CERT-In orders AI security audits and six-hour reporting
In short
CERT-In issued AI security audit rules for companies. The summary says firms must classify risks, report incidents within six hours, monitor continuously and keep logs for 180 days.
This matters because businesses using AI may need to change how they track and report security issues. The report does not say when the rules start or what penalties apply if firms fail to comply.
What the reporting says
CERT-In issued guidelines for enterprise AI security audits, including risk-based classification, six-hour incident reporting, continuous monitoring and 180-day log retention, according to a publisher summary. The reporting does not say when the guidance was released or which firms must comply. It points to tighter oversight of AI systems used by enterprises, but leaves the exact enforcement process and penalties unstated. The immediate consequence is stronger compliance pressure.
Why it matters
CERT-In issued guidelines for enterprise AI security audits, requiring risk-based classification, six-hour incident reporting, continuous monitoring and 180-day log retention. The reporting does not provide a release date or explain the enforcement mechanism. It also does not specify the industries covered beyond enterprise users. The immediate effect is likely more compliance work for companies running AI systems, especially around monitoring and incident reporting.