Centre issues transparency, safety guidelines for AI

India's top cybersecurity agency has laid out a set of security, transparency and accountability requirements for artificial intelligence (AI) systems, seeking to establish minimum standards for companies building and deploying AI.

The 107-page guidelines, titled Artificial Intelligence Security Auditing Guidelines: Framework for Secure, Ethical and Auditable Artificial Intelligence Systems, was published on Wednesday by the Indian Computer Emergency Response Team (CERT-In).

While it applies to all AI developers and service providers, including US-based companies behind popular applications ChatGPT, Claude and Gemini, it is legally binding only for cyber security auditors that are empanelled with Cert-In. Put simply, while the guidelines are themselves not binding on companies building AI, they are the basis on which AI systems within companies will be audited. If found inadequate, and once India establishes its AI regulations, failing to comply with these guidelines could carry consequences,

The framework identifies about 10 areas in which companies building AI models, applications and related systems should seek to meet specified standards. Among its requirements, companies must report AI-related security breaches to CERT-In within six hours and maintain logs of AI systems' usage and operations for 180 days.

At the core of the guidelines is a proposed classification system that would place AI models and applications in four tiers of criticality — low, moderate, high, and critical. The classification would be based on eight identifiers, including the severity of potential impact and sensitivity of data.

The framework also envisages independent audits and security assessments. Experts said its risk classification and audit structure appear to draw on the European Union's (EU) approach. Unlike the EU AI Act, however, India's guidelines are not legally binding.

Shouvik Das