Cert-In issues AI security audit guidelines, sets 4-tier risk framework

India's cybersecurity agency, Cert-In, has released guidelines for auditing artificial intelligence (AI) systems, classifying them into four risk tiers based on factors such as autonomous decision-making, data sensitivity, and potential harm. Low-risk systems can be self-assessed or reviewed internally annually, while moderate, high, and critical systems require independent audits by Cert-In-approved auditors.

High-risk and critical systems must be monitored continuously. The guidelines also mandate compliance requirements for AI-related incidents to be reported within six hours, with logs kept for 180 days. Organisations using generative AI must have policies against creating deepfakes and must label AI-generated media with content provenance labels.

Additionally, AI systems must maintain an 'AI bill of materials' detailing the models, datasets, prompts, tools, and software used, tailored to the system's complexity and risk. Critical systems must undergo red-team attack exercises annually. Failure to comply with the guidelines may result in a fresh audit within three months if multiple critical problems are found or if an unsatisfactory opinion is given.

While the guidelines do not specify legal provisions, intended users include regulators like the Reserve Bank of India, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India, and the Telecom Regulatory Authority of India.