India Cert-In AI Incident Reporting Rules

Cert-In said enterprises must rate systems as low, moderate, high or critical based on the severity of an incident, the autonomy of the model or agent, the sensitivity and scale of exposed data and whether the data can be recovered. Firms must also conduct audits across nine domains, including governance, data lifecycle, data privacy, model risk management, bias and fairness, explainability and third-party assurance.

The agency said AI governance cannot be addressed through ethical principles or conventional cybersecurity controls alone, signaling a broader push for technical testing, continuous monitoring and human oversight. Companies must keep logs for 180 days and synchronize time across AI components to preserve forensic readiness, adding a new layer of record-keeping that will likely require fresh spending on security tools and audit processes.

The rules could have ripple effects across India’s fast-growing enterprise AI market, where banks, IT services firms, cloud providers and large corporates are rolling out generative AI and automated decision systems. Vendors selling AI platforms and security software may benefit as customers look for tools that can track model behavior, detect incidents and document controls in line with the new framework.

For investors, the main issue is not just compliance cost but execution risk: enterprises that fail to build audit trails and incident response procedures could face regulatory exposure, reputational damage and slower AI adoption. The tighter regime also highlights a broader global trend toward tougher AI oversight, with governments increasingly targeting the security of AI infrastructure as much as the models themselves.

Shares of AI-exposed technology firms and cybersecurity vendors will likely stay sensitive to how aggressively Indian regulators enforce the rules and whether other jurisdictions follow with similar requirements. The next catalyst will be how quickly enterprises translate the guidance into internal controls, procurement changes and new security budgets.