---
title: "CERT-In AI audit guidelines: 4 tiers, empanelled audits from Tier 2, legal force unstated"
summary: "What CERT-In’s 107-page AI Security Auditing Guidelines of 4 November ask, and of whom: four risk tiers, nine audit domains, a six-hour clock from 2022, and no stated legal force."
url: https://www.thetechbag.com/blog/cert-in-ai-audit-guidelines-four-tiers
format: Analysis
desk: "Security"
area: "Risk & compliance"
region: India
published: 2026-11-06
facts_checked: 2026-11-06
author: TechBag (The TechBag Journal)
tags: ["CERT-In","AI Security Auditing Guidelines","AI audit","risk tiering","empanelled auditors","CERT-In Directions 2022","six-hour reporting","log retention","section 70B","prompt injection","data poisoning","model extraction","AIBOM","ISO/IEC 42001","EU AI Act","India AI Governance Guidelines","agentic AI","RAG"]
cover: https://www.thetechbag.com/blog/covers/cert-in-ai-audit-guidelines-four-tiers.png
---

# CERT-In AI audit guidelines: 4 tiers, empanelled audits from Tier 2, legal force unstated

*What CERT-In’s 107-page AI Security Auditing Guidelines of 4 November ask, and of whom: four risk tiers, nine audit domains, a six-hour clock from 2022, and no stated legal force.*

Analysis · Security · Risk & compliance · By TechBag · Published 2026-11-06 · Facts checked 2026-11-06 · Canonical: https://www.thetechbag.com/blog/cert-in-ai-audit-guidelines-four-tiers

The short version

1. CERT-In’s AI Security Auditing Guidelines, dated 4 November, sort every AI system into four risk tiers by scoring eight factors from 1 to 4. From Tier 2 (Moderate) upwards, the minimum is an independent audit by a CERT-In-empanelled auditing organisation “at least annually”; Tier 4 (Critical) adds continuous monitoring.[1]
2. The document says it “applies universally to all types and sizes of organisations operating AI systems within India or processing Indian citizens’ data”. It does not cite a legal basis, an effective date or a penalty, and is titled “guidelines”; CERT-In’s 2025 audit-policy guidelines, by contrast, say they are binding under section 70B of the IT Act.[1][3]
3. The six-hour reporting clock and 180-day log retention it lists are not new: they are the April 2022 Directions, which already name attacks on AI and machine-learning systems as reportable. What is new is the audit itself: nine domains, a six-phase method and tests for prompt injection, data poisoning and model extraction.[1][2]

On 4 November CERT-In, India’s national computer emergency response team, published a 107-page framework for auditing AI systems, prepared by a working group on “Indian Standards for Cybersecurity Auditing”.[1] The same day it issued an advisory on AI-driven attacks on lenders, which [we covered on 5 November](https://www.thetechbag.com/blog/cert-in-crafty-falcon-nbfc-payment-attacks). A company running a chatbot, a credit model or an AI agent in India now wants to know four things: does this apply to me, how would my system be classified, what does an AI audit actually test, and is any of it compulsory. This piece answers each from the document’s own text, and says where the text is silent.

## Who it covers: anyone running AI in India, or on Indians' data

The scope is as wide as a document can make it. The guidelines cover “AI systems developed, procured, deployed or operated by organisations in India, as well as AI systems processing Indian data or providing AI-enabled services to Indian users”. Section 4.4 names micro, small and medium enterprises, large companies, government bodies and public-sector units, start-ups, and “Indian and international entities offering AI-as-a-Service”, which are “subject to audit obligations both as providers and as third-party vendors to their customers”.[1] A model is in scope whether it was built in-house, bought, downloaded as open weights or called through an API.

