CERT-In AI Security Auditing Guidelines 2026: BFSI Checklist

CERT-In Releases AI Security Auditing Guidelines 2026

What Banks, NBFCs and Financial Institutions Should Review

From model security and prompt injection to autonomous agents and independent assurance, AI is creating new responsibilities for cybersecurity, risk management and internal audit professionals.

RMAI Risk Insights | 4 November 2026

The Indian Computer Emergency Response Team (CERT-In) has published its Artificial Intelligence (AI) Security Auditing Guidelines, CISG-2026-04, dated 4 November 2026.

The release comes amid growing attention to AI-related cybersecurity risks, particularly following CERT-In’s October advisory describing autonomous AI agents accessing Indian organisations’ systems without authorisation.

Banks and financial institutions increasingly use artificial intelligence for credit scoring, fraud detection, customer service, transaction monitoring, risk analytics and automated decision-making.

These applications introduce risks that conventional IT security assessments may not fully address.

An AI system may be protected against ordinary network attacks but remain vulnerable to manipulated inputs, inappropriate data access, compromised model components or excessive agent permissions.

The central question is whether financial institutions can independently demonstrate that their AI systems are secure, properly governed and operating within approved boundaries.

1. What Has CERT-In Announced on 4 November 2026?

CERT-In has published CISG-2026-04, Artificial Intelligence (AI) Security Auditing Guidelines, in its official security guidelines repository.

The release follows several earlier CERT-In publications relevant to AI assurance:

Date	CERT-In publication	Significance
25 July 2025	Comprehensive Cyber Security Audit Policy Guidelines, CISG-2025-02	Recognises AI system audits and AI-related component auditing within cybersecurity assurance engagements
25 May 2026	Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation, CISG-2026-02	Addresses AI-specific threats, security governance, continuous assessment and resilience
15 October 2026	Critical Advisory CIAD-2026-0049	Describes unauthorised access involving autonomous agents and malicious use of agentic AI tools
4 November 2026	Artificial Intelligence (AI) Security Auditing Guidelines, CISG-2026-04	Newly published, dedicated AI security auditing guidance

The publication of dedicated guidelines makes AI security auditing a timely priority for organisational risk and assurance planning.

However, the detailed provisions, applicability and status of individual requirements under CISG-2026-04 must be checked against its full document before any specific requirement is attributed to it.

The practical assessment framework below is based on CERT-In’s previously published guidance and established security auditing principles.

2. Why AI Security Auditing Differs From Conventional IT Audits

Traditional IT security audits examine infrastructure, applications, networks, identity management, access controls and data protection.

These controls remain essential. However, AI systems introduce additional risks involving model behaviour, training data, external information sources and automated actions.

AI Models Can Produce Unpredictable Outputs

A conventional software application generally follows predefined instructions.

AI models may produce different responses to similar inputs, particularly where probabilistic techniques or generative models are involved.

Auditors must therefore evaluate not only technical security but also reliability, limitations, inappropriate outputs and the effectiveness of safeguards.

Prompt Injection Creates New Attack Opportunities

Prompt injection occurs when malicious or untrusted instructions influence an AI system’s behaviour.

For example, a banking AI assistant retrieving information from an external document could encounter instructions designed to make it disclose confidential information or perform an unauthorised action.

An AI security assessment should examine whether the system separates trusted instructions from untrusted content.

Autonomous Agents Can Take Actions

AI agents may interact with applications, execute workflows, access databases or invoke APIs.

A compromised or improperly configured agent could potentially access information or initiate actions beyond its intended purpose.

CERT-In’s October advisory specifically emphasised restricting agent permissions, monitoring activities and enforcing technical operating boundaries.

Third-Party AI Introduces Additional Dependencies

Financial institutions increasingly obtain AI capabilities through external vendors, cloud services and application providers.

This creates questions about data handling, model provenance, security testing, incident notification and the organisation’s ability to obtain independent assurance.

An effective AI security audit must therefore examine the complete AI system, including models, data, integrations, permissions, vendors and operational decision-making.

3. Practical AI Security Audit Checklist for Financial Institutions

The following checklist is an RMAI-recommended audit framework, informed by CERT-In’s earlier published guidance. It should not be presented as a verbatim checklist or mandatory control schedule under CISG-2026-04.

Audit area	What should auditors examine?	Evidence to review
AI Inventory and Ownership	Are all AI models, applications and agents identified, classified and assigned responsible owners?	Model inventories, AI application registers, approvals
AI Governance	Are AI use cases approved, risk-assessed and subject to appropriate oversight?	AI policies, risk assessments, governance minutes
Data Security and Privacy	Can sensitive customer information be accessed, disclosed or transferred without authorisation?	Data-flow maps, permissions, encryption and DLP records
Prompt Injection and Adversarial Testing	Can malicious inputs cause unintended disclosures or actions?	Authorised adversarial test reports and remediation evidence
Model Security and Integrity	Are model versions, dependencies, data sources and deployment pipelines protected against tampering?	Model documentation, version records, integrity checks
AI Agent Access Controls	Can agents perform actions outside approved permissions or contact unauthorised systems?	Service identities, tool permissions, network policies
Third-Party AI Risk	Are vendor-operated models and integrations subject to adequate security oversight?	Contracts, vendor assessments, security reports
Logging and Monitoring	Are significant AI interactions, tool calls and security events traceable?	Activity logs, monitoring alerts, access records
Incident Response	Can the institution suspend a compromised agent, preserve evidence and recover safely?	Incident plans, test results, escalation records

Three areas deserve particular attention.

