Regulating AI-Assisted Cyber Threats In India: Assessing The Adequacy Of Cert-In's Emerging Cybersecurity Framework
Shaurya Raj, LL.M., National Law University Jodhpur
ABSTRACT
This project examines whether the Indian Computer Emergency Response Team's ("CERT-In") emerging framework for AI-assisted cyber threats built primarily through advisories and a nonbinding Blueprint issued on 25 May 2026, rather than through binding directions or statutory amendment is an adequate regulatory response to the threat it describes. Drawing directly on CERT-In's AI-specific advisories, the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, recent orders of the Supreme Court and the Delhi and Bombay High Courts on deepfake and "digital arrest" fraud, and comