India's AI Security Framework: Will OpenAI and Anthropic Have to Comply?

India is moving toward a more structured approach to artificial intelligence regulation, with the Indian Computer Emergency Response Team (CERT-In) proposing a new security audit framework. The initiative seeks to hold AI developers and organizations accountable by classifying systems based on risk levels ranging from low to critical. While local entities may find the path to compliance clear, the potential impact on global players like OpenAI and Anthropic remains a subject of intense debate. As users search for information regarding OpenAI in India, the question of whether these international giants will submit to local audits has become a central point of contention for policymakers and industry observers.

The proposed framework mandates that security incidents be reported within six hours and requires continuous monitoring for critical systems. Furthermore, it introduces safeguards for autonomous AI agents, including restricted access permissions and the implementation of a mandatory kill switch. However, legal experts have raised concerns regarding the document's authority. Virag Gupta, a Supreme Court Advocate and Cyber Law Expert, noted that the 107-page proposal relies on guidelines and blueprints rather than established law, questioning its ability to mandate compliance from foreign entities.

India's proposed AI security framework faces significant questions regarding legal enforceability and compliance for global tech firms.

Navigating the Regulatory Landscape for OpenAI in India

Sudarshan Rajamani, Director at Dexian India, emphasized that regulatory interest in security should apply to any provider serving Indian customers or processing domestic data, regardless of where a company is headquartered. Despite this, Rajamani expressed skepticism that global firms would readily agree to independent audits conducted by CERT-In-empanelled organizations. He suggested that while foreign companies cannot simply opt out of cybersecurity obligations, the specific mechanisms for enforcing these rules on international developers remain unclear.

Gupta argued that existing frameworks, such as the Information Technology Act and the IT Intermediary Rules, should already cover foreign AI companies. He suggested that firms like Anthropic should be classified as intermediaries, thereby subjecting them to requirements for grievance redressal. Additionally, he highlighted the need for better integration with law enforcement, noting that the current proposal lacks a clear role for police in handling AI-related security incidents.

Beyond developers, the framework poses challenges for banks and businesses that procure third-party AI tools. Organizations must now consider how to authorize external AI providers to access sensitive data without compromising confidentiality. The potential for data leakage and the absence of fully implemented legislation, such as the Digital Personal Data Protection Act, add layers of uncertainty for domestic enterprises aiming to integrate AI into their operations.

Why it matters

The proposed framework represents a significant shift in how India intends to manage the risks associated with rapid AI adoption. For businesses and government bodies, it necessitates a stricter approach to data governance and third-party tool procurement. The outcome will determine whether international AI providers must align their global operations with specific Indian security standards.