CERT-In AI Security Audit Self Assessment

Tier one AI system, check it against the nine audit domains with the ISO/IEC 42001 mapping, and get a gap report. Based on the AI Security Auditing Guidelines v1.0, 4 November 2026. Everything runs in your browser.

Describe the system

System name CERT-In system types (section 4.5, choose all that apply)

Model source (section 4.6)

Model origin does not remove scope. A vendor model is still your system to audit.

Life cycle stage Sector

In scope: every organisation that operates AI in India or processes the data of Indian citizens (section 4.3). Out of scope: academic research not in production, rule based automation, personal consumer use.

Tier calculator (section 5)

Eight factors, each scored 1 to 4. Composite score 8 to 32.

Escalation triggers (section 5.6)

Any trigger forces Tier 4 whatever the score. Record the rationale for the trigger in the tiering decision.

Rules from the Guidelines

Score before crediting controls. Missing evidence cannot justify a low score (section 5.4).
Tiers 3 and 4 carry full obligations whatever the organisation size. Proportionality applies to Tiers 1 and 2 only (section 5.7).
Reassess at least annually and before any material change goes live. A downgrade needs documented reassessment and approval (section 5.7).

Domain checklist (sections 8 to 11)

Answer for the system as it runs today. Yes means the control exists and you can show the evidence. Partly means it exists without evidence, or covers part of the system. Not applicable removes the question from the score. Each question carries the Guidelines section, the ISO/IEC 42001:2023 clause or Annex A control, the ISO/IEC 27001:2022 control or ISO/IEC 27090:2026 clause where one carries the requirement, and what an auditor would ask to see. The Guidelines map each domain to ISO/IEC 42001 at clause and Annex A family level (the mapping rows in section 8 and Table 36 in section 14) and ask the audit programme to cross reference clauses and controls (section 7.4). The references here were checked against the text of the standards; where a commonly cited control does not fit, the note says why.

Show recommended domains (not mandatory for this tier)

GovernanceCore audit domainsSecurity, supply chain, architecture specificRecommended for this tier

Results

Talk to Pricoris

Section numbers refer to AI Security Auditing Guidelines v1.0 (CERT-In Working Group on Indian Standards for Cybersecurity Auditing, 4 November 2026). The Guidelines have no effective date yet, and this tool is a reading of the text by Pricoris LLP, not CERT-In's. It is a reading aid, not an audit opinion; Tier 2 and above need a CERT-In empanelled auditor. Your answers stay in this browser (local storage). No analytics, no cookies, no calls to any server other than Google Fonts. Prepared by Pricoris LLP. See the CERT-In map and the RBI Model Risk Management map.