First, AI inventories must be sufficiently comprehensive. An organisation may have approved models in its risk analytics function while employees or business units independently use generative AI applications and external AI services.

Second, testing must examine actual behaviour. Reviewing a policy that prohibits unauthorised data disclosure is insufficient if the deployed system has not been tested against realistic attempts to access restricted information.

Third, security testing must be appropriately authorised and controlled. Adversarial testing against live banking systems can itself create operational, confidentiality and service-availability risks.

Institutions should use approved testing environments, defined scopes and suitable safeguards.

4. What Does This Mean for Banks, NBFCs and Financial Institutions?

AI security auditing should be considered alongside existing RBI expectations concerning cybersecurity, technology governance, outsourcing and model risk.

RBI Cybersecurity and Technology Governance

On 31 July 2026, RBI issued consolidated cybersecurity and technology risk directions for several categories of regulated entities, including separate directions for commercial banks, Small Finance Banks and NBFCs.

These directions address areas such as IT governance, cybersecurity controls, incident response, resilience and information systems assurance.

A bank using AI within customer-facing applications, security operations or operational processes should consider whether those systems are adequately reflected in its technology risk assessments and audit coverage.

The applicable direction and its specific provisions must be identified according to the regulated entity’s category.

RBI Model Risk Management

On 24 June 2026, RBI released draft Guidance on Regulatory Principles for Model Risk Management.

The draft addressed model governance, inventories, model risk assessment, validation and ongoing oversight, including models employing AI and machine learning.

Model risk management and AI security auditing are complementary but distinct.

Model validation examines whether a model is appropriately designed, performs reliably and is suitable for its intended use.

AI security auditing examines vulnerabilities, access restrictions, data protection, system integrity and resistance to malicious manipulation.

Both forms of assurance may be necessary for a critical AI-based financial application.

The June 2026 proposal must be identified as draft guidance unless its finalisation is separately confirmed.

Third-Party and Outsourcing Risk

Financial institutions using external AI services should assess whether existing vendor governance arrangements adequately address AI-specific security risks.

Relevant considerations include:

Access to customer information and confidential institutional data.
Vendor security testing and independent assurance.
Model and software supply-chain integrity.
Data retention, subcontracting and incident notification.
Business continuity and exit arrangements.

RBI’s applicable outsourcing directions remain relevant when AI services form part of a regulated outsourcing arrangement.

Internal Audit and Independent Assurance

Internal Audit should consider whether the institution’s audit universe adequately captures material AI applications and their supporting infrastructure.

Risk-based audit coverage may need to include model interfaces, AI agents, critical datasets, externally hosted AI services and associated operational controls.

The objective is not to create duplicate assessments but to establish clear coordination between technology audits, model validation, compliance reviews and enterprise risk management.

5. What Should the Board, CRO, CISO and Internal Audit Review?

AI governance requires clearly allocated responsibilities.

Function	Key oversight responsibility
Board / Relevant Board Committees	Review material AI risks, governance arrangements and significant assurance findings
Chief Risk Officer	Integrate AI-related exposures into enterprise, operational and model risk management
Chief Information Security Officer	Oversee security architecture, AI access controls, monitoring and incident preparedness
Business and AI System Owners	Ensure approved use, documented accountability and effective operational controls
Internal Audit	Independently evaluate AI governance and the effectiveness of security controls

Seven Questions for Senior Management

Does the institution maintain a complete inventory of AI models, applications and autonomous agents?
Which AI systems have access to customer data, payment infrastructure or other critical operations?
Have material AI applications undergone independent security testing?
Can AI agents execute transactions or modify records without appropriate authorisation?
Are prompt injection, data leakage and model-integrity risks included in relevant assessments?
Can suspicious AI activity be detected, investigated and contained promptly?
Are significant AI security weaknesses tracked through remediation and reported to appropriate management committees?

These questions can help institutions identify where AI adoption has progressed faster than their assurance arrangements.

Conclusion

CERT-In’s publication of dedicated AI Security Auditing Guidelines on 4 November 2026 brings renewed attention to the need for structured assurance over artificial intelligence systems.

For banks, NBFCs and other financial institutions, AI security auditing should extend beyond conventional vulnerability scanning to include model interfaces, data security, autonomous agents, third-party integrations and the effectiveness of access controls.

The responsibility for managing AI risk must also be shared across business functions, technology, cybersecurity, risk management and independent audit.

The critical question is no longer whether an organisation uses artificial intelligence. It is whether the organisation can independently demonstrate that its AI systems operate securely, within approved authority and under effective governance.

RMAI’s Commitment to Professional Capacity Building

The Risk Management Association of India (RMAI) supports capacity building through specialised programmes covering Cybersecurity and Technology Risk Management, Fraud Risk Management, Model Risk Management, and Risk Management for Artificial Intelligence.

These programmes help banking, financial services and other organisational professionals strengthen their understanding of emerging risks, regulatory expectations and practical control frameworks.

Professionals and organisations are invited to explore relevant courses and institutional learning opportunities.

Model Risk Management Course: https://www.smartonlinecourse.co.in/courses/Model-Risk-Management-in-Banking–Financial-Institutions-6ae1f09cb865bc0fb1a78d68
Enquiries: info@rmaindia.org

Official References

Editorial note: CISG-2026-04’s publication details are verified, but its full text was unavailable for clause-level review. The AI audit checklist and management recommendations are RMAI’s analytical framework based on other identified sources, not quotations or confirmed requirements of CISG-2026-04.