AI Governance
Data Centers
Drones
Climate
Privacy
Bob Dylan
India’s Reported AI Security Guidelines Put Incident Response in Focus
India’s CERT-In reportedly issued AI Security Auditing Guidelines calling for qualifying AI-related cybersecurity incidents to be reported within six hours and synchronized logs to be retained for 180 days. If confirmed, the provisions could make AI incident response a more immediate task for security and compliance teams.
The underlying guidelines were not available for verification. Their legal force, scope and relationship to existing requirements remain important open questions.
The reported CERT-In guidelines cover government and private entities and describe four risk tiers, with audits spanning governance, data practices, model risk, fairness and explainability. Organizations should verify which provisions are mandatory and which incidents and systems they cover before treating them as new obligations.
Snowflake and Oracle separately announced approaches to governing enterprise AI agents. Var India reported that Snowflake’s Cortex AI Gateway is generally available, while additional safeguards and analysis tools are in preview. Oracle says its architecture can enforce administrator-defined business rules at the database level, according to a Yahoo News Singapore contributor article.
Smartsheet announced ISO/IEC 42001 AI-management certification, an Australian IRAP security assessment, security event streaming and configurable data-sensitivity labels. The certification’s scope and assessment findings were not supplied.
Key Points
- The Snowflake and Oracle announcements show two ways to put controls closer to agent activity: managing connections and monitoring on one hand, and enforcing access and transaction rules at the database on the other. Neither announcement establishes that the controls work effectively in production.
- A recent vendor-sponsored Australian survey suggested that some organizations lack visibility into every agent action, although its methodology was not supplied. The new tools address that kind of oversight problem; they do not establish that it has been solved.
Implications
Organizations potentially affected by the Indian guidelines may need to coordinate AI-system records, incident triage and audit responsibilities across security, compliance and AI teams. The necessary changes depend on verification of the primary text.
Enterprise buyers should distinguish available controls from previews and architecture claims, and request evidence showing what actions are logged, restricted or rejected.
Watchpoints
Watch
CERT-In’s primary guidelines: which provisions are binding or newly created, when they apply, and which entities and incidents are covered.
Watch
Snowflake and Oracle: production availability and independent evidence that the announced agent safeguards enforce the controls described.
Watch
Smartsheet: the scope of its ISO/IEC 42001 certification and the coverage of its security event streams.
Fallout
The clearest potential compliance change concerns AI-related security incidents in India. Separate vendor announcements offer operational controls and assurance claims that still need scrutiny.
AI incident response in India
Reported security guidelines could affect incident reporting, recordkeeping and audits for organizations using AI.
Fresh developments
CERT-In reportedly issued guidelines specifying six-hour notification for qualifying AI cybersecurity incidents, 180-day synchronized log retention and risk-based audit expectations.
Why we noticed
The provisions could require practical coordination between AI owners and security teams. The available account does not establish which requirements are new, binding or applicable to particular organizations.
Watch for:
- The primary text, effective dates, incident definitions and covered entities.
- How mandatory provisions differ from recommended audit practices and existing requirements.
Controls for enterprise AI agents
Vendors are offering different ways to constrain and monitor agents that interact with enterprise systems.
Fresh developments
Snowflake announced approved business definitions and expanded gateway controls. Oracle presented an architecture that it says applies identity, access and business-rule controls at the database level.
Why we noticed
The distinction matters for procurement: approved definitions do not guarantee accurate answers, while claimed database enforcement needs evidence of availability and effectiveness.
Watch for:
- Which Snowflake safeguards move from preview into general availability.
- Independent testing and deployment evidence for Oracle’s database-level controls.
Supplier assurance and AI management
Certification and monitoring claims can inform supplier reviews, but their scope matters.
Fresh developments
Smartsheet announced ISO/IEC 42001 certification, an IRAP security assessment and additional monitoring controls alongside new AI agents and integrations.
Why we noticed
Certification is not proof that every AI feature is safe, and an assessment is not regulatory approval. Buyers need to know which services and activities each covers.
Watch for:
- The certification scope, assessment findings and security event stream coverage.
Final Thought
The practical question is becoming sharper: an AI governance claim matters most when an organization can identify the action it requires or the control it actually enforces.