India's CERT-In has released security guidelines for AI agents, categorizing them into four risk tiers. The framework mandates human oversight and stricter access controls to prevent data leaks. This move increases the compliance burden for Indian enterprises and tech companies integrating AI, signaling a shift toward regulated and secure AI adoption.
The Indian Computer Emergency Response Team (CERT-In) has released a comprehensive security framework for Artificial Intelligence (AI) systems. Announced on November 4, 2026, these guidelines aim to address the growing risks associated with autonomous AI agents, including potential data leaks, unauthorized network access, and the manipulation of AI decision-making. As Indian corporations ramp up AI adoption, this framework provides a clear path for managing security threats in automated environments.
The guidelines establish a risk-based approach, sorting AI systems into four tiers ranging from low to critical. This structure allows organizations to apply security measures that match the potential harm an AI system could cause. For critical systems, the requirements are stringent, demanding robust defense mechanisms that prevent AI agents from inheriting the full access rights of the users or tools they interact with. By enforcing an explicit permission model, the government intends to stop unauthorized lateral movement, where an AI tool might otherwise access sensitive data it does not need to function.
A key mandate is the requirement for a human-in-the-loop for any action that has significant consequences. This means that AI systems cannot unilaterally execute high-impact decisions without a human reviewer having the ability to check, approve, or override the output. This requirement is intended to act as a fail-safe, ensuring that companies retain control over autonomous agents even as they delegate more complex tasks to them. Auditors are now expected to verify these checkpoints, along with maintaining 180-day logs of all AI actions for forensic analysis.
For investors and market participants, these guidelines carry significant business implications. Companies that are heavily investing in AI infrastructure or selling AI-powered solutions to enterprises may face increased compliance costs. The necessity for independent security audits will likely require businesses to allocate more funds to cybersecurity and legal compliance. While currently non-binding, these guidelines are widely viewed as the blueprint for future, legally enforceable AI regulations in India.
Companies with large-scale AI deployments, particularly in sensitive sectors like finance, healthcare, and infrastructure, will need to evaluate their existing systems against these new standards. The guidelines also highlight technical challenges such as prompt injection, where malicious actors attempt to trick AI models into behaving unexpectedly. Developing defenses against such attacks and ensuring adherence to the mandatory six-hour incident reporting window will require specialized talent and technology. The key monitorable for the market will be how quickly enterprise-level AI providers adapt their architectures to these standards and whether this leads to a shift in IT spending toward heightened security measures.