Officials in suits stand around a tall brass oil lamp garlanded with marigolds as a man in a blue high-collared suit lights it with a taper, before a stage backdrop reading APCERT Annual General Meeting & Conference 2017, Building Trust in the Digital Economy, New Delhi.
Ravi Shankar Prasad, then India's Minister for Electronics and Information Technology, lights the lamp to open the APCERT annual conference hosted by CERT-In in New Delhi, November 15, 2017. Archive government photograph; it predates CERT-In's 2026 publications. Ministry of Electronics & IT, Government of India / Press Information Bureau (Wikimedia Commons) · Government Open Data License - India (GODL-India), for the photograph only; it confers no rights in the official marks shown

Risk Tiers Set Audit Independence

The Indian Computer Emergency Response Team (CERT-In) has published Artificial Intelligence (AI) Security Auditing Guidelines, version 1.0, dated November 4, 2026. The 107-page PDF scores each AI system from 1 to 4 on eight inherent-risk factors "without taking credit for claimed control effectiveness." Capabilities are to be "established rather than inferred from policy statements" (page 23). Tier 1 permits self-assessment. Tier 2 adds an independent audit by a "CERT-In empanelled auditing organisation" at least annually. Tiers 3 and 4 call for independent audits by such organizations, with continuous monitoring at Tier 4 (pages 25 and 26).

What Auditors Check in Agents

Agents "shall" have documented identities, approved tools, permission boundaries, and action limits, without automatically inheriting permissions from users, tools, or other agents. Tool calls, delegated tasks, approvals, and external actions needed to reconstruct the execution chain are to be logged and protected against unauthorized modification (Section 9.7, page 66). Auditors are told not to rely solely on the organization's self-assessed tier (page 37), to sample agent tool calls and autonomous actions where applicable (page 38), and to test whether approval gates can be bypassed through alternate interfaces (page 80).

Status and Limits

The PDF says a 2025 national policy framework provides "the policy authority" for its audit requirements (page 102) and does not cite a statutory provision making it binding. CERT-In's Directions page lists 2022 directions, not this document. We have not assessed its legal effect. It reports no audit results.