CERT-In published AI Security Auditing Guidelines in November 2026. If we run AI agents or a generative AI app that serves users in India, what do the guidelines say we have to log and keep, how do they handle hallucinations, and how do the risk tiers change who audits us?

What should I check, step by step?

1. Check scope first: the guidelines cover AI developed, procured, deployed or operated in India, and AI processing Indian data or serving Indian users. Academic research AI that isn't deployed is outside the mandatory scope until it goes to pilot or production.

2. Score each AI system into a tier (Low, Moderate, High, Critical). Tool use, code execution, transactions, external communication, persistent memory, multi-step autonomy and delegation to other agents are listed as reasons to escalate the tier.
3. For each agent, document its identity, authorised objectives, approved tools, permission boundaries and action limits, and keep it on least privilege without inheriting permissions from users, tools or other agents.
4. Log what's needed to rebuild an agent run: execution metadata, state transitions, tool calls, delegated tasks, approvals, external actions and outputs, and protect those logs against unauthorised modification.
5. Keep an approved inventory of the MCP servers, plugins, agent-to-agent links and other tool services each agent may connect to, authenticate them, validate tool descriptions, and log security-relevant tool calls.
6. Log human approvals, interventions, overrides and exceptions so they're traceable, and keep logs at least 180 days with time synchronised across AI components.
7. Write a hallucination risk assessment for each generative AI use case and put risk-based human review in front of high-impact outputs.
8. For high-risk agents, prove you can interrupt them, revoke their credentials, roll back and stop uncontrolled automatic restarts. Auditors at Tier 3 and 4 are expected to test those mechanisms, not just read the procedure.

Who do CERT-In's AI Security Auditing Guidelines apply to, and how do the risk tiers work?

The guidelines were prepared by a sub-group of the CERT-In working group on Indian standards for cybersecurity auditing and published as version 1.0 dated November 4, 2026. They set a risk-based audit framework for AI systems built, procured, deployed or operated by organisations in India, and for AI that processes Indian data or provides AI services to Indian users. The intended readers include government and public sector bodies, critical infrastructure operators, regulated entities, private companies, AI developers and service providers, and auditors, including CERT-In empanelled auditing organisations.

• Each system is scored on factors including impact severity, autonomy, data sensitivity, scale, reversibility and adversarial exposure, and placed in one of four tiers. The tier sets the minimum audit: self-assessment or basic internal review for Tier 1 (Low); documented internal audit plus an independent audit by a CERT-In empanelled auditor at least annually for Tier 2 (Moderate); periodic independent third-party audits by empanelled auditors for Tier 3 (High); and independent audit with continuous monitoring for Tier 4 (Critical).
• Rule-based automation without machine learning is excluded, but hybrid systems that mix rules with ML are fully in scope.

What do CERT-In's AI Security Auditing Guidelines require AI agents to log?

Section 9.7 on agentic AI requires that agent execution metadata, state transitions, tool calls, delegated tasks, approvals, external actions and outputs required to reconstruct the execution chain be logged and protected against unauthorised modification. For multi-agent systems, logs must let an auditor reconstruct agent-to-agent requests, delegated tasks, permissions, decisions, tool invocations and the resulting external actions.

• Agents that use external tool servers, plugins, Model Context Protocol (MCP) services, agent-to-agent channels or dynamically discovered services must keep an approved inventory of permitted connections, authenticate tool and service identities, validate connection metadata and tool descriptions, and log security-relevant tool calls. New tool connections need a provenance, integrity and security assessment before production use.
• More broadly, decision and interaction logging must capture enough to reconstruct material AI outputs and consequential actions, while respecting data minimisation and avoiding unnecessary capture of sensitive content. Human approvals, interventions, overrides and exceptions must be logged and traceable. The cybersecurity domain points to CERT-In's 180-day log retention minimum with time synchronisation across AI components, and to reporting AI-related security incidents within six hours.

How do CERT-In's AI Security Auditing Guidelines handle hallucinations and auditors' own use of AI?

Generative AI deployments need a documented hallucination risk assessment for each use case, knowledge grounding such as retrieval with source verification for factual applications, and risk-based human review for high-impact or consequential outputs. Auditors check that incident response covers hallucination events and that monitoring tracks quality measures such as factual accuracy. Fabricated citations are named among the misinformation risks auditors assess.

• The guidelines apply the same idea to auditors who use AI. AI-derived material must be kept separate from original evidence, every relied-upon output must link to identifiable source records, log entries or test results, quoted requirements and citations must be checked against the authoritative source, and an AI-generated narrative or synthetic record must not be presented as original audit evidence.
• On human oversight, the guidelines warn auditors not to conclude that oversight works just because a manual-review procedure exists. Audit steps include sampling AI decisions to confirm required reviews happened, testing whether approval gates can be skipped through other interfaces, and inspecting audit logs for traceability of AI outputs, approvals and overrides.