Three things are outside: AI used only for academic research that makes no decisions about people, purely rule-based automation with no machine learning, and consumer AI used for personal, non-commercial purposes. The last exclusion covers the user, not the company: “the providers of such AI tools operating in India remain within scope”.[1]

The document arrives on top of earlier CERT-In work on AI. Its July 2025 audit-policy guidelines already listed AI system audits as an audit type, and its July 2025 technical guidelines defined an AI bill of materials; an April 2026 advisory warned of frontier AI that finds and chains vulnerabilities, a May blueprint covered AI-assisted exploitation, and an October advisory described AI agents used against Indian systems.[3][9][5][6][7][8]

**Figure: The audit guidelines follow a run of CERT-In AI publications since July 2025**

*Selected CERT-In publications on AI security and audit, by date of issue, July 2025 to November 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 25 Jul 2025 | Audit policy guidelines | Name AI system audits and AIBOM audits as audit types; binding on empanelled auditors |
| 26 Apr 2026 | Frontier AI advisory | CIAD-2026-0020: AI that finds and chains vulnerabilities at speed |
| 25 May 2026 | AI exploitation blueprint | 38 pages on cutting exposure to AI-assisted exploitation |
| 15 Oct 2026 | AI agents advisory | CIAD-2026-0049: agents as attack vectors against Indian systems |
| 4 Nov 2026 | AI audit guidelines | 107 pages, four tiers; CRAFTY FALCON advisory the same day |

Source: CERT-In audit policy guidelines (25 July 2025), CIAD-2026-0020, AI exploitation blueprint, CIAD-2026-0049, CIAD-2026-0058, AI Security Auditing Guidelines · as of 6 November 2026 · Selected by TechBag. Not shown: AIBOM technical guidelines v2.0 (9 July 2025) and other AI-related advisories

The guidelines draw on those earlier documents and on outside standards: ISO/IEC 42001 is the “primary alignment standard”, and the four-tier structure was informed by the EU AI Act’s risk model, the document says. It also maps itself onto MeitY’s India AI Governance Guidelines, describing that document as the policy layer and itself as the auditable one.[1] Our earlier [reading of CERT-In’s October advisories on AI agents](https://www.thetechbag.com/blog/cert-in-ai-agents-no-victim-noticed) covers the attacks these controls are meant to catch.

## Eight scores decide the tier, and Tier 2 already means an empanelled auditor

Each AI system is scored from 1 (Low) to 4 (Critical) on eight factors: impact severity, autonomy, data sensitivity, scale and exposure, reversibility, sector criticality, adversarial exposure, and complexity and auditability. The scores are added. A total of 8 to 12 is Tier 1 (Low), 13 to 19 Tier 2 (Moderate), 20 to 26 Tier 3 (High) and 27 to 32 Tier 4 (Critical).[1] Scoring is deliberately conservative: factors are scored “without taking credit for claimed control effectiveness”, “missing evidence shall not justify a low score”, and where the auditor’s tier differs from the organisation’s, “the higher tier shall apply”.[1]

The tier sets the minimum audit. Tier 1 needs only a self-assessment or basic internal review. Tier 2 needs a documented internal audit and an “independent audit by CERT-In empanelled auditing organisations at least annually”. Tier 3 calls for a periodic independent third-party audit, which one table attributes to empanelled organisations, and audits every six months where risk or material change warrants. Tier 4 needs an empanelled audit with continuous monitoring, board or senior-management oversight and red-team exercises.[1] Size does not lower the bar above Tier 2: “The security, safety, operational or systemic risk presented by an AI system does not diminish because the deploying organisation is small.”[1]

**Figure: On our scoring, an online shop's product recommender lands in Tier 2, the first tier with an empanelled audit**

*Composite risk score out of 32 for three illustrative AI systems, scored by TechBag on the guidelines' eight factors, November 2026*

Internal HR-policy chatbot

Tier 1

12

Every factor scored Moderate

Tier 2

16

Online shop's product recommender

Tier 2

18

Bank's customer-service chatbot

Tier 3

21

|  | Value |
| --- | --- |
| Internal HR-policy chatbot | 12 |
| Every factor scored Moderate | 16 |
| Online shop's product recommender | 18 |
| Bank's customer-service chatbot | 21 |

Source: CERT-In, AI Security Auditing Guidelines, Tables 11 and 12 (factors and calibration), composite-score table; scoring by TechBag · as of 6 November 2026 · Illustration, not a CERT-In classification. Tier bands: 8–12 Low, 13–19 Moderate, 20–26 High, 27–32 Critical

