CERT-In AI Security Auditing Guidelines: Risk Tiers, Audit Phases and Checklist
CERT-In’s AI Security Auditing Guidelines v1.0 sort every AI system into four risk tiers that decide how it must be audited. Here is what the framework covers and a 7-step checklist to prepare.
Image: TeQBlogs
CERT-In’s new AI security auditing guidelines, released on 4 November 2026, give Indian organisations a common way to check whether their AI systems are secure, fair and accountable. The framework sorts every AI system into one of four risk tiers, and the tier decides how deep the audit goes and whether an independent CERT-In empanelled auditor is needed. If your business uses chatbots, AI agents, RAG search or any machine-learning model, the first job is simple: list your AI systems and work out their tier.
Quick summary
- Document: “Artificial Intelligence (AI) Security Auditing Guidelines: Framework for Secure, Ethical and Auditable Artificial Intelligence Systems”, v1.0, dated 4 November 2026.
- Who it covers: organisations of every size that run AI in India or process Indian citizens’ data, including MSMEs, startups, large enterprises, government bodies and AI service providers.
- How it works: four risk tiers, eight risk factors, nine core audit domains and a six-phase audit process.
- Incident reporting: AI-related security incidents are to be reported to CERT-In within the 6-hour timeline, with logs kept for at least 180 days.
- First step: build an AI inventory and score each system.
What are CERT-In’s AI security auditing guidelines?
They are a risk-based framework for auditing AI systems across their whole life, from design and procurement to decommissioning. The guidelines aim to make scoping, evidence collection, technical testing, finding classification and remediation checks consistent, so that different auditors reach comparable results.
The scope is wide. It covers predictive and generative AI, RAG systems, foundation models, multimodal systems, AI-as-a-service, and agentic and multi-agent systems. It applies whether the model was built in-house, bought from a vendor, downloaded as open weights or used through an API. Academic research systems (until they reach pilot or production), simple rule-based automation and people’s personal use of consumer AI are excluded, though companies that provide consumer AI in India remain in scope.
Also read: Beginners guide: What is VoIP and how does it work? (Explained)
The guidelines were published the same week CERT-In warned BFSI firms about AI-assisted attacks; read our report on the Crafty Falcon campaign for that side of the story.
The four AI risk tiers and what each needs
Each AI system is scored from 1 to 4 on eight inherent-risk factors, without credit for existing controls. The total, between 8 and 32, places it in a tier.
| Composite score | Tier | Minimum audit requirement |
|---|---|---|
| 8–12 | Tier 1 (Low) | Self-assessment or basic internal review |
| 13–19 | Tier 2 (Moderate) | Documented internal audit, plus a CERT-In empanelled independent audit at least once a year |
| 20–26 | Tier 3 (High) | Periodic independent third-party audit by a CERT-In empanelled organisation |
| 27–32 | Tier 4 (Critical) | Independent CERT-In empanelled audit with continuous monitoring |
The eight factors are impact severity, autonomy and actionability, data sensitivity, scale and exposure, reversibility, operational or sector criticality, adversarial exposure, and complexity and auditability. Some triggers push a system up regardless of score, such as safety-critical autonomous actions, impact on critical infrastructure, irreversible harm or privileged access to production.
Tiers must be reassessed at least once a year and after major changes or incidents. MSMEs may use simpler methods for Tier 1 and Tier 2 systems, but Tier 3 and Tier 4 obligations apply whatever the company’s size.
Nine audit domains in the AI security auditing guidelines
Auditors look at nine core domains. For Tier 1, only governance and security are mandatory; for Tiers 2 to 4, all core domains apply.
