Short answer: CERT-In's new AI Security Auditing Guidelines, dated 4 November 2026, give every AI system a score out of 32 and place it in one of four risk tiers, from a simple self-check to independent audits with continuous monitoring. They say they apply to organisations of every size, including ones that only use AI through a vendor. Whether or not they become binding, an afternoon spent placing your own AI tools in a tier is the cheapest way to see where you stand.
What CERT-In published
The document runs to 107 pages and was prepared by a sub-group of CERT-In's working group on Indian cybersecurity auditing standards. It sets out the risk scoring, nine audit domains (from governance and data privacy to human oversight and third-party supply chain, as TeamLease RegTech lists them), and checklists for auditors.
Two scope points matter for an owner.
First, it isn't only about companies that build AI. The guidelines cover AI developed in-house, bought from third parties, used through APIs or cloud services, or built on open-source models. They say the framework applies to all types and sizes of organisations operating AI in India or processing Indian citizens' data. AI vendors serving Indian customers carry obligations too, both as providers and as suppliers to their customers.
Second, plain automation is out. Purely rule-based systems, such as traditional RPA with no machine learning, aren't treated as AI. Anything that mixes rules with a model is in.
On legal status, be careful. TeamLease RegTech notes that the text it reviewed doesn't set a commencement date or make the guidelines mandatory. The PDF itself is labelled guidelines, version 1.0. So this is a strong signal of what auditors, large customers and regulators will ask for, not yet a deadline.
How the scoring works
Under section 5 of the guidelines, each AI system is scored from 1 (low) to 4 (critical) on eight factors:
- Impact: what happens if an output is wrong or the system is compromised.
- Autonomy: whether it only suggests, or takes actions itself.
- Data sensitivity: public data, personal data, or financial and health data.
- Scale and exposure: a few internal users, or many customers.
- Reversibility: how hard it is to undo a bad output or action.
- Criticality: whether it supports a core or regulated function.
- Adversarial exposure: internal only, or open to the internet.
- Complexity: how easy it is to understand and check.
The total decides the tier: 8–12 is Tier 1 (Low), 13–19 is Tier 2 (Moderate), 20–26 is Tier 3 (High) and 27–32 is Tier 4 (Critical).
The minimum audit for each:
- Tier 1: a self-assessment or basic internal review with documented evidence, and a designated owner.
- Tier 2: a documented internal audit, plus an independent audit by a CERT-In empanelled auditor at least annually.
- Tier 3: periodic independent third-party audits by empanelled auditors, every six months where risk or material change warrants.
- Tier 4: independent audit with continuous monitoring.
There's relief for small firms at the bottom and none at the top. MSMEs running Tier 1 systems can use a simplified self-assessment. But the guidelines say Tier 3 and 4 systems must meet full obligations regardless of company size, because the risk "does not diminish because the deploying organisation is small."
The line that moves a tool up a tier
Autonomy is where most businesses will feel this. The guidelines tell the auditor or system owner to consider moving a system up a tier if it can, among other things, execute code, transactions or external communications on its own, has privileged access to production systems or sensitive data, or can't be reliably stopped or rolled back.
In practice, an AI that drafts a customer reply for a person to check and send is a bounded recommendation inside a human workflow. The same AI sending the reply itself, or sending payment reminders without anyone looking, is initiating actions. Same model, different tier.
For agents, the auditor checklist asks for least-privilege permissions, human approval gates and a kill switch. If your agents still share a staff member's login, our guide to giving an AI agent its own login covers the first step.
Place your AI in an afternoon
You don't need an auditor to do a first pass.
1. List every AI system in use. Include features inside software you already pay for, AI APIs your developers call, and anything a vendor runs for you. Skip pure rule-based automation.
2. Score each one on the eight factors. Be honest about autonomy and data. The guidelines say actual capabilities should be checked, not inferred from policy statements.
3. Flag the ones that act on their own. Anything that sends messages, moves money, changes records or runs code goes on a separate list, even if its score looks low.
4. Check your vendor contracts. For AI suppliers, auditors are told to look for contracts that cover incident notification, notice of changes on the provider's side, and audit or assurance rights. For critical AI dependencies, they also expect documented exit and fallback arrangements.
5. Sort out logs and reporting. The guidelines expect AI incidents that meet CERT-In's reportable criteria to be reported within six hours, with 180-day log retention. If your AI tool doesn't keep logs you can get at, find out now.
6. Name an owner for each system. Even Tier 1 asks for a designated owner. In a 50-person company, the head of the team that uses the tool is a sensible choice.
If your AI only suggests and stays internal, expect it to land in Tier 1 or 2. The useful part is finding the one or two tools that have quietly started acting on their own, and deciding whether a person should be approving what they do.
Arthat AI
Working on something similar at your company?
Arthat AI builds these automations for Indian businesses every week. If you want to talk through whether this fits your situation, we'll give you a straight answer — even if the answer is "don't build it."
