India's Cert-In tightens AI security rules with rapid incident reporting mandate

Cert-In has released fresh directives requiring Indian organizations to implement robust security frameworks for artificial intelligence applications, marking a significant step toward managing emerging technological risks. The guidelines emphasize risk-based classification systems that allow enterprises to prioritize security measures according to the criticality of their AI deployments and potential impact on operations.

A cornerstone of the new requirements is the six-hour incident reporting window, compelling organizations to notify Cert-In of any security breaches or anomalies detected in their AI systems within this timeframe. This accelerated reporting mechanism aims to enable faster threat detection and coordinated response across the technology sector, reducing vulnerability windows that could be exploited by malicious actors.

The guidelines also mandate continuous monitoring of AI systems to identify vulnerabilities and unauthorized access attempts in real time. Organizations must maintain comprehensive logs of all system activities for a minimum of 180 days, creating an audit trail essential for forensic investigations and compliance verification.

These directives reflect growing concerns among Indian cybersecurity authorities about the security gaps inherent in deploying large-scale AI systems without adequate safeguards. As artificial intelligence becomes increasingly integrated into critical infrastructure and business operations, the government is moving to establish baseline security standards that balance innovation with national security interests.