CERT-In AI audit guidelines: 4 tiers, empanelled audits from Tier 2, legal force unstated

01Who it covers: anyone running AI in India, or on Indians' data

The scope is as wide as a document can make it. The guidelines cover “AI systems developed, procured, deployed or operated by organisations in India, as well as AI systems processing Indian data or providing AI-enabled services to Indian users”. Section 4.4 names micro, small and medium enterprises, large companies, government bodies and public-sector units, start-ups, and “Indian and international entities offering AI-as-a-Service”, which are “subject to audit obligations both as providers and as third-party vendors to their customers”.¹ A model is in scope whether it was built in-house, bought, downloaded as open weights or called through an API.

Three things are outside: AI used only for academic research that makes no decisions about people, purely rule-based automation with no machine learning, and consumer AI used for personal, non-commercial purposes. The last exclusion covers the user, not the company: “the providers of such AI tools operating in India remain within scope”.¹

The document arrives on top of earlier CERT-In work on AI. Its July 2025 audit-policy guidelines already listed AI system audits as an audit type, and its July 2025 technical guidelines defined an AI bill of materials; an April 2026 advisory warned of frontier AI that finds and chains vulnerabilities, a May blueprint covered AI-assisted exploitation, and an October advisory described AI agents used against Indian systems.³⁹⁵⁶⁷⁸

The guidelines draw on those earlier documents and on outside standards: ISO/IEC 42001 is the “primary alignment standard”, and the four-tier structure was informed by the EU AI Act’s risk model, the document says. It also maps itself onto MeitY’s India AI Governance Guidelines, describing that document as the policy layer and itself as the auditable one.¹ Our earlier reading of CERT-In’s October advisories on AI agents covers the attacks these controls are meant to catch.

02Eight scores decide the tier, and Tier 2 already means an empanelled auditor

Each AI system is scored from 1 (Low) to 4 (Critical) on eight factors: impact severity, autonomy, data sensitivity, scale and exposure, reversibility, sector criticality, adversarial exposure, and complexity and auditability. The scores are added. A total of 8 to 12 is Tier 1 (Low), 13 to 19 Tier 2 (Moderate), 20 to 26 Tier 3 (High) and 27 to 32 Tier 4 (Critical).¹ Scoring is deliberately conservative: factors are scored “without taking credit for claimed control effectiveness”, “missing evidence shall not justify a low score”, and where the auditor’s tier differs from the organisation’s, “the higher tier shall apply”.¹

The tier sets the minimum audit. Tier 1 needs only a self-assessment or basic internal review. Tier 2 needs a documented internal audit and an “independent audit by CERT-In empanelled auditing organisations at least annually”. Tier 3 calls for a periodic independent third-party audit, which one table attributes to empanelled organisations, and audits every six months where risk or material change warrants. Tier 4 needs an empanelled audit with continuous monitoring, board or senior-management oversight and red-team exercises.¹ Size does not lower the bar above Tier 2: “The security, safety, operational or systemic risk presented by an AI system does not diminish because the deploying organisation is small.”¹

03How an AI audit runs: six phases, nine domains, and tests a normal IT audit skips

Every engagement follows the same six phases, from a signed engagement letter to follow-up verification of fixes.¹ The substance is nine “core audit domains”: governance and accountability; data lifecycle, quality and privacy; model risk management; ethics, bias and fairness; explainability; security, adversarial resilience and incident reporting; continuous monitoring and drift; human oversight; and third-party and AI supply-chain assurance. At Tier 1 only governance and security are mandatory; from Tier 2 all nine are, plus the extra requirements for generative, retrieval-based, agentic, multimodal, multi-agent and autonomous systems wherever such a system is deployed.¹

Two rules close the obvious shortcuts. An auditor “shall not conclude that a control is effective solely on the basis of policy or design documentation”, and where a proprietary model or an API service blocks access, “absence of access shall not automatically be treated as evidence of conformity”: the auditor falls back on black-box testing and documents the residual risk.¹ Auditors may use AI tools themselves, but only with the auditee’s written authorisation before non-public information is processed, and AI-generated analysis is “not, by themselves, evidence that a control is implemented or effective”.¹

04The six-hour clock and the 180-day logs are the 2022 rules, restated

The numbers most likely to be quoted from the document are its reporting clock and its log retention. Its security domain asks for “AI-related security incidents reported within mandated timelines (6 hours)” and “forensic readiness with 180-day log retention”; its incident-response section says “AI incidents meeting CERT-In reportable criteria shall be reported within 6 hours”.¹ Both numbers come from CERT-In’s Directions of 28 April 2022, issued under section 70B(6) of the IT Act, which require service providers, intermediaries, data centres, body corporates and government organisations to report listed incidents “within 6 hours of noticing such incidents” and to keep logs of all ICT systems “for a rolling period of 180 days” within India.²

AI was already on the 2022 list. Annexure I of the Directions names 20 categories of mandatorily reportable incident; item xx is “attacks or malicious/suspicious activities affecting systems/servers/software/applications related to Artificial Intelligence and Machine Learning”.² The guidelines do not add a new category or a new clock. They make the existing duty something an auditor checks: whether a CERT-In reporting process exists and has been “tested for AI-specific scenarios”, and an absent one is their own example of a High finding.¹ They also say that an audit finding does not by itself trigger external reporting: “The classification of an audit finding alone shall not automatically determine whether external reporting is required.”¹

05What the text does not say: its legal force, its start date, and who has the auditors

The document is written in the language of obligation. It uses “shall” 300 times by our count, speaks of “compliance obligations” by tier, and refers to systems outside “the mandatory compliance scope”.¹ But it does not say where the obligation comes from. It contains no reference to section 70B of the IT Act, no effective date, no transition period, no enforcing authority and no consequence for not complying. It is titled “guidelines”, and says only that it is “intended for use by” government bodies, regulated entities, private organisations, AI developers and auditors.¹ CERT-In’s own audit-policy guidelines of July 2025 show what a stated legal basis looks like.³

The two documents meet in one place: the AI guidelines list the 2025 audit-policy guidelines among the CERT-In publications an auditor should consider, and the 2025 rules already bind empanelled firms in how they plan, conduct and report audits, with AI system audits among the types they list.¹³ Whether an organisation must commission the AI audit in the first place is what the new text leaves open. It also anticipates sector regulators: a tier must be reassessed “when a sectoral regulator issues new classification guidance or escalates minimum tier requirements”, and RBI, SEBI, IRDAI and TRAI are named among its intended users.¹