Indian Computer Emergency Response Team issued enhanced cybersecurity guidelines this month for original equipment manufacturers and technology providers, requiring faster coordinated vulnerability disclosure, patch testing, and incident reporting as AI-assisted reconnaissance tools shrink the time between flaw discovery and exploitation, according to the PDF notice posted on CERT-In’s portal.

Scope of covered vendors

The document applies to hardware makers, cloud providers, managed service integrators, and software vendors supplying products to Indian enterprises, government agencies, and critical infrastructure operators. CERT-In referenced its April 2026 advisory on frontier-AI-driven risks and the existing six-hour incident reporting rule under the 2022 directions.

Vendors must maintain contact points reachable from India Standard Time business hours and support independent verification of patches by CERT-In or contracted assessors. The language stops short of mandating local data residency but insists that forensic logs be available for cross-border supply-chain investigations.

What changes for CISOs

Security leaders at banks and IT services firms said the guidelines push procurement teams to embed AI-era response timelines in vendor contracts. Where older agreements specified 90-day patch cycles, CERT-In’s framing expects critical fixes on calendars measured in days when active exploitation is detected.

OEMs must document how automated tools they use internally for vulnerability discovery cannot be repurposed by customers in ways that violate export or misuse policies—a nod to growing concern that generative models lower the skill floor for crafting exploit chains.

Enforcement realities

Guidelines are not standalone criminal law but sit under Section 70B directions; repeated non-cooperation can trigger blocking advisories or public alerts naming slow vendors. MeitY has parallel efforts on trusted electronics and data centre classifications, so enterprise buyers may treat CERT-In compliance as a tie-breaker in RFP scoring.

Indian market angle

India’s installed base of affordable smartphones and rapid SaaS adoption creates a large attack surface. Domestic startups selling to government clouds will need to show they inherit OEM commitments downstream. For global vendors, the practical cost is staffing India-time incident bridges and pre-positioning patch binaries on local content delivery networks to meet shortened deadlines.

Procurement clauses

Large IT services exporters are inserting CERT-In-aligned response timelines into master service agreements with multinational clients, using the guidelines as a benchmark even when contracts are governed by foreign law. That shift pressures OEMs to maintain parallel disclosure tracks for Indian subsidiaries and global headquarters.

Cloud regions hosted in Mumbai and Hyderabad saw ticket volumes rise on questions about shared responsibility for hypervisor patches. CERT-In’s language clarifies that tenants remain responsible for guest OS images while providers must secure control planes—a distinction that still confuses mid-market CIOs.

Red-team expectations

Security researchers hope the guidelines encourage coordinated disclosure rather than full-public dumps of proof-of-concept code. Ethical hackers said OEMs that ignore India-time bridges risk seeing flaws sold on grey markets tuned for rupee-denominated ransomware demands.

SME exposure

Small manufacturers running legacy SCADA systems may lack vendor support for rapid patches; CERT-In encouraged sectoral ISACs to publish tested workarounds when OEMs cannot ship fixes within stated windows. Insurance underwriters are reviewing whether cyber policies cover AI-assisted attacks explicitly, another push for documented patch cadence.