system and its dependencies are |
The eight scores are added. The total, between 8 and 32, sets the tier (Table 11, page 25):
| Total score | Tier | Minimum audit |
|---|---|---|
| 8 to 12 | Tier 1, Low | Self-assessment or basic internal review with documented evidence |
| 13 to 19 | Tier 2, Moderate | Documented internal audit, plus an independent audit by a CERT-In empanelled auditing organisation at least annually |
| 20 to 26 | Tier 3, High | Periodic independent audit by an empanelled organisation, more often after material changes or incidents |
| 27 to 32 | Tier 4, Critical | Independent audit by an empanelled organisation with continuous monitoring |
The total is not the last word. The same page lists escalation triggers, including a system that can “autonomously execute code, transactions or external communications”, has privileged access to production systems, or cannot be reliably interrupted or rolled back. In those cases the owner or auditor has to consider a higher tier and record why.
Small firms get some relief, but only at the bottom. Section 5.7 (pages 27 and 28) lets MSMEs use a simplified self-assessment for Tier 1 and proportionate documentation for Tiers 1 and 2. Tier 3 and Tier 4 systems must meet the full requirements “irrespective of organisational size”.
Three worked examples
The scores below are our own illustrations, applying the calibration guide in Table 11 to three hypothetical systems. They are not CERT-In assessments, and a real audit would score each factor with evidence.
| Factor | HR policy chatbot (internal) | CV-screening tool | Loan agent on a messaging app |
|---|---|---|---|
| F1 Impact severity | 2 | 3 | 3 |
| F2 Autonomy | 1 | 2 | 3 |
| F3 Data sensitivity | 2 | 2 | 3 |
| F4 Scale and exposure | 1 | 2 | 3 |
| F5 Reversibility | 1 | 2 | 3 |
| F6 Criticality | 1 | 2 | 3 |
| F7 Adversarial exposure | 1 | 2 | 3 |
| F8 Complexity | 2 | 3 | 3 |
| Total | 11 | 18 | 24 |
| Tier | 1, Low | 2, Moderate | 3, High |
The HR policy chatbot answers staff questions about leave and travel rules from the company handbook. It handles some personal information, so data sensitivity is 2, but it only gives advice, sits on the internal network and its mistakes are easy to correct. At 11 it stays in Tier 1: a documented internal review is enough.
The CV-screening tool ranks applicants for a recruiter who makes the final call. It processes personal data from people outside the company, its shortlists affect candidates’ chances and the model’s reasoning is hard to inspect. At 18 it is Tier 2, which already means an annual audit by an empanelled organisation and a mandatory, simplified AI risk and impact assessment (Table 14, page 26).
The loan agent talks to customers of a lender on a public messaging app, reads their financial data and can approve small loans and start disbursal. It scores 3 on every factor, for a total of 24 and Tier 3. Because it can execute transactions on its own, it also meets an escalation trigger, so the lender would have to document whether Tier 4 applies.
The jump between the first two examples comes from small changes: data from outsiders, decisions about people and an opaque model. That is why the guidelines tell auditors not to rely solely on a company’s self-assessed tier; where the two differ, the higher tier applies for scoping (Section 7.3, page 37).
What changes inside a company
Beyond the audit itself, several requirements reach day-to-day work with AI:
- Incident reporting. AI incidents meeting CERT-In’s reportable criteria must be reported within 6 hours, with 180-day log retention (pages 56 and 76). These are the same timelines as CERT-In’s existing directions, explained in our guide to CERT-In incident reporting.
- An AI bill of materials. Production AI systems need an AIBOM listing models and versions, datasets, system prompts, guardrails, vector databases, tools and external APIs, in proportion to risk (page 51).
- Deepfakes and labels. Organisations using generative AI need a policy against making deepfakes of real people without explicit consent, and provenance marking such as C2PA for synthetic media their systems generate (page 64). The marking requirement sits alongside the IT Rules on deepfake labelling.
- Agents. AI agents need documented identities, approved tools and permission limits, and “shall not automatically inherit permissions from users, tools or other agents”. Consequential actions need human approval gates, and agent actions must be logged so the chain can be reconstructed (Section 9.7, page 66).
- Re-audits. An unsatisfactory audit opinion, or two or more critical findings, triggers a re-audit within 3 months (page 86).
Are the guidelines binding?
The document does not cite a statutory provision that makes it mandatory, and it gives no penalty for ignoring it. Its closing section says the India AI Governance Guidelines provide “the policy authority” for its audit requirements (page 102); our explainer on the India AI governance guidelines covers that framework. The 6-hour reporting duty is different: it already applies through CERT-In’s directions under the IT Act.
Sector rules still matter. A bank or NBFC deploying AI also answers to the RBI’s expectations, described in our piece on the RBI’s FREE-AI framework, and employers handling staff or applicant data have duties under the DPDP Act when using AI tools.
