# CERT-In published AI Security Auditing Guidelines in November 2026. If we run AI agents or a generative AI app that serves users in India, what do the guidelines say we have to log and keep, how do they handle hallucinations, and how do the risk tiers change who audits us?

**Short answer:** CERT-In's AI Security Auditing Guidelines v1.0, dated November 4, 2026, cover AI systems developed, bought, deployed or operated in India and AI that processes Indian data or serves Indian users. For agents, section 9.7 says the execution metadata, state transitions, tool calls, delegated tasks, approvals, external actions and outputs needed to reconstruct the execution chain must be logged and protected against unauthorised modification, and security-relevant tool calls to MCP servers, plugins and other agents must be logged. Agents need documented identities, approved tools, permission boundaries and action limits, must not inherit permissions automatically, and consequential actions need human approval gates; high-risk agents must support emergency interruption, credential revocation and rollback. Decision logs must be detailed enough to reconstruct material AI outputs and consequential actions, human approvals and overrides must be logged, and logs must meet CERT-In's 180-day retention minimum with synchronised time. Generative AI needs a documented hallucination risk assessment per use case and risk-based human review for consequential outputs. A system's risk tier (Low to Critical) sets the audit: self-assessment at Tier 1, and independent audits by CERT-In empanelled auditors from Tier 2 upward.

## Checklist
1. Check scope first: the guidelines cover AI developed, procured, deployed or operated in India, and AI processing Indian data or serving Indian users. Academic research AI that isn't deployed is outside the mandatory scope until it goes to pilot or production.
2. Score each AI system into a tier (Low, Moderate, High, Critical). Tool use, code execution, transactions, external communication, persistent memory, multi-step autonomy and delegation to other agents are listed as reasons to escalate the tier.
3. For each agent, document its identity, authorised objectives, approved tools, permission boundaries and action limits, and keep it on least privilege without inheriting permissions from users, tools or other agents.
4. Log what's needed to rebuild an agent run: execution metadata, state transitions, tool calls, delegated tasks, approvals, external actions and outputs, and protect those logs against unauthorised modification.
5. Keep an approved inventory of the MCP servers, plugins, agent-to-agent links and other tool services each agent may connect to, authenticate them, validate tool descriptions, and log security-relevant tool calls.
6. Log human approvals, interventions, overrides and exceptions so they're traceable, and keep logs at least 180 days with time synchronised across AI components.
7. Write a hallucination risk assessment for each generative AI use case and put risk-based human review in front of high-impact outputs.
8. For high-risk agents, prove you can interrupt them, revoke their credentials, roll back and stop uncontrolled automatic restarts. Auditors at Tier 3 and 4 are expected to test those mechanisms, not just read the procedure.

## Who do CERT-In's AI Security Auditing Guidelines apply to, and how do the risk tiers work?
- The guidelines were prepared by a sub-group of the CERT-In working group on Indian standards for cybersecurity auditing and published as version 1.0 dated November 4, 2026. They set a risk-based audit framework for AI systems built, procured, deployed or operated by organisations in India, and for AI that processes Indian data or provides AI services to Indian users. The intended readers include government and public sector bodies, critical infrastructure operators, regulated entities, private companies, AI developers and service providers, and auditors, including CERT-In empanelled auditing organisations.
- Each system is scored on factors including impact severity, autonomy, data sensitivity, scale, reversibility and adversarial exposure, and placed in one of four tiers. The tier sets the minimum audit: self-assessment or basic internal review for Tier 1 (Low); documented internal audit plus an independent audit by a CERT-In empanelled auditor at least annually for Tier 2 (Moderate); periodic independent third-party audits by empanelled auditors for Tier 3 (High); and independent audit with continuous monitoring for Tier 4 (Critical).
- Rule-based automation without machine learning is excluded, but hybrid systems that mix rules with ML are fully in scope.

## What do CERT-In's AI Security Auditing Guidelines require AI agents to log?
- Section 9.7 on agentic AI requires that agent execution metadata, state transitions, tool calls, delegated tasks, approvals, external actions and outputs required to reconstruct the execution chain be logged and protected against unauthorised modification. For multi-agent systems, logs must let an auditor reconstruct agent-to-agent requests, delegated tasks, permissions, decisions, tool invocations and the resulting external actions.
- Agents that use external tool servers, plugins, Model Context Protocol (MCP) services, agent-to-agent channels or dynamically discovered services must keep an approved inventory of permitted connections, authenticate tool and service identities, validate connection metadata and tool descriptions, and log security-relevant tool calls. New tool connections need a provenance, integrity and security assessment before production use.
- More broadly, decision and interaction logging must capture enough to reconstruct material AI outputs and consequential actions, while respecting data minimisation and avoiding unnecessary capture of sensitive content. Human approvals, interventions, overrides and exceptions must be logged and traceable. The cybersecurity domain points to CERT-In's 180-day log retention minimum with time synchronisation across AI components, and to reporting AI-related security incidents within six hours.

