CERT-In outlines four risk tiers for AI security audits

An AI audit framework released by the Indian Computer Emergency Response Team on November 4 sets out four risk tiers for systems developed or deployed in India. The 107-page guidance also covers organisations handling Indian data and foreign providers offering AI tools or services to Indian users.

The tiers are low, moderate, high and critical. Classification considers factors such as autonomous decisions, data sensitivity, the number of people affected and whether harm can readily be reversed.

The document was prepared by a working group at the cybersecurity agency. Its risk classifications determine the depth of security assessment expected for each system.

Independent checks for higher risks

Under the AI audit framework, low-risk systems can undergo self-assessment or a basic internal review. Moderate-risk systems are assigned annual independent audits by organisations empanelled with CERT-In.

High-risk and critical systems also require independent assessments by empanelled auditors, with continuous monitoring specified for critical deployments. The guidance provides no lighter standards for smaller firms or startups operating in those categories.

Critical systems should undergo annual red-team exercises. Where an audit finds at least two critical problems or delivers an unsatisfactory opinion, the document calls for another audit within three months.

The guidance brings AI-related incidents into existing reporting and recordkeeping expectations, including six-hour notification for reportable incidents and 180-day log retention. Production systems should also maintain records of their models, datasets, prompts, tools and software.

Generative AI operators are asked to prohibit non-consensual deepfakes of real people and use provenance labels for generated media. However, the document does not identify the legal provision under which it was issued, an implementation date or penalties for non-compliance, leaving those aspects unspecified.

Also read: Binance hack disclosure deepens Bitcoin fall below $77,000