TechBag countTechBag count: how we scored the examples

We applied the document’s calibration guide factor by factor. The HR chatbot scores 1 on autonomy, scale, reversibility, criticality and exposure, 2 on impact and data, and 3 on complexity (a large language model is “complex or partially opaque”): 12. The recommender scores 3 on scale, exposure and complexity, 2 on impact, autonomy, data and criticality, and 1 on reversibility: 18. The bank chatbot scores 3 on data, scale, criticality, exposure and complexity and 2 on the other three: 21. An auditor could score any factor differently; the point is how quickly a customer-facing model reaches Tier 2.

## How an AI audit runs: six phases, nine domains, and tests a normal IT audit skips

Every engagement follows the same six phases, from a signed engagement letter to follow-up verification of fixes.[1] The substance is nine “core audit domains”: governance and accountability; data lifecycle, quality and privacy; model risk management; ethics, bias and fairness; explainability; security, adversarial resilience and incident reporting; continuous monitoring and drift; human oversight; and third-party and AI supply-chain assurance. At Tier 1 only governance and security are mandatory; from Tier 2 all nine are, plus the extra requirements for generative, retrieval-based, agentic, multimodal, multi-agent and autonomous systems wherever such a system is deployed.[1]

**Figure: An AI audit runs in six phases, and the auditor re-scores the tier before testing anything**

*The audit lifecycle in CERT-In's AI Security Auditing Guidelines, with each phase's main deliverable, as published 4 November 2026*

Step 1 of 6

1. Engagement initiation

Objectives, audit type (initial, periodic, re-audit or special) and a signed engagement letter. The auditor confirms independence: no conflict of interest with the AI systems audited.

Source: CERT-In, AI Security Auditing Guidelines v1.0, section 7 and section 12 · as of 6 November 2026

Two rules close the obvious shortcuts. An auditor “shall not conclude that a control is effective solely on the basis of policy or design documentation”, and where a proprietary model or an API service blocks access, “absence of access shall not automatically be treated as evidence of conformity”: the auditor falls back on black-box testing and documents the residual risk.[1] Auditors may use AI tools themselves, but only with the auditee’s written authorisation before non-public information is processed, and AI-generated analysis is “not, by themselves, evidence that a control is implemented or effective”.[1]

## The six-hour clock and the 180-day logs are the 2022 rules, restated

The numbers most likely to be quoted from the document are its reporting clock and its log retention. Its security domain asks for “AI-related security incidents reported within mandated timelines (6 hours)” and “forensic readiness with 180-day log retention”; its incident-response section says “AI incidents meeting CERT-In reportable criteria shall be reported within 6 hours”.[1] Both numbers come from CERT-In’s Directions of 28 April 2022, issued under section 70B(6) of the IT Act, which require service providers, intermediaries, data centres, body corporates and government organisations to report listed incidents “within 6 hours of noticing such incidents” and to keep logs of all ICT systems “for a rolling period of 180 days” within India.[2]

**Figure: The reporting and log rules already apply to AI; the audit cycle and AI testing are what the guidelines add**

*Time limits named in CERT-In's AI Security Auditing Guidelines (4 November 2026) and their source*

6 hours

to report an AI incident that meets CERT-In's reportable criteria

2022 Directions, restated

180 days

of logs kept, synchronised in time across all AI components

2022 Directions, restated

Yearly

minimum independent audit by an empanelled organisation, from Tier 2

New in the guidelines

12 months

within which the last AI-specific VAPT must fall, on the auditor's checklist

New in the guidelines

Source: CERT-In AI Security Auditing Guidelines v1.0 (sections 5.4, 8.6, 10.6); CERT-In Directions under section 70B(6), 28 April 2022 · as of 6 November 2026

