CERT-In issues AI security audit guidelines with four risk tiers and agentic AI checks
In one line: CERT-In has issued a detailed framework for auditing AI systems, grading them by risk and adding special tests for AI agents that act on their own.
Published 6 November 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
The Indian Computer Emergency Response Team (CERT-In), the national agency for responding to cyber incidents, has issued the 'Artificial Intelligence (AI) Security Auditing Guidelines: Framework for Secure, Ethical and Auditable Artificial Intelligence Systems'. Version 1.0 is dated 4 November 2026 and was prepared by a working group under CERT-In's effort on Indian standards for cybersecurity auditing. It applies to AI systems developed or operated in India, and to systems that process Indian data or serve Indian users. Its aim is a consistent, risk-based way to audit AI for security, governance, privacy, fairness, transparency, resilience and auditability across the system's life cycle. The Hindu reported it on 6 November with a focus on its rules for agentic AI, which are systems that plan and carry out tasks, use tools and delegate work on their own.
The guidelines sort systems into four tiers: Low, Moderate, High and Critical. Eight inherent risk factors, including impact severity, autonomy, data sensitivity, reversibility and adversarial exposure, are each scored 1 to 4, giving a composite of 8 to 32. Auditors must validate the tier, and if they disagree with the organisation the higher tier applies. Tier 1 needs an annual self-assessment; Tier 2 an internal audit and an independent audit by a CERT-In empanelled auditor at least annually; Tier 3 independent audits, every six months where warranted; and Tier 4, for AI in critical infrastructure, national security or safety-critical settings, an empanelled audit with continuous monitoring. An AI Impact Assessment is mandatory for Tiers 3 and 4, and sole-auditor engagements are not allowed for them.
For agentic AI, the guidelines cover excessive agency, unsafe tool use, persistent memory and communication between agents. Audits are to test whether an agent can exceed its authorised permissions or misuse credentials, whether task delegation is safe and whether emergency-stop mechanisms work. Autonomous execution of code, transactions or external messages is an escalation trigger that can push a system into a higher tier. The framework requires risk-based human oversight, approval gates for consequential actions and manual override. AI-related security incidents must be reported to CERT-In within six hours, with logs kept for 180 days. The guidelines draw on ISO/IEC 42001, the NIST AI Risk Management Framework, MITRE ATLAS, OWASP guidance and MeitY's India AI Governance Guidelines. The document itself does not state how it will be enforced or what its legal status is.
Prelims facts
- CERT-In's AI Security Auditing Guidelines, version 1.0, are dated 4 November 2026.
- AI systems are placed in four risk tiers (Low, Moderate, High, Critical) using eight risk factors scored 1 to 4.
- Critical-tier systems need an audit by a CERT-In empanelled auditor plus continuous monitoring, and an AI Impact Assessment is mandatory for Tiers 3 and 4.
- Audits of agentic AI must test permissions, credential misuse, safe delegation and emergency-stop mechanisms.
- AI-related security incidents must be reported to CERT-In within six hours, with logs kept for 180 days.
Quick recall
- What are CERT-In's new AI guidelines called?
- AI Security Auditing Guidelines: Framework for Secure, Ethical and Auditable Artificial Intelligence Systems.
- Date of version 1.0?
- 4 November 2026.
- How many risk tiers are there?
- Four: Low, Moderate, High and Critical.
- How many inherent risk factors are scored?
- Eight, each scored 1 to 4.
- Which tiers require a mandatory AI Impact Assessment?
- Tier 3 (High) and Tier 4 (Critical).
- Deadline for reporting AI-related security incidents to CERT-In?
- Six hours.
- For how long must relevant logs be kept?
- 180 days.
- Under which Ministry does CERT-In function?
- The Ministry of Electronics and Information Technology (MeitY).
Prelims practice question
With reference to CERT-In's AI Security Auditing Guidelines issued in November 2026, consider the following statements:
1. They classify AI systems into four risk tiers.
2. If an auditor and the organisation disagree on the tier, the lower tier applies.
3. They apply only to AI systems developed by government departments.
Which of the statements given above is/are correct?
- 1 only
- 1 and 2 only
- 2 and 3 only
- 1, 2 and 3
Show answer
Answer: (a) 1 only. Statement 1 is correct: the tiers are Low, Moderate, High and Critical. Statement 2 is wrong: the higher tier applies when they disagree. Statement 3 is wrong: the guidelines cover AI systems developed or operated in India, or processing Indian data or serving Indian users, not only government systems.
Use this in UPSC Mains: previous-year questions
Recurring theme: Cybersecurity governance and the risks of artificial intelligence
- How to use this
Use the guidelines as a 2026 example of India filling gaps in its cyber strategy by extending audits and incident reporting to AI systems.
