Introduction
In our last lesson, we dissected the IT Act's framework for imposing civil liability for technological harm, concluding that its "human-centric" design creates a liability gap when dealing with autonomous AI. We saw how the law attempts to assign responsibility after a failure has occurred.
This lesson shifts our focus from reactive liability to proactive duty. What does the law require organizations to do to prevent cyber incidents in the first place? Your learning outcome is to describe the cybersecurity obligations for organizations deploying AI systems under the Act and associated rules. We will explore the legal authority and specific mandates issued by the Indian Computer Emergency Response Team (CERT-In), India's national cybersecurity agency. These rules form a critical layer of compliance for any entity developing or deploying AI in the Indian digital ecosystem.
1. The Guardian of Indian Cyberspace: CERT-In
The foundation for India's cybersecurity mandates is Section 70B of the Information Technology Act, 2000. This section establishes the Indian Computer Emergency Response Team (CERT-In) and empowers it to act as the national agency for cybersecurity.
CERT-In's functions include:
- Collecting, analyzing, and disseminating information on cyber incidents.
- Forecasting and issuing alerts about cybersecurity threats.
- Coordinating emergency responses to cyber incidents.
- Issuing guidelines, advisories, and whitepapers on information security practices.
Crucially, Section 70B(6) grants CERT-In the power to issue legally binding "Directions" to service providers, intermediaries, data centres, and any "body corporate." This authority is the source of the mandatory obligations we will now examine.
2. The 2022 CERT-In Directions: A New Era of Compliance
On April 28, 2022, CERT-In used its authority under Section 70B(6) to issue a set of Directions that significantly strengthened cybersecurity compliance requirements in India. These rules apply broadly to virtually all organizations operating online.
To get a clear overview of these significant changes, let's begin with a legal analysis that unpacks the key requirements of the 2022 Directions.
2022 CERT-In Directions on Reporting Cyber Incidents
The following analysis from law firm Trilegal provides a concise summary of the 2022 Directions. It explains their purpose and why they represent a major shift in India's cybersecurity and data breach reporting laws.
Please read the short introduction and the concluding paragraphs of the article. Focus on understanding the overall purpose of the Directions and the authors' summary of their impact on the compliance landscape.
As the article highlights, these Directions are not mere suggestions; they are legally enforceable mandates designed to augment India's incident response capabilities. They introduced several stringent obligations that we will now explore in detail.
3. A Deep Dive into the Mandates
Let's examine the primary legal text to understand the specific duties imposed on organizations, including those deploying AI systems.
a. Mandatory Incident Reporting and the AI Connection
Perhaps the most impactful requirement is the new timeline for reporting cyber incidents.
- Timeline: The 2022 Directions mandate that any service provider, intermediary, data centre, or body corporate must report cyber incidents to CERT-In within 6 hours of noticing them or being notified about them. This is a dramatic reduction from the previous, vaguer "reasonable time" standard.
What makes this directly relevant to our course is the expanded list of what constitutes a reportable incident.
CERT-In Directions dated 28 April, 2022
The Directions include a detailed list of mandatorily reportable incidents in Annexure I. This list explicitly brings AI and Machine Learning systems under its ambit. Let's examine the primary text.
Please read 'Annexure I: Types of cyber security incidents mandatorily to be reported...' starting on page 5 of the PDF. Scan the list and pay special attention to item (xx) on page 6.
Item (xx) is unequivocal:
"Attacks or malicious/ suspicious activities affecting systems/ servers/software/ applications related to Artificial Intelligence and Machine Learning"
This clause has profound implications. It means that cybersecurity events unique to AI are now formally recognized and must be reported. This includes:
- Adversarial Attacks: Malicious inputs designed to fool a model.
- Data Poisoning: Corrupting the training data to compromise the model's integrity.
- Model Inversion Attacks: Attempts to reconstruct sensitive training data from the model's outputs.
- Any unauthorized access or suspicious activity targeting the infrastructure running your AI applications.
b. Log Maintenance and Data Localization
To enable effective investigation after an incident is reported, the Directions impose strict data logging requirements.
