Overview
- India’s national cybersecurity agency released the guidelines on November 4, 2026, establishing a four‑tier risk framework—Low, Moderate, High and Critical—that determines how often and how deeply AI systems must be audited.
- The rules require organisations to report AI‑related security incidents to Cert‑In within six hours and to retain time‑synchronised logs for 180 days to support forensic investigations.
- Audits must cover nine lifecycle domains from governance and data quality to model risk and explainability, and Moderate, High and Critical systems must use independent auditors empanelled by Cert‑In.
- The guidance adds special controls for generative and agentic AI, including red‑team testing for critical systems, provenance labels for AI‑generated content, and an ‘AI bill of materials’ listing models, data and tools.
- The document applies to any entity handling Indian data, including foreign providers, but it does not state the legal authority, penalties or formal enforcement process for non‑compliance, leaving legal exposure and implementation details unclear for firms.