- AI governance and accountability
- Data lifecycle, quality and privacy
- Model risk management
- AI ethics, bias and fairness
- Explainability and transparency
- Security, adversarial resilience and incident reporting
- Continuous monitoring, drift management and validation
- Human oversight and decision accountability
- Third-party and AI supply-chain assurance
Further sections deal with risks specific to modern AI, including prompt injection, sensitive information disclosure, excessive agency, data and model poisoning, unsafe tool use, persistent memory, communication between agents and improper output handling. If you run AI agents, our guide to AI agent security covers practical fixes for several of these.
The six phases of a CERT-In AI audit
Every engagement, whether initial, periodic, a re-audit or a special audit after an incident, follows six phases:
- Engagement initiation: mandate, terms, auditor independence and stakeholders.
- Risk assessment and scoping: review the AI inventory and validate tiers; where views differ, the higher tier applies.
- Detailed planning: audit programme, evidence requests, sampling and a technical testing plan.
- Fieldwork and evidence collection: test whether controls are designed and working, and record working papers.
- Analysis and findings: root-cause analysis and severity rating (Critical, High, Moderate, or Low/Observation).
- Reporting and follow-up: final report, tracking of corrective actions and follow-up checks.
For Tier 3 and Tier 4 systems, a single auditor is not allowed. The team must include at least one person with AI/ML skills and one with a professional audit certification, such as CISA, CIA or ISO 27001 Lead Auditor. The guidelines also say lack of access is not evidence of conformity: if a vendor will not share details, auditors must use other evidence, such as black-box testing, and record the remaining risk.
How to prepare your business: a 7-step checklist
These steps follow the documents and evidence the guidelines ask auditors to request before an audit.
- Make an AI inventory. List every AI system, including vendor chatbots, copilots, APIs and open-source models, with its owner and purpose.
- Score each system on the eight factors and record its tier and the reasons.
- Write down governance: an AI policy, a committee or owner, and a RACI chart showing who approves what.
- Document data and models: data sources and permissions, model cards, version logs and validation reports.
- Test security: keep a threat model and adversarial or VAPT reports, and check for prompt injection and data leakage.
- Set up logging and reporting: keep logs for at least 180 days and make sure staff know how to report an AI security incident to CERT-In within 6 hours.
- Check suppliers: due diligence on AI vendors, an AIBOM/SBOM where possible, contract terms and an exit plan.
Small teams that need help with security testing or log monitoring can look at Suprams’ cybersecurity services. Website owners may also want to read our guide on opting out of AI training crawlers, a separate but related data-control step.
Which standards does the framework map to?
The guidelines reference well-known frameworks, so work already done for them can be reused. These include ISO/IEC 42001 (AI management systems), the NIST AI Risk Management Framework, ISO/IEC 25012 and ISO/IEC 5259 for data quality, IEEE P7003 for algorithmic bias, NITI Aayog’s AI principles, and MITRE ATLAS and the OWASP ML/LLM Top 10 for security testing.
Frequently asked questions
When did CERT-In release the AI security auditing guidelines?
CERT-In released version 1.0 on 4 November 2026.
Do the guidelines apply to small businesses?
Yes. They cover organisations of all sizes, including MSMEs and startups. MSMEs can use simpler approaches for Tier 1 and 2 systems, but Tier 3 and 4 rules apply regardless of size.
Does every AI system need an external audit?
No. Tier 1 systems need only a self-assessment or basic internal review. Tier 2 adds an annual independent audit, and Tiers 3 and 4 need audits by a CERT-In empanelled organisation.
How fast must AI security incidents be reported?
The guidelines say AI-related security incidents must be reported within CERT-In’s mandated 6-hour timeline, and logs should be retained for at least 180 days.
Bottom line
CERT-In’s AI security auditing guidelines turn AI risk into something you can measure: score the system, find its tier, and audit the domains that tier requires. Start with an inventory this month, fix logging and incident reporting first, and keep the evidence auditors will ask for.
Sources
- CERT-In: Artificial Intelligence (AI) Security Auditing Guidelines (guideline page)
- CERT-In: AI Security Auditing Guidelines v1.0 (PDF)
About The Author