AI was already on the 2022 list. Annexure I of the Directions names 20 categories of mandatorily reportable incident; item xx is “attacks or malicious/suspicious activities affecting systems/servers/software/applications related to Artificial Intelligence and Machine Learning”.[2] The guidelines do not add a new category or a new clock. They make the existing duty something an auditor checks: whether a CERT-In reporting process exists and has been “tested for AI-specific scenarios”, and an absent one is their own example of a High finding.[1] They also say that an audit finding does not by itself trigger external reporting: “The classification of an audit finding alone shall not automatically determine whether external reporting is required.”[1]

## What the text does not say: its legal force, its start date, and who has the auditors

The document is written in the language of obligation. It uses “shall” 300 times by our count, speaks of “compliance obligations” by tier, and refers to systems outside “the mandatory compliance scope”.[1] But it does not say where the obligation comes from. It contains no reference to section 70B of the IT Act, no effective date, no transition period, no enforcing authority and no consequence for not complying. It is titled “guidelines”, and says only that it is “intended for use by” government bodies, regulated entities, private organisations, AI developers and auditors.[1] CERT-In’s own audit-policy guidelines of July 2025 show what a stated legal basis looks like.[3]

**Figure: CERT-In's 2025 audit rules say they bind; its AI audit guidelines do not say either way**

*What two CERT-In audit documents state about their own authority, July 2025 and November 2026*

AI audit guidelines, November 2026

- No section on the authority under which they are issued
- No effective date, transition period or review date
- No enforcing body and no consequence for non-compliance
- “Intended for use by” organisations and auditors; scope stated as universal

Audit policy guidelines, July 2025

- Section 2, “Authority for Issuance”, cites section 70B(1), (4), (6) and (7) of the IT Act
- “Binding on all CERT-In empanelled auditing organizations and auditee entities covered under the relevant provisions”
- A section on “Consequences of Non-Compliance” (section 19)
- Already lists “Artificial Intelligence (AI) System Audits” and AIBOM audits as audit types

Source: CERT-In, AI Security Auditing Guidelines v1.0 (4 November 2026); Comprehensive Cyber Security Audit Policy Guidelines v1.0 (25 July 2025), sections 2 and 4 · as of 6 November 2026 · TechBag text search of the 2026 document found no mention of section 70B, an effective date or a penalty

The two documents meet in one place: the AI guidelines list the 2025 audit-policy guidelines among the CERT-In publications an auditor should consider, and the 2025 rules already bind empanelled firms in how they plan, conduct and report audits, with AI system audits among the types they list.[1][3] Whether an organisation must commission the AI audit in the first place is what the new text leaves open. It also anticipates sector regulators: a tier must be reassessed “when a sectoral regulator issues new classification guidance or escalates minimum tier requirements”, and RBI, SEBI, IRDAI and TRAI are named among its intended users.[1]

TechBag countTechBag count: 228 empanelled auditing organisations

CERT-In’s list of empanelled information security auditing organisations, as published on 6 November 2026, numbers 228 organisations. The list does not say which of them audit AI systems. The four firms whose staff the guidelines acknowledge as working-group contributors (G-Info Technology Solutions, Shieldbyte Infosec, Dr CBS Cyber Security Services and The Intect, Hion Security) are all on it.[4][1] How many AI systems in India would score Tier 2 or above, and so need one of these firms each year, nobody has published.

Our viewOur view: what to watch

Whether CERT-In issues a direction under section 70B(6) that refers to these guidelines, as its 2022 Directions did for incident reporting; whether RBI, SEBI or IRDAI cite them in sector rules; and whether CERT-In’s empanelment criteria start to name AI audit competence, which the guidelines define for Tier 3 and 4 teams.[1][2]

India: what a team running AI can do before anyone asks for an audit

Two obligations bind today, whatever happens to the guidelines: an attack on an AI or machine-learning system is a reportable incident under the 2022 Directions, to be reported to CERT-In within six hours, and the logs that would show it must be kept for 180 days in India.[2] If your AI incidents do not yet reach your CERT-In reporting process, that is the first gap, and the guidelines name it as a High finding.[1]

The rest is preparation the document describes step by step: an inventory of every AI system with an owner and a tier, scored on the eight factors; an AI bill of materials listing models, versions, hashes, datasets, prompts and tool connections; and a record of prompt-injection and adversarial tests. On our scoring in section 2, a customer-facing model lands in Tier 2 or above, the point at which the guidelines expect an empanelled auditor every year.[1] The document says nothing about audit fees, and mentions the Digital Personal Data Protection Act only in its definitions and in what auditors should know. Lenders and other regulated firms should read it alongside the [BFSI obligations already in force](https://www.thetechbag.com/industries/bfsi/obligations).

