{
  "id": 18260520,
  "title": "Cert-In issues AI security audit guidelines, sets 4-tier risk framework",
  "url": "https://urgent.news/2026/11/05/cert-in-issues-ai-security-audit-guidelines-sets-4-tier-risk-framework",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-05T05:24:19.000Z",
  "source": {
    "name": "Hindustan Times",
    "slug": "hindustan-times",
    "url": "https://www.hindustantimes.com/india-news/certin-issues-ai-security-audit-guidelines-sets-4-tier-risk-framework-101793856260232.html"
  },
  "original_language": "en",
  "account": "India's cybersecurity agency, Cert-In, has released guidelines for auditing artificial intelligence (AI) systems, classifying them into four risk tiers based on factors such as autonomous decision-making, data sensitivity, and potential harm. Low-risk systems can be self-assessed or reviewed internally annually, while moderate, high, and critical systems require independent audits by Cert-In-approved auditors. High-risk and critical systems must be monitored continuously. The guidelines also mandate compliance requirements for AI-related incidents to be reported within six hours, with logs kept for 180 days. Organisations using generative AI must have policies against creating deepfakes and must label AI-generated media with content provenance labels. Additionally, AI systems must maintain an 'AI bill of materials' detailing the models, datasets, prompts, tools, and software used, tailored to the system's complexity and risk. Critical systems must undergo red-team attack exercises annually. Failure to comply with the guidelines may result in a fresh audit within three months if multiple critical problems are found or if an unsatisfactory opinion is given. While the guidelines do not specify legal provisions, intended users include regulators like the Reserve Bank of India, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India, and the Telecom Regulatory Authority of India.",
  "summary": "Cert-In emphasised that compliance requirements for high-risk and critical systems apply uniformly, with no exemptions or relaxed standards for smaller firms or startups.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Indian Express",
        "title": "CERT-In sets six-hour reporting deadline for AI security incidents",
        "url": "https://urgent.news/2026/11/05/cert-in-sets-six-hour-reporting-deadline-for-ai-security-incidents",
        "published": "2026-11-05T02:11:04.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}