Introduction Artificial Intelligence has evolved from a specialised technology into an important component of digital services, business processes, public administration and critical infrastructure. AI systems are increasingly being used in banking & financial services, healthcare, telecommunications, education, transportation, manufacturing, law enforcement, defence, citizen-service delivery and other sectors to generate predictions, recommendations, decisions and content, and in certain cases to autonomously initiate actions in physical or digital environments. While AI offers significant opportunities for innovation, efficiency and improved service delivery, its adoption also introduces risks that are not fully addressed through conventional information technology and cybersecurity assurance mechanisms. Such risks include manipulation of training data and models, adversarial attacks, unauthorised model access, leakage of sensitive information, algorithmic bias, lack of explainability, model and data drift, insecure third-party dependencies, misuse of generative and agentic AI, deepfakes, hallucinated outputs and inadequate human oversight. These risks may affect the confidentiality, integrity, availability, safety, fairness, reliability and accountability of AI-enabled systems. The Artificial Intelligence Security Auditing Guidelines have been developed by Sub-group 03 of the Working Group on “Indian Standards for Cybersecurity Auditing” constituted by the Indian Computer Emergency Response Team (CERT-In). The Guidelines establish a common, riskbased and lifecycle-oriented framework for assessing the governance, security, privacy, fairness, transparency, resilience and auditability of AI systems. They are intended to facilitate consistent security auditing practices across sectors while supporting responsible innovation, indigenous capability development and alignment with applicable Indian legal, regulatory and policy requirements and internationally recognised AI governance and cybersecurity standards. Intended users of the guidelines The Guidelines are intended for use by government organisations, public sector entities, critical infrastructure operators, regulated entities, private organisations, Al developers, Al service providers, internal and external auditors, CERT-In empanelled cybersecurity auditing organisations, risk and compliance functions and other stakeholders involved in the development, procurement, deployment or oversight of Al systems. Executive Summary of the Guidelines The Artificial Intelligence Security Auditing Guidelines provide a structured framework for conducting security and governance audits of Al systems developed, procured, deployed or operated by organisations in India, as well as Al systems processing Indian data or providing Al-enabled services to Indian users. The framework adopts a risk-based approach under which Al systems are classified into four risk tiers-Low, Moderate, High and Critical based on factors such as impact severity, autonomy of decision-making, data sensitivity, scale and exposure, transparency, Explainable AI (XAI), incident response readiness, reversibility and recoverability, operational/sector criticality, adversarial exposure and complexity/auditability. The assigned risk tier determines the depth, frequency and independence of the audit, the extent of documentation required, the level of human oversight and the applicable monitoring, reporting and assurance requirements. The Guidelines establish nine core audit domains: Al Governance and Accountability Data Lifecycle, Quality and Privacy Model Risk Management Al Ethics, Bias and Fairness Explainability and Transparency Security, Adversarial Resilience and Incident Reporting Continuous Monitoring, Drift Management and Validation Human Oversight and Decision Accountability Third-Party and Al Supply-Chain Assurance These domains collectively cover the entire Al lifecycle, including design, procurement, data collection, model development, training, validation, deployment, operation, retraining, monitoring and decommissioning. The framework supplements these domains with dedicated requirements for advanced Al architectures, including Generative Al, Retrieval-Augmented Generation (RAG), Agentic Al, Multimodal Al, Multi-Agent Al and Autonomous/Cyber-Physical Al. These requirements address prompt injection, sensitive-information disclosure, excessive agency, data and model poisoning, supply-chain risks, vector and embedding weaknesses, unsafe tool use, persistent-memory risks, inter-agent communication, multimodal attacks, misinformation and improper output handling. The Guidelines also prescribe a structured audit methodology covering engagement initiation, risk assessment, scoping, audit planning, evidence collection, technical testing, finding classification, reporting, remediation and follow-up verification. Audit findings are classified as Critical, High, Moderate or Low/Observation, with corresponding containment, remediation, escalation and reporting requirements. A five-level maturity model enables organisations to assess their current Al governance capability and plan progressive improvement from ad hoc practices to measured and continuously optimised governance.Al-assisted audit procedures may support evidence analysis, control mapping, technical testing and report preparation. Their use is subject to approved scope, confidentiality controls, tool validation, traceable evidence and competent human review. Al-generated outputs shall not replace sufficient and appropriate evidence or the auditor's independent judgement. The framework is aligned with recognised standards and frameworks, including CERT-In's Blueprint for Reducing Exposure and Defending against Al-Assisted Vulnerabilities Exploitation in Digital Infrastructure, India Al Governance Guidelines by MeitY, ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 27001, NIST AI RMF, MITRE ATLAS and OWASP guidance for machine learning and large language model applications. The framework also provides a structured mechanism for identifying, assessing and mapping applicable CERT-In requirements, sector-specific cybersecurity obligations, contractual security requirements and other external requirements into the audit criteria and Statement of Applicability. What This Framework Provides The guideline document delivers a comprehensive, actionable and internationally aligned auditing framework structured across the following pillars: Risk Tiering and Applicability -A four-tier risk classification system (Low, Moderate, High, Critical) calibrated to sector, use case, and impact severity, determining audit intensity and compliance obligations. Nine Core Audit Domains - Structured audit requirements spanning Al governance, data lifecycle, model risk management, ethics and fairness, explainability, cybersecurity resilience, continuous monitoring, human oversight, and third-party accountability. Advanced Al Security Requirements - Dedicated audit provisions for large language models, Generative AI, RAG, Agentic Al, Multimodal Al, Multi-Agent Al and Autonomous/Cyber-Physical Al, addressing prompt injection, hallucination, content integrity, training data provenance, and output attribution. Audit Planning and Scoping Methodology - A risk-based audit lifecycle from engagement planning through fieldwork, evidence collection, and reporting, aligned with ISO 42001 and ISACA/IIA methodologies. Audit Reporting and Remediation - Structured finding classification, corrective action planning, ISO 42001 Clause 9-10 integration for management review and continual improvement, and escalation protocols. Al-Assisted Audit Procedures - Controlled use of Al tools to support audit work, with defined authorisation, data protection, tool validation, evidence traceability, human review and auditor accountability. Guiding Principles The framework is anchored on seven foundational principles for secure, ethical and auditable Al systems align with Meity's India Al Governance guiding principles: Security-by-Design Accountability and Human Oversight Transparency and Explainability Fairness and Bias Management Data Security and Privacy Auditability and Traceability Resilience and Continuous Assurance To view the complete guidelines, click here