E-MagazineGovt releases new AI security rules: Here is what changes for organisations in India
CERT-In has introduced four AI risk levels: Low, Moderate, High and Critical.
AI security audits will cover nine key areas, including data privacy, fairness and cybersecurity.
The guidelines also address risks linked to chatbots, AI agents and generative AI tools.
The Indian Computer Emergency Response Team (CERT-In) has recently shared a new set of Artificial Intelligence (AI) Security Auditing Guidelines. The authorities clarified that with these guidelines they want to ensure that the organisations check whether their AI systems are secure, fair and accountable.. The 107-page document provides a common framework for auditing AI tools used by organisations in India. It also covers AI systems that handle Indian data or provide services to Indian users across different sectors. Other than that, it also covers risks linked to data, models, privacy and cybersecurity, while placing importance on human oversight. Follow along with the article to learn everything you need to know about the new AI guidelines issued by CERT-In.
CERT-In proposes four levels of AI risk
In the framework shared by CERT-In, the authorities grouped AI systems into four categories, notably Low, Moderate, High and Critical. The government have classified these categories based on factors such as the possible harm caused if the system fails, how independently the AI tool works, the sensitivity of the data it uses, the scale of its operations and its importance to essential services.
The authorities have also clarified that the audit process for each AI will vary depending on the category it falls in. Low-risk systems can undergo annual reviews or basic internal assessments, whereas the moderate-risk-based systems require continuous assessment and documented internal audits, along with an independent audit by a CERT-In-empanelled auditing organisation at least once a year.
High-risk systems will need to be audited by independent third-party organisations, specifically CERT-In-empanelled ones, with audits as often as every six months where risk or material changes warrant it, while the critical systems will need audits by CERT-In-empanelled organisations and must be monitored continuously.
Nine areas will guide AI security audits
The guidelines focus on nine main areas that need to be reviewed, which are AI governance, data quality and privacy, model risk management, fairness, transparency, cybersecurity, regular monitoring, human supervision, and third-party suppliers. The checks cover the full AI lifecycle, from planning and data collection to development, deployment, monitoring and retirement.
Aside from that, the document also includes additional checks for generative AI, including chatbots, retrieval-augmented systems that use external documents, AI agents and multi-agent systems, autonomous and cyber-physical AI, and multimodal AI that processes text, images, audio or video.
These address risks such as prompt manipulation, data leaks, unsafe tool use and misleading outputs. The authorities have also given clear guidelines on how to plan audits, collect evidence, and carry out technical tests.
