India ki national cyber security agency CERT-In (Indian Computer Emergency Response Team) ne Artificial Intelligence (AI) Security Auditing Guidelines jaari kiye hain. CERT-In ki official website par is document ki date 4 November 2026 di gayi hai. Ye guidelines un organisations ke liye ek common framework deti hain jo AI tools banate, kharidte, deploy karte ya chalate hain.
Reports ke mutabik ye lagbhag 107 pages ka document hai, aur iska focus is baat par hai ki AI systems secure, fair aur accountable rahein, aur un par insaani nigrani (human oversight) bani rahe.
Kya naya hai
Guidelines ka sabse bada hissa risk ke hisaab se audit karna hai. Har AI system ko chaar categories mein se ek mein rakha jaata hai. Risk tay karte waqt dekha jaata hai ki system fail hone par kitna nuksaan ho sakta hai, wo kitni azaadi se faisle leta hai, kitna sensitive data process karta hai aur kya galat nateeje ko palta ja sakta hai.
| Risk level | Audit ki zarurat (reports ke mutabik) |
| Low | Saalana review ya basic internal assessment |
| Moderate | Lagataar internal assessment, documented internal audit, aur saal mein kam se kam ek baar CERT-In-empanelled auditor se independent audit |
| High | CERT-In-empanelled organisation se independent third-party audit, zarurat padne par har 6 mahine tak |
| Critical | CERT-In-empanelled organisation se audit ke saath continuous monitoring |
Jab kisi system ki capability, use karne ka mahaul ya uska asar badle, to dobara assessment karna hoga.
Audit kin baaton ko cover karega
Document mein audit ke liye nau mukhya areas bataye gaye hain:
- AI governance
- Data quality aur privacy
- Model risk management
- Fairness
- Transparency
- Cybersecurity
- Regular monitoring
- Human supervision
- Third-party suppliers ki zimmedari
Ye checks AI ke poore lifecycle par lagte hain, yaani planning aur data collection se le kar development, deployment, monitoring aur system ko band karne tak. Organisations ko system ka intended use, architecture, risks aur controls document karne honge.
Generative AI aur AI agents ke liye alag checks
Guidelines mein generative AI, chatbots, retrieval-augmented generation (RAG) systems, AI agents, multi-agent systems aur multimodal AI ke liye extra checks jode gaye hain. Inmein prompt injection, data poisoning, sensitive data leak, zarurat se zyada permissions aur unsafe tool use jaise risks shaamil hain.
Reports ke mutabik CERT-In ke reportable criteria mein aane wale AI incidents ko 6 ghante ke andar report karna hoga. Ye samay-seema CERT-In ke April 2022 ke directions se li gayi hai, yaani ye naya niyam nahi balki pehle se maujood niyam ka hissa hai. Isi tarah security logs 180 din tak rakhne ki baat bhi purane directions par aadharit hai.
Kis par laagu hoga
Reports ke anusaar ye framework un AI systems ko cover karta hai jo India mein organisations develop, deploy ya operate karti hain, aur un systems ko bhi jo Indian users ka data process karte hain ya unhe AI services dete hain. Bahar se liye gaye models, datasets aur software ke liye bhi organisation hi zimmedar maani jayegi.
Iska matlab kya hai
Aam users ke liye iska seedha asar ye ho sakta hai ki banking, telecom, e-commerce ya sarkari services mein use hone wale AI chatbots aur tools par zyada structured security checks hon. Companies ke liye ab ek tay framework hai jiske hisaab se wo apne AI systems ka risk aanka kar audit plan kar sakti hain.
Kuch reports ke mutabik ye framework apne aap mein koi naya AI kanoon nahi hai. Kaun si baat kis organisation par kis had tak lazmi hai, iske liye CERT-In ka original document padhna zaruri hai.
Sources:
Leave a Reply