CERT-In issues AI security audit guidelines with six-hour incident reporting rule
Published · Updated
What happened
CERT-In published an AI security audit framework for organizations deploying or operating AI systems in India. The guidance introduces risk-based categorization, incident reporting within six hours, traceability requirements for training data and model changes, and a 180-day log-retention rule.
Why it matters
The guideline gives Indian regulators and regulated entities a new compliance baseline for AI security operations. It can change incident reporting workflows, vendor contracts, record-keeping practices, and audit scope for firms building or using AI systems in India.
On November 6, 2026, CERT-In issued AI security audit guidelines that set a six-hour deadline for reporting AI-related security incidents. The framework classifies AI systems into four risk tiers based on factors including autonomy and data sensitivity, and sets audit requirements across nine domains such as governance, privacy, and model risk management. It also requires organizations to maintain traceability for training data and system changes and to retain security logs for at least 180 days.
Watch for
CERT-In publication of the full AI audit guideline text or implementation FAQ on or after 2026-11-07 MeitY clarification on whether the six-hour rule applies to all AI deployments or only notified entities on or after 2026-11-07 NASSCOM or Data Security Council of India issuance of member compliance guidance on log retention, traceability, and reporting within 72 hours Large Indian AI or IT services firms updating incident-response disclosures or customer contract terms by 2026-11-10
Sources
- Weekly Tech Roundup: 10 key developments (Nov 2-6, 2026) · livemint.com
Researched and written by AI from the sources listed, under published rules. How V³ Aware is made