- CERT-In's AI Security Auditing Guidelines (4 November 2026) place AI systems in four risk tiers with graded audits.
- AI-related security incidents must be reported to CERT-In within six hours, with logs kept for 180 days.
- Agentic AI audits must test permissions, credential misuse and emergency-stop mechanisms.
- How to use this
Use the CERT-In framework to suggest how privacy risks of AI in healthcare can be managed through risk-tiered audits and human oversight.
- CERT-In's 2026 guidelines score data sensitivity as one of eight risk factors when placing AI systems in tiers.
- High and Critical tier systems need an AI Impact Assessment and independent audits.
- The framework requires approval gates and manual override so that humans remain accountable for AI decisions.
Data security in the digital world is the wider theme; the AI guidelines reference the DPDP Act, 2023, but the question is about the Srikrishna Committee report.
Mains practice question
Agentic AI systems that act autonomously raise new security risks. Discuss these risks and evaluate the approach of CERT-In's AI Security Auditing Guidelines, 2026 in addressing them. (250 words)
Model answer
Agentic AI systems plan and execute a sequence of actions, invoke tools and delegate tasks with little human input. CERT-In's AI Security Auditing Guidelines (version 1.0, 4 November 2026) set a risk-based audit framework for such systems.
Risks of agentic AI
- Excessive agency: an agent may exceed authorised permissions or misuse credentials.
- Unsafe tool use: autonomous code execution, transactions or external messages can cause real harm.
- Persistent memory: retained data can leak or be poisoned.
- Inter-agent communication: one compromised agent can mislead others.
- Prompt injection: hidden instructions can hijack behaviour.
CERT-In's approach
- Four tiers (Low to Critical) using eight risk factors scored 1 to 4; the higher tier applies if auditor and organisation disagree.
- Escalation triggers: autonomous execution of code or transactions can raise the tier.
- Graded audits: CERT-In empanelled audits for Moderate and Critical systems; continuous monitoring for Critical.
- Agent tests: permissions, credential misuse, safe delegation and emergency stops.
- Human oversight: approval gates and manual override.
- Incidents: reporting within six hours; 180-day log retention.
Gaps
- Legal status and enforcement are not spelt out.
- Capacity: Tier 3 and 4 audit teams must include at least one member with AI/ML competence.
Way forward
- Link the framework to sector regulators and the DPDP Act, 2023.
- Build auditor capacity and publish sector-specific checklists.
The guidelines move India from broad AI principles to testable controls, but their impact depends on enforcement and capacity.
The basics
Why this matters
AI tools have moved from answering questions to taking actions: running code, sending emails, moving money and calling other software. When a system can act, a security failure is no longer a wrong answer but a wrong deed. CERT-In's guidelines are a detailed checklist for auditing such systems, and they matter for any firm that builds or uses AI in India.
Agentic AI from zero
A chatbot replies. An agent pursues a goal: it breaks the goal into steps, chooses tools, acts, checks results and tries again. CERT-In defines agentic AI as systems 'capable of independently planning and executing a sequence of actions, invoking tools or services'. That power creates new failure modes, explained in Agentic AI: an agent may exceed its permissions, misuse stored credentials, remember sensitive data, or be steered by a hidden instruction, a trick called prompt injection.
A risk-based audit
The framework does not treat every AI system alike. A recommendation engine for a small shop is not an AI that controls a power grid. Each system gets a tier from eight inherent risk factors, and audit intensity rises with the tier. This is the logic of Risk-based AI regulation. The most serious tiers need independent auditors empanelled by CERT-In and an AI Impact Assessment.
- 1Score the riskEight factors such as autonomy, impact and data sensitivity are scored 1 to 4.
- 2Fix the tierThe auditor validates it; the higher tier applies if views differ.
- 3Choose the auditFrom annual self-assessment (Tier 1) to empanelled audit with continuous monitoring (Tier 4).
- 4Test controlsFor agents: permissions, credential misuse, delegation and emergency stops.
- 5Report and keep logsIncidents to CERT-In within six hours; logs kept for 180 days.
Humans in charge
The guidelines insist on Human oversight of AI: clear ownership, approval gates before consequential actions, the ability to override and stop the system, and logs of decisions. An emergency stop that does not work is treated as a serious audit finding. The open question is enforcement: the document is written in 'shall' language but does not say what happens to a firm that ignores it.
Go deeper
Why it matters for UPSC
Cybersecurity and emerging technology are regular GS3 themes. This framework is a concrete example of how India is moving from AI principles to checkable rules, and it links to data protection, critical infrastructure and internal security.
The core idea
CERT-In, India's national cyber incident agency, wants every AI system to be audited in proportion to its risk, the principle behind Risk-based AI regulation. The guidelines pay special attention to Agentic AI, because an agent that can act can also misuse its powers. Across all tiers they insist on Human oversight of AI: approval gates, overrides and working emergency stops.
