Share with your CISO
India’s cybersecurity regulator CERT-In has drawn a hard line on AI accountability, issuing comprehensive AI security audit guidelines that apply to every enterprise, public or private, operating AI systems in India. The rules mandate a six-hour incident reporting window, 180-day log retention, and structured audits across nine domains including model risk management, bias and fairness, and explainability. All AI deployments must be risk-classified into four tiers, with audit depth, human oversight requirements, and documentation standards scaling accordingly.
What this means for your business
The six-hour reporting clock is the sharpest edge here. Most enterprises running AI in India today don’t have incident response playbooks that distinguish an AI security event from a conventional breach, and that gap is now a compliance liability, not a future planning item. If your organization operates any AI system touching Indian users, government contracts, or Indian-domiciled data, the question isn’t whether these rules apply to you. It’s whether your current IR (incident response) infrastructure can even detect an AI-specific incident in time to report it.
The nine-domain audit framework is more demanding than it looks at first read. Covering governance, data lifecycle, model risk, bias, and explainability in a single audit cycle requires coordination across security, data, legal, and the business units owning the models. That’s not how most enterprise security audits are staffed today, where the CISO owns the process but model behavior and training data governance typically sit with the CDO or CTO. CERT-In is quietly mandating a cross-functional audit structure that most organizations haven’t built yet, and “audit-ready” becomes a shared accountability problem, not a security team checkbox.
India is now ahead of most Western jurisdictions in requiring mandatory AI-specific security audits rather than folding AI risk into existing cybersecurity frameworks. If this model spreads, and the EU AI Act’s risk-tier logic suggests it very likely will, then enterprises that build audit and logging infrastructure to satisfy CERT-In will have a reusable compliance foundation. The ones that treat this as an India-only edge case will pay to build the same capability twice. The leading indicator to watch is whether CERT-In publishes approved third-party auditor criteria, because that’s when enforcement teeth actually appear.
Based on reporting from Cert-In calls for AI security audits, six-hour incident reporting by firms | Artificial Intelligence News, originally published 2026-11-04 10:30:00.
