AI you can explain to a regulator, a court and a board.
We help organisations take stock of where AI is used, assess each use against the law and against how it is built, and put contracts and oversight around it.
New · 4 Nov 2026 CERT-In issues AI Security Auditing Guidelines →
Most AI risk is a data and contract question first.
Indian obligations come from existing law and from guidance. We map them to each use case.
What the law and guidance ask
- DPDP Act applies where personal data is used to train, tune or run a model
- IT Act and IT Rules, including the 2026 amendment on synthetically generated content for intermediaries
- Sector guidance, such as the RBI FREE-AI report for financial services
- MeitY’s India AI Governance Guidelines and their seven principles
- Vendor contracts: data use, indemnity, intellectual property and liability
What the systems must do
- An inventory of AI use cases, each with an owner and a risk tier
- Data provenance for training and retrieval sources
- Testing for accuracy, bias and robustness before and after release
- Human oversight with clear points of review and escalation
- Logging and change control for models, prompts and data
- Hosting choices, including local deployment where data must not leave
Guidance is arriving faster than statute.
Four developments we track for clients.
Sources: CERT-In, AI Security Auditing Guidelines v1.0 · The Tribune on the India AI Governance Guidelines · RBI press release on the FREE-AI report · Business Today on the IT Amendment Rules 2026. Check the notified text before relying on a date or a provision.
India now has a national method for auditing AI systems.
On 4 November 2026 CERT-In issued version 1.0 of its guidelines, prepared by Sub-group 03 of its working group on Indian standards for cybersecurity auditing. They give auditors and organisations one risk-based way to assess the security and governance of AI across its whole lifecycle.
What each tier requires, at a minimumFour tiers, scored on eight factors
Self-assessment or a basic internal review, with documented evidence.
Documented internal audit. Independent audit by a CERT-In empanelled auditing organisation at least annually.
Periodic independent third-party audit by a CERT-In empanelled organisation, more often when changes or incidents warrant.
Independent audit by a CERT-In empanelled organisation, with continuous monitoring.
The eight factors are impact severity, autonomy, data sensitivity, scale and exposure, reversibility, sector criticality, adversarial exposure, and complexity and auditability. Tiers must be reassessed at least yearly and before a material change goes live. A system can be escalated above its score, for example where it acts autonomously on safety-critical matters or cannot be reliably interrupted.
Nine core audit domainsWhat an audit looks at
What an audit looks at
- AI governance and accountability
- Data lifecycle, quality and privacy
- Model risk management
- Ethics, bias and fairness
- Explainability and transparency
- Security, adversarial resilience and incident reporting
- Continuous monitoring, drift and validation
- Human oversight and decision accountability
- Third-party and AI supply-chain assurance
Extra requirements for newer systems
- Covered: generative AI, retrieval-augmented generation, agentic, multimodal and multi-agent AI, and autonomous or cyber-physical AI
- Threats named: prompt injection, sensitive-information disclosure, excessive agency, data and model poisoning, and supply-chain risk
- Also named: vector and embedding weaknesses, unsafe tool use, persistent-memory risk, multimodal attacks, misinformation and improper output handling
- Alignment: MeitY’s India AI Governance Guidelines, ISO/IEC 42001, ISO/IEC 27001, NIST AI RMF, MITRE ATLAS and OWASP guidance
Where does your AI governance stand today?Five-level maturity model
The guidelines include a five-level maturity model. Organisations use it to assess themselves before an audit and to plan improvement. It gives context only: it never changes how severe an audit finding is.
No AI policy or named owner, no inventory, no bias testing or monitoring.
A policy exists but is incomplete. Basic inventory, some bias testing, and human oversight for high-impact decisions.
Full policy suite, tiered inventory, an AI governance committee and an ISO/IEC 42001-aligned system. Can show compliance for its tier.
Fairness, drift and incident-response metrics tracked, with automated alerting and board-level reporting.
Continuous improvement, automated compliance checks, and a voice in standards and industry forums.
From MeitY’s seven principles to audit checksPrinciple mapping
MeitY’s India AI Governance Guidelines say what good AI governance should look like. CERT-In’s guidelines say how to check it. This is the mapping CERT-In itself draws.
Maturity levels: CERT-In guidelines, section 13. Principle mapping: CERT-In guidelines, section 15.2. We have shortened both for readability.
How we help you prepareOur engagement
Tier every system
Score each AI use case on the eight factors, record the reasoning, and flag the ones that need escalation. The tier goes into your AI register.
Close the gaps before the audit
Check evidence against the nine domains: policy, data provenance, testing, human review, vendor terms, logging and incident handling. Fix what is missing first.
Line up the independent audit
Where your tier needs an independent audit, it is carried out by a CERT-In empanelled auditing organisation. We prepare the documents, the evidence and the management responses.
Source: CERT-In, AI Security Auditing Guidelines v1.0, 4 November 2026 · CERT-In guidelines page. This is our summary. The published guidelines are the authority, and whether they bind you depends on your regulator and your contracts.
An AI register with a legal and technical test for each use.
Every use case is assessed against the same checklist before it is approved, and the result is kept where an auditor can find it.
- One register for the organisation. Owner, purpose, data used, risk tier and status for each use case.
- A legal touchpoint for each use. The provisions and guidance that apply, so counsel can see the basis.
- A technical checklist. Provenance, testing, human review, vendor terms and logging.
Register 6 of 17 use cases
| Use case | Personal data | CERT-In tier | Status |
|---|---|---|---|
| Customer support assistant | Yes | Tier 2 | Assessed |
| Résumé screening | Yes | Tier 3 | In review |
| Contract summariser | Yes | Tier 2 | Assessed |
| Demand forecasting | No | Tier 1 | Assessed |
| Credit pre-screening | Yes | Tier 3 | Pending |
| Marketing copy generator | No | Tier 1 | Assessed |
Assessment checklist Résumé screening
| Lawful basis and notice | Done |
| Training and retrieval data provenance | Done |
| Bias and accuracy testing | In progress |
| Human review point defined | Done |
| Vendor terms and data location | In progress |
| Logging and change control | Open |
What we do in this area.
From a first inventory to a standing review process.
Inventory and tier
Find where AI is already in use, including in vendor products, and tier each use against the CERT-In risk factors.
Assess and contract
Legal and technical assessment of each use, audit readiness against the nine CERT-In domains, and vendor terms for data, liability and audit.
Govern
A policy, a review board and reporting, so new uses pass the same checks as the first ones.
Start with an inventory.
Most organisations use more AI than they have listed. We find it, tier it and say what to do first.