The Daily PulseGeneral
Cert-In releases new rules for AI safety audits across India
Reported by Kunal Bhatia (Senior Writer) · Hindustan Times - India ·
Photo: Wikimedia CommonsNew AI Safety Rules
India's main cybersecurity agency has released a detailed 107-page rulebook to audit artificial intelligence systems. The document covers any group that builds, runs, or uses AI in the country, and also includes foreign firms that handle local data or offer AI tools to Indian users. A working group inside Cert-In put together these guidelines, which were made public on November 4.
Four Risk Tiers
The new system divides AI tools into four risk levels: low, moderate, high, and critical. This level depends on how much a tool acts on its own, the type of data it handles, how many people it touches, and the speed at which damage can be reversed. Low-risk tools need only a basic internal check. Moderate-risk tools require a yearly check by an outside auditor approved by Cert-In. High-risk and critical tools also need independent checks, while critical systems face round-the-clock monitoring. Smaller companies and startups get no special relaxations or exemptions for high-risk and critical systems.
Extra Requirements
Groups using generative AI must ban deepfakes of real people made without their permission, and must tag AI-generated media using standards like C2PA. Teams running live AI systems must keep an 'AI bill of materials' to track their models, data, prompts, and software. Autonomous AI tools face extra checks against prompt injection, and critical systems must undergo yearly red-team attack tests. If an audit fails or finds two or more major flaws, a new audit must happen within three months. The guidelines also apply Cert-In's older rules on reporting security breaches within six hours and keeping logs for 180 days to AI tools.
Context
The document mentions several financial and telecom watchdogs like the Reserve Bank of India and SEBI as intended users, but does not list the specific legal section behind the rules or set exact penalties for breaking them. Cert-In is India's national agency set up to handle computer security incidents, defend against cyber attacks, and issue advisory guidelines to protect the country's digital space.
ExplainerWhy this matters
What Happened
Cert-In issued comprehensive security auditing guidelines for artificial intelligence systems, setting a four-tier risk framework that mandates regular security assessments, specific technical logs, and deepfake policies for organizations operating in India.
Why It Matters
This framework introduces formal, binding-style oversight to the rapidly growing AI sector in India, ensuring that both domestic firms and foreign companies handling local user data adhere to rigorous safety standards. By mandating independent audits, strict record-keeping through an AI bill of materials, and strict rules against unauthorized deepfakes, the guidelines aim to protect consumers, prevent critical system failures, and hold developers accountable for autonomous AI behavior.
What Happens Next
Regulators and organizations are expected to align their internal compliance mechanisms with these guidelines, while developers and startups adjust their workflows to meet independent audit requirements. Observers will watch for further legal notifications clarifying penalties for non-compliance and how sector-specific regulators like the RBI and SEBI choose to enforce these standards.
More in General
Photo: Openverse - flickrGeneralSource: Hindustan TimesWorth knowing
Union Cabinet allows Agniveers who miss regular cut to stay on for two extra years
Reported by Kunal Bhatia (Senior Writer) · Hindustan Times - India ·
