CERT-In issues AI security audit guidelines with six-hour incident reporting
The Indian Computer Emergency Response Team (CERT-In) issued AI Security Auditing Guidelines on 4 November 2026 for AI systems run in India or handling Indian data. Reportable AI security incidents must reach CERT-In within six hours. Systems fall into four risk tiers, Low to Critical. Audits cover nine domains, and logs must be kept for 180 days.
Syllabus: GS3 · IT, Space, Biotech & IPR; GS3 · Cyber Security & Money Laundering
Why this matters for UPSC
GS3 security: basics of cyber security and the role of CERT-In under the IT Act, 2000. Prelims can ask CERT-In's powers and the six-hour rule; Mains, how to secure agentic AI.
Why it matters
A bank customer whose loan is judged by an AI model, or a patient sorted by one in a hospital, rarely sees the system at work. If that model is tampered with, or an outside AI agent slips into the bank's network, the harm can spread quietly. The guidelines push the organisations running such systems to check them in proportion to the damage they could do, and to tell the national agency quickly when something breaks. A small shop using a simple chatbot faces light checks; the operator of a power grid or payment system faces outside auditors and constant watch. The October incidents showed the gap: the companies hit never spotted the intruders themselves. People will trust AI in public services only if someone answers for its failures.
Prelims pointers
- CERT-In is appointed by the Central Government by notification under Section 70B of the Information Technology Act, 2000, as the national agency for cyber incident response.
- CERT-In's listed functions include collecting and analysing incident information, forecasts and alerts, emergency measures, coordinating response, and issuing guidelines, advisories and vulnerability notes.
- Guidelines are one of CERT-In's functions; its separate power to call for information and give directions is the one backed by a penalty for non-compliance.
- Failing to comply with a CERT-In direction can bring imprisonment of up to one year, a fine of up to one lakh rupees, or both, under the IT Act, 2000.
- CERT-In's 2022 directions bind service providers, intermediaries, data centres, body corporates and government organisations, and require ICT clocks synchronised with NIC or NPL time servers.
Practise a UPSC-style question
With reference to the Indian Computer Emergency Response Team (CERT-In), consider the following statements:
1. It is appointed by the Central Government by notification under the Information Technology Act, 2000.
2. It functions under the Ministry of Home Affairs as the national agency for cyber incident response.
3. It can give directions to intermediaries and data centres, and failure to comply is punishable.
Which of the statements given above is/are correct?
- (a) 1 and 2 only
- (b) 2 and 3 only
- (c) 1 and 3 only
- (d) 1, 2 and 3
Show the answer
Answer: (c) 1 and 3 only
Answer: (c) 1 and 3 only. CERT-In is a statutory agency under the IT Act, 2000, placed under MeitY.
Statement 1: correct. Section 70B of the Information Technology Act, 2000 lets the Centre appoint CERT-In by notification in the Official Gazette.
Statement 2: incorrect. CERT-In works under the Ministry of Electronics and Information Technology (MeitY), not the Ministry of Home Affairs.
Statement 3: correct. The Act lets CERT-In call for information and give directions to service providers, intermediaries, data centres and body corporates; non-compliance can bring up to one year in prison, a fine of up to one lakh rupees, or both.
Eliminate: Statement 2 is the surest: CERT-In sits under MeitY. Out: (a), (b), (d).
Trap: Swapped attribution. A cyber security body sounds like a home-ministry agency, so the question pins CERT-In on the wrong ministry.
Remember: CERT-In: IT Act, 2000; MeitY; national agency for cyber incident response.
More from the 6 November 2026 edition
- TRAI recommends satellite network provider authorisation and direct-to-device services Sci-Tech
- Supreme Court: Article 22(2)'s 24 hours run from detention, not arrest Polity
- US sanctions India-based network over fake registries for Iran's shadow fleet World & IR
- Eleven arrested after 100-day dharna for rehabilitation at LPAI land port National
- UP Chief Electoral Officer orders Assembly and local body rolls matched Polity
- SEBI allows digital KYC from abroad for NRIs, OCIs and foreign nationals Economy
- India issues guidelines to recognise OECMs towards the 30x30 target Environment
- Supreme Court leaves rotation of SC/ST-reserved seats to Parliament Polity
- Draft Drugs Rules change proposes immediate licence suspension for NSQ drugs National