- Requirement: All entities must "mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days."
- Localization: Critically, these logs "shall be maintained within the Indian jurisdiction."
For an organization deploying AI, this means logs related to model training, inference requests, API calls, and system performance must be meticulously kept and stored in India. These logs are the digital breadcrumbs essential for forensic analysis to determine the root cause of an AI failure or attack.
c. Other Key Obligations
The Directions include several other important mandates you should be aware of:
- Time Synchronization: All ICT system clocks must be synchronized to the Network Time Protocol (NTP) servers of the National Informatics Centre (NIC) or National Physical Laboratory (NPL). This ensures that logs from different systems can be accurately correlated during an investigation.
- Point of Contact: Organizations must designate a Point of Contact (PoC) to interface with CERT-In for all communications.
- Cooperation: Entities are mandated to provide any information or assistance required by CERT-In for incident response.
- Penalties for Non-Compliance: Failure to comply with these Directions can lead to punitive action under Section 70B(7) of the IT Act, which includes imprisonment for up to a year and/or a fine.
Test your understanding!
A financial services company in Mumbai uses a proprietary AI model for fraud detection. An internal audit reveals that for a period of two hours, a misconfiguration in their cloud environment allowed unauthorized API calls to the model, although no data was confirmed to be exfiltrated. The issue was fixed immediately.
Based on the 2022 CERT-In Directions, what are the company's immediate legal obligations? List at least three specific actions.
Show answer
- Report to CERT-In: They must report this event within 6 hours of discovery. Even without confirmed data loss, the unauthorized API access qualifies as a "malicious/suspicious activity" affecting an AI application (as per Annexure I, item xx) and an "unauthorised access of IT systems" (item iii).
- Provide Logs: They must be prepared to provide all relevant logs (API gateway logs, application logs, cloud configuration logs) from the time of the incident to CERT-In upon request. These logs must have been stored securely for the past 180 days.
- Ensure Time Accuracy: The logs provided must have accurate timestamps synchronized with India's official time sources, allowing investigators to build a precise timeline of the event.
- Communicate via PoC: All communication with CERT-In regarding the incident must be handled by the company's officially designated Point of Contact.
4. The Broader Governance Context
These cybersecurity Directions are not an isolated piece of regulation. They should be viewed as a foundational component of India's evolving AI governance strategy. While comprehensive, AI-specific legislation is still under discussion, the government is using existing instruments like the IT Act to establish baseline rules for safety and security.
This proactive stance on cybersecurity for AI systems indicates that any future, more comprehensive AI law will almost certainly have a strong security-by-design component.
Conclusion
In this lesson, we have shifted from analyzing liability after the fact to understanding the proactive duties mandated by law to ensure cybersecurity. We saw how the IT Act empowers CERT-In to create binding rules and how the 2022 Directions have established a strict compliance regime.
Key Takeaways:
- Section 70B of the IT Act establishes CERT-In and grants it the power to issue legally binding Directions on cybersecurity.
- The 2022 CERT-In Directions impose strict, mandatory obligations on all organizations, including those deploying AI.
- Key obligations include 6-hour incident reporting, 180-day log retention in India, and synchronization of system clocks.
- Critically for this course, any "malicious or suspicious activity" affecting an AI/ML system is now a mandatorily reportable incident, bringing adversarial attacks and other AI-specific vulnerabilities squarely within the legal framework.
- Non-compliance is a punishable offense under the IT Act, signaling the seriousness of these duties.
Preview of the Next Lesson:
We have now concluded our deep dive into the IT Act, covering intermediary safe harbours, civil liability, and cybersecurity obligations. This Act primarily governs the digital and cyber aspects of technology. But how does the law approach the societal impact of AI, particularly within the justice system itself?
In our next lesson, we will begin a new module, "AI in the Justice System." We will start by exploring a foundational concept: defining 'access to justice' and analyzing how AI technologies can both enhance and impede it. This will set the stage for our analysis of predictive policing and the automation of judicial functions.