India's proposed framework for auditing artificial intelligence (AI) systems seeks to bring greater accountability to AI developers and organisations deploying the technology. But questions remain over its legal enforceability, particularly when it comes to global technology companies such as OpenAI and Anthropic.

The Indian Computer Emergency Response Team (CERT-In) has proposed a security audit framework that requires AI-related security incidents to be reported within six hours. It classifies AI systems as low, moderate, high or critical risk, with critical systems facing continuous monitoring and independent audits by CERT-In-empanelled organisations.

The framework also prescribes safeguards for autonomous AI agents, including restrictions on the permissions they can access and a kill switch to shut them down when necessary.

While the proposed measures seek to address emerging cybersecurity risks, their implementation raises several questions. Will foreign AI companies have to submit to security audits in India? Will banks and other businesses using third-party AI tools also face compliance requirements? And could the framework increase costs for Indian AI startups?

Speaking to CNBC-TV18, Sudarshan Rajamani, Director, Dexian India, and Virag Gupta, Supreme Court Advocate and Cyber Law Expert, discussed the legal and practical challenges surrounding the proposed framework.

A key question is whether the proposed framework has the legal backing required to make compliance compulsory for AI companies.

Gupta questioned its enforceability, pointing out that the 107-page document refers to guidelines, advisories and blueprints but, in his assessment, does not have sufficient legal backing.

He identified three areas that need to be addressed through appropriate legal provisions.

Source link