How we did this

Figures as of 6 November 2026, 7pm IST

We read the AI Security Auditing Guidelines in full (107 pages) and quote them directly; the tier thresholds, audit minimums, phases and finding timelines are the document’s. The comparison of the six-hour and 180-day rules is with the Directions of 28 April 2022, read in full. The binding-force comparison uses sections 2 and 4 of CERT-In’s July 2025 audit policy guidelines; “no mention of section 70B, an effective date or a penalty” and the count of 300 uses of “shall” are text searches of CERT-In’s PDF. The scores in Figure 2 are ours, from the document’s calibration guide, and are an illustration rather than a classification. The count of 228 empanelled organisations is from the numbered list in CERT-In’s PDF as published on 6 November. Where the guidelines’ tables differ (Tier 3 is “independent third-party” in one and “CERT-In empanelled” in another), we say so. Not used: coverage describing the guidelines as mandatory.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [CERT-In, Artificial Intelligence (AI) Security Auditing Guidelines, v1.0 (107 pages)](https://www.cert-in.org.in/PDF/AI_Security_Auditing_Guidelines.pdf) — 4 November 2026
2. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (six-hour reporting; 180-day logs; Annexure I item xx)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 Effective 60 days after issue.
3. [CERT-In, Comprehensive Cyber Security Audit Policy Guidelines, v1.0 (sections 2, 4 and 6; section 19 heading)](https://www.cert-in.org.in/PDF/Comprehensive_Cyber_Security_Audit_Policy_Guidelines.pdf) — 25 July 2025
4. [CERT-In, Empanelled Information Security Auditing Organisations (list of 228)](https://www.cert-in.org.in/PDF/Empanel_org.pdf) — as published 6 November 2026
5. [CERT-In, CIAD-2026-0020: Defending Against Frontier AI Driven Cyber Risks](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0020) — 26 April 2026
6. [CERT-In, Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure, v1.0](https://www.cert-in.org.in/PDF/Blueprint_for_Defending_against_AI_Assisted_Exploitation.pdf) — 25 May 2026
7. [CERT-In, CIAD-2026-0049: AI Agents as Attack Vectors](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049) — 15 October 2026
8. [CERT-In, CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor "CRAFTY FALCON"](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058) — 4 November 2026
9. [CERT-In, Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, v2.0](https://www.cert-in.org.in/PDF/TechnicalGuidelines-on-SBOM,QBOM&CBOM,AIBOM_and_HBOM_ver2.0.pdf) — 9 July 2025

Related on TechBag: the [Aquila I AI red-teaming](https://www.thetechbag.com/aquilai/aquilai-ai-red-teaming) and [Prisma AIRS](https://www.thetechbag.com/palo-alto/prisma-airs) pages, on tools for the prompt-injection and adversarial tests the guidelines list.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [CERT-In names ‘CRAFTY FALCON’: NBFCs that remediated were attacked again](https://www.thetechbag.com/blog/cert-in-crafty-falcon-nbfc-payment-attacks) — CERT-In’s other AI document of 4 November: an advisory naming CRAFTY FALCON, four AI tools and ₹1 test transfers against lenders.

Go deeper on TechBag

- [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the six-hour reporting and log rules already in force for lenders
- [Aquila I AI Red Teaming](https://www.thetechbag.com/aquilai/aquilai-ai-red-teaming) — an Indian vendor's tool that attacks LLM apps, RAG pipelines and agents, the tests the guidelines list
- [Palo Alto Networks Prisma AIRS](https://www.thetechbag.com/palo-alto/prisma-airs) — AI discovery and model scanning, two controls the audit domains ask about