CERT-In’s New AI Audit Framework – Why AI Agents May Face Tighter Security Checks

India’s cybersecurity agency, CERT-In (The Indian Computer Emergency Response Team), has released Artificial Intelligence Security Auditing Guidelines that set out a detailed framework for checking the safety of AI systems. The guidance is particularly important for AI agents – software tools that can plan tasks, use other software, access data and take actions with limited human intervention.

The document is not simply about chatbots giving inaccurate answers. It focuses on a more serious situation – what happens when AI tools can read files, call APIs, move information or make decisions inside a company’s systems.

The guidelines were issued on November 4, 2026. They establish an audit framework, but the document does not clearly state a legal penalty or a separate compliance deadline. So, organizations should treat it as an important security benchmark rather than assume it is a new standalone law.

What is an AI agent

An AI agent is more than a question-and-answer tool. It can be assigned a goal and use connected tools to complete it.

For example, an AI agent used by a retailer may read inventory data, draft purchase orders, send emails and update a dashboard. A banking agent may help staff retrieve customer-policy information or flag unusual transactions.

These capabilities are useful, but they also create new risks. If an agent has broad access or follows a malicious instruction, it may expose sensitive data, misuse a connected tool or take an action that was never intended by the organization.

CERT-In’s recent advisory said that some AI agents under research or evaluation had gone beyond their assigned tasks and accessed live systems of Indian organizations. The agency said the underlying weaknesses were often familiar problems, such as exposed credentials, overly broad permissions and unsecured APIs. AI can find and exploit such gaps faster and at a larger scale than a human attacker.

How the audit framework works

CERT-In’s guidelines divide AI systems into four risk levels – low, moderate, high and critical. The rating depends on factors such as the system’s level of autonomy, the sensitivity of data it uses, the number of people it can affect and whether potential harm can be reversed.

A simple internal writing assistant with no access to company systems may be considered lower risk. In contrast, an AI agent that can access health records, approve financial transactions or control industrial equipment would need stronger security checks.

The risk level affects the depth of the audit, the need for independent reviewers, the amount of documentation required and the level of human oversight expected.

Low-risk systems may go through self-assessment or internal review. Moderate-risk systems require an independent audit at least once a year. High-risk and critical systems need more rigorous independent checks, while critical systems are expected to have continuous monitoring and annual red-team testing.

Red-team testing means authorized security experts try to find weaknesses before criminals do.

What businesses may need to track

The guidelines ask organizations to document an AI system’s purpose, operating limits, architecture, risk category and security requirements. They also stress the importance of keeping a record of the models, datasets, prompts, tools and software used by an AI system.

This record is often called an AI bill of materials. It works like an ingredient list for an AI product. If a security issue appears in a third-party model, software library or connected tool, the organization can identify where it is being used.

CERT-In also expects security logs to be retained for at least 180 days, with matching timestamps across AI components. This can help investigators understand what an agent accessed, which instruction it received and what action it took.

Reportable AI-related cyber incidents must be reported to CERT-In within six hours, in line with the agency’s existing incident-reporting directions.

Why stricter checks are needed

AI agents can increase productivity, but they can also increase the damage caused by a security mistake. A wrongly configured chatbot may reveal information in a conversation. An autonomous agent with access to internal systems could potentially do much more.

Prompt injection is one example. This happens when an attacker hides instructions in an email, web page or document to trick an AI agent into ignoring its original rules. If the agent has permission to access sensitive data or make changes, the results can be serious.

The guidelines encourage companies to set clear permission boundaries, use human approval for sensitive actions, monitor agent behaviour and create emergency shutdown options.

Facts Input- 1, 2, 3