Context:
Recently, The Indian Computer Emergency Response Team (CERT-In) released its AI Security Auditing Guidelines on 4 November 2026, establishing a framework for secure, accountable and risk-based auditing of Artificial Intelligence systems, including Agentic AI. The guidelines aim to address emerging cybersecurity threats arising from autonomous AI systems and strengthen India's digital security framework.
What is Agentic AI?
Agentic AI refers to AI systems capable of independently planning, making decisions and executing multi-step tasks with limited human intervention. Unlike traditional generative AI, which primarily produces text, images or other content, Agentic AI can interact with external applications, access databases, use digital tools and perform actions on behalf of users. However, excessive autonomy can create risks of unauthorised access, data leakage and cyberattacks.
What is CERT-In?
CERT-In stands for Indian Computer Emergency Response Team. It functions under the Ministry of Electronics and Information Technology (MeitY) and serves as India's national nodal agency for cybersecurity incident response. It derives its statutory mandate from Section 70B of the Information Technology Act, 2000. Its functions include monitoring cyber threats, issuing security advisories, coordinating responses to cyberattacks and strengthening cybersecurity preparedness.
Major Provisions of the Guidelines:
The guidelines introduce a four-tier risk classification of AI systems: low, moderate, high and critical, depending on their autonomy and potential impact. They recommend risk-based security audits, independent assessments for higher-risk systems and continuous monitoring of critical systems. Reportable AI-related cybersecurity incidents must be reported within six hours, while security logs must be maintained for at least 180 days. The framework also promotes human oversight, accountability and the maintenance of an AI Bill of Materials (AI-BOM), documenting models, datasets, tools and software components. Special safeguards address prompt injection, excessive permissions and unauthorised tool usage.
Significance for India:
The guidelines can strengthen India's cybersecurity preparedness, protect critical infrastructure and reduce risks of data breaches. They promote responsible AI development, improve transparency and accountability, and enhance public trust in digital governance. They are particularly relevant to banking, healthcare, telecommunications and government digital services. They also support India's ambition to become a trusted global AI hub.
Challenges and Way Forward:
Major challenges include high compliance costs, rapid technological changes, privacy concerns, shortage of skilled cybersecurity professionals and difficulties in fixing accountability for autonomous AI decisions. India should promote regular security audits, privacy-by-design, human-in-the-loop mechanisms, indigenous cybersecurity technologies and the principle of least privilege, ensuring AI agents receive only necessary access.
Conclusion:
CERT-In's guidelines represent an important step towards building a secure and trustworthy AI ecosystem. India must balance technological innovation with cybersecurity, transparency and accountability to achieve Responsible AI and secure Digital India.