Numbers and dates to remember
- 4 November 2026: version 1.0 issued.
- 4 tiers; 8 risk factors scored 1 to 4; composite 8 to 32.
- Tier 2 and above: independent audits; Tier 4: CERT-In empanelled audit plus continuous monitoring.
- 6 hours to report AI-related incidents; 180 days of logs.
Where to go next
- CERT-In: the agency behind the guidelines.
- Agentic AI: what makes AI agents different and risky.
- Risk-based AI regulation: why rules scale with risk.
- Human oversight of AI: keeping people in control.
Go deeper: can audits make AI safe?
The strongest argument for the guidelines is that they make AI governance testable. Broad principles such as fairness and transparency are hard to enforce; a check that an agent cannot exceed its permissions, or that its emergency stop works, is not. By tying audit intensity to risk, the framework follows the logic of Risk-based AI regulation and avoids burdening low-risk uses.
The framework also fits India's existing cyber law. CERT-In already requires cyber incidents to be reported within six hours and logs to be kept for 180 days; the AI guidelines apply these to AI incidents. Its focus on Agentic AI responds to a real shift: systems that run code, send messages and move money on their own.
The weaknesses are practical. The document does not say how it will be enforced or what legal status it has. Audits by empanelled auditors cost money, and Tier 3 and Tier 4 audit teams must include at least one member with AI and machine learning competence. Firms may also understate risk to stay in a lower tier, which is why auditors must validate the tier and the higher one prevails.
A wider debate is whether audits can keep pace with AI that learns and changes. The guidelines answer with reassessment after material changes and continuous monitoring for critical systems, and with strong Human oversight of AI. Critics of audit-based regimes argue that they check paperwork more than behaviour; supporters reply that tests of permissions and stops are behavioural by design.
CERT-In
The agency behind the guidelines.
In one line: The Indian Computer Emergency Response Team is the national agency for responding to cybersecurity incidents, under the Ministry of Electronics and Information Technology.
What it does
CERT-In is designated under Section 70B of the Information Technology Act, 2000. It collects and analyses information on cyber incidents, issues alerts and advisories, coordinates responses and issues guidelines on security practices. It also empanels auditors who carry out security audits.
Its reporting rules
CERT-In's Directions of 2022 require organisations to report specified cyber incidents within six hours and to keep logs for 180 days.
Why it is in the news
On 4 November 2026 it issued AI Security Auditing Guidelines that extend its audit and reporting system to AI.
Where to go next
Agentic AI
What makes AI agents different and risky.
In one line: Agentic AI refers to systems that independently plan and execute a sequence of actions, using tools and services to reach a goal.
How it differs from a chatbot
A chatbot produces text when asked. An agent takes a goal, breaks it into steps, calls software tools, acts, observes the result and continues. It may remember past interactions and hand tasks to other agents.
New risks
- Excessive agency: doing more than it was allowed to do.
- Credential misuse: using stored passwords or keys wrongly.
- Persistent memory: retaining or leaking sensitive data.
- Prompt injection: hidden instructions that hijack it.
- Inter-agent communication: one compromised agent misleading others.
Why it is in the news
CERT-In's guidelines require audits to test these risks and to check that emergency stops work.
Where to go next
Risk-based AI regulation
Why rules scale with risk.
In one line: Risk-based regulation sets stricter rules for AI uses that can cause more harm, and lighter rules for low-risk uses.
The idea
Not all AI is equally dangerous. A tool that suggests songs is not like one that runs a hospital or a power grid. Risk-based rules first classify a system, then match controls to the class.
How CERT-In applies it
Eight factors, including impact, autonomy, data sensitivity, reversibility and exposure to attack, are each scored 1 to 4. The total (8 to 32) places a system in one of four tiers, from annual self-assessment for Low to empanelled audits with continuous monitoring for Critical. Escalation triggers can lift a system to a higher tier.
Where to go next
Human oversight of AI
Keeping people in control.
In one line: Human oversight means people remain accountable for an AI system and can approve, override or stop its actions.
Three models
- Human-in-the-loop: a person takes part in each decision.
- Human-on-the-loop: a person monitors and can step in.
- Human-over-the-loop: a person sets rules and reviews outcomes.
What CERT-In requires
Risk-based oversight with clear ownership, approval gates before consequential actions, manual override, emergency stops and logs of decisions and overrides. Auditors must check that these actually work.
Why it matters
As AI agents act faster than people, oversight that exists only on paper fails. Tested stops and approvals are the guard against an agent acting beyond its mandate.
Where to go next
Take the 6 November 2026 quiz: 30 Prelims-style questions with answers