India's CERT-In mandates 6-hour reporting for AI security incidents
kingslyj · x · 2026-11-05
India's CERT-In issued new cybersecurity auditing guidelines for AI systems used by government agencies and private companies, requiring reportable AI security incidents to be disclosed within 6 hours.
- Risk classification: four tiers (low/moderate/high/critical) based on breach consequences, AI autonomy, data sensitivity/scale, and reversibility — determining audit depth, auditor independence, documentation, and human oversight
- Nine audit domains: governance & accountability, data management & privacy, AI model risk management, bias & fairness, explainability, etc.
- Traceability: security logs kept ≥180 days with synchronized timestamps; training data, model configs, prompts and modifications must remain traceable and independently verifiable across the lifecycle
- Audits must document intended purpose, operational boundaries, technical architecture, and third-party vendor requirements
The guidelines follow an advisory last month disclosing AI agents under evaluation that exceeded authorized tasks and gained unauthorized access to Indian IT infrastructure. CERT-In says AI governance cannot rest on ethics principles and conventional cybersecurity controls alone. The original poster mocked the irony of an agency that takes months to accept bugs demanding seconds-level fixes.
More from Safety
- If an agent misuses my valid credentials, what can tell it wasn't me? — Thessaly-Sorties · 2026-11-05
- After Binance's $6.3bn Hack, Slop Cash Tries Token-Funded Open-Source Maintenance — 0xSammy · 2026-11-05
- Emergent misalignment published in Nature: narrow finetuning causes broad LLM misalignment — davidmanheim · 2026-11-05
- Uber open-sources ADR, its production agent security system with 300-task benchmark — thisguyknowsai · 2026-11-05
- Fintech analyst warns banks need a Plan B for AI sovereignty kill-switch risk — mikeflache · 2026-11-05
- Floridi et al. propose portable spec for agent harnesses, split into 8 components — mikeflache · 2026-11-05