## How do CERT-In's AI Security Auditing Guidelines handle hallucinations and auditors' own use of AI?
- Generative AI deployments need a documented hallucination risk assessment for each use case, knowledge grounding such as retrieval with source verification for factual applications, and risk-based human review for high-impact or consequential outputs. Auditors check that incident response covers hallucination events and that monitoring tracks quality measures such as factual accuracy. Fabricated citations are named among the misinformation risks auditors assess.
- The guidelines apply the same idea to auditors who use AI. AI-derived material must be kept separate from original evidence, every relied-upon output must link to identifiable source records, log entries or test results, quoted requirements and citations must be checked against the authoritative source, and an AI-generated narrative or synthetic record must not be presented as original audit evidence.
- On human oversight, the guidelines warn auditors not to conclude that oversight works just because a manual-review procedure exists. Audit steps include sampling AI decisions to confirm required reviews happened, testing whether approval gates can be skipped through other interfaces, and inspecting audit logs for traceability of AI outputs, approvals and overrides.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Our agent just called an external MCP tool that changes a customer record. Record the tool call with the agent identity and version, the approved connection it used, the approval reference and a hash of our full execution-chain log entry, with no customer data, so an auditor can match it later."

```json
{
  "tool": "record_action",
  "arguments": {
    "action_type": "agent.tool_call",
    "outcome": "success",
    "occurred_at": "2026-11-14T21:00:00Z",
    "client_event_id": "crm-agent:run-2026-11-14-0412:step-3",
    "summary": "agent urn:agent:crm-updater v2.4.1; tool crm.update_contact via approved MCP connection mcp-inv-07; delegated by orchestrator run 0412; human approval APR-5521 (consequential action); state transition draft->applied; full execution-chain record kept in our log store",
    "action_sha256": "<sha256 of the full log entry for this step>"
  }
}
```
- Needs your API key (or accept_terms:true once to open a free account; the key comes back once). It returns a ledger-committed receipt of what was submitted and when, kept outside your agent's own log.
- Send one call per consequential step, each with its own client_event_id, so retries don't create duplicates; keep the full log entry in your own store under your retention policy.
- Keep customer names, account numbers and raw prompts out of summary; the hash ties the receipt to the full record you keep.
- A receipt shows that an entry was recorded and when. It doesn't assign a CERT-In risk tier, audit your system, check your agent's permissions or count as an empanelled audit.

_Rightshold isn't affiliated with CERT-In or any empanelled auditor, isn't an auditing organisation, and its ledger isn't a CERT-In-recognised control. Details are from CERT-In's AI Security Auditing Guidelines v1.0, dated November 4, 2026, read November 14, 2026; how the guidelines apply to a given organisation, and how they interact with sector rules, can depend on other Indian laws and directions not covered here, and later versions may change them. Not legal or compliance advice._

## Sources
- [CERT-In: Artificial Intelligence (AI) Security Auditing Guidelines v1.0 (November 4, 2026, PDF)](https://www.cert-in.org.in/PDF/AI_Security_Auditing_Guidelines.pdf)
- [CERT-In: Guidelines page](https://www.cert-in.org.in/s2cMainServlet?pageid=GUIDLNVIEW01)

## Related
- [How to log every AI agent tool call for audit](https://www.rightshold.com/answers/how-to-log-every-ai-agent-tool-call-for-audit)
- [What does the IETF Agent Audit Trail draft require in each AI agent log record?](https://www.rightshold.com/answers/what-does-the-ietf-agent-audit-trail-draft-require-in-each-ai-agent-log-record)
- [What records does the HKMA expect banks to keep for each AI agent?](https://www.rightshold.com/answers/what-records-does-the-hkma-expect-banks-to-keep-for-each-ai-agent)
- [How to make an AI agent's audit log append-only so even an admin can't silently delete entries](https://www.rightshold.com/answers/how-to-make-an-ai-agents-audit-log-append-only-so-even-an-admin-cant-silently-delete-entries)
- [How to build a kill switch for an autonomous AI agent](https://www.rightshold.com/answers/how-to-build-a-kill-switch-for-an-autonomous-ai-agent)

_Not legal advice. Updated 2026-11-14. JSON: https://www.rightshold.com/answers/what-do-indias-cert-in-ai-security-auditing-guidelines-require-you-to-log-for-ai-agents.json_