Do the CERT-In directions apply to a small firm?

The directions apply to body corporates, and CERT-In’s FAQ explains a body corporate as any company, including a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities.

Do the six hours run from the attack or from noticing it?

From noticing the incident or being told about it. CERT-In’s FAQ says entities may report what they know at the time and add details later.

Do we need to keep AI tool logs for 180 days?

The directions cover logs of all ICT systems, kept for a rolling 180 days in India. Treating AI system logs like other system logs is the cautious reading; confirm with your adviser.

Is CERT-In the same as the Data Protection Board?

No. CERT-In handles cyber security incidents under the IT Act; the Data Protection Board enforces the DPDP Act. A data breach can need reports to both.

ANVE: the private AI office, on the record. See what that means

ANVE

Private AI glossary · updated 2026-10-07

CERT-In
India’s national cyber incident agency, and the duties its 2022 directions put on offices.

Short answer. CERT-In, the Indian Computer Emergency Response Team, is India’s national agency for responding to cyber security incidents, appointed under section 70B of the Information Technology Act, 2000 and working under MeitY. Its directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporates and government organisations. Four points matter to most offices: report listed cyber incidents to CERT-In within 6 hours of noticing them; keep logs of all ICT systems for a rolling 180 days within India; synchronise system clocks with NIC or NPL time servers; and name a point of contact. Data breaches, data leaks and attacks on AI and machine learning systems are among the incident types to report. CERT-In’s FAQ explains that a body corporate includes a firm or sole proprietorship. This is general information, not legal advice.

The 2022 directions in brief

Direction	Requirement
(i) Clock synchronisation	Connect ICT systems to the NTP servers of NIC or NPL, or to servers traceable to them.
(ii) Incident reporting	Report incidents listed in Annexure I within 6 hours of noticing them or being told about them.
(iii) Point of contact	Designate a point of contact, and act on CERT-In orders for information or assistance.
(iv) Logs	Enable logs of all ICT systems and keep them securely for a rolling 180 days within Indian jurisdiction.
(v) Subscriber records	Data centres and VPS, cloud and VPN providers keep validated customer details for 5 years.
Non-compliance	May attract section 70B(7): imprisonment up to one year, a fine up to ₹1 lakh, or both.

Incident types that touch AI use

Unauthorised access to IT systems or data.
Data breach.
Data leak.
Attacks or suspicious activity affecting cloud computing systems, servers, software or applications.
Attacks or suspicious activity affecting systems, servers, software or applications related to artificial intelligence and machine learning.
Identity theft, spoofing and phishing attacks.

CERT-In’s advice on generative AI

In its advisory of 26 March 2025, CERT-In told organisations to avoid online generative AI tools for professional work involving sensitive information, to use only tools approved and verified by the organisation, to review tools’ access to business data periodically, and to fact-check outputs instead of relying on AI alone for business decisions. Its advisory of 9 May 2023 on AI language-based applications told users not to submit sensitive information such as login credentials or financial information.

What an office should set up

A named point of contact and an incident route that can report within 6 hours.
Logs from servers, firewalls and AI tools kept for 180 days, stored in India.
Clocks synchronised to NIC or NPL time, so logs from different systems line up.
A clear rule that client confidentiality clauses do not stop reporting: CERT-In’s FAQ says the statutory duty overrides them.
ANVE keeps its log of model calls on the device in the office; an office still needs its own log retention and reporting process.

Questions people ask

Do the CERT-In directions apply to a small firm?: The directions apply to body corporates, and CERT-In’s FAQ explains a body corporate as any company, including a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities.
Do the six hours run from the attack or from noticing it?: From noticing the incident or being told about it. CERT-In’s FAQ says entities may report what they know at the time and add details later.
Do we need to keep AI tool logs for 180 days?: The directions cover logs of all ICT systems, kept for a rolling 180 days in India. Treating AI system logs like other system logs is the cautious reading; confirm with your adviser.
Is CERT-In the same as the Data Protection Board?: No. CERT-In handles cyber security incidents under the IT Act; the Data Protection Board enforces the DPDP Act. A data breach can need reports to both.

What is not real yet

No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.

Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.

CERT-InIndia’s national cyber incident agency, and the duties its 2022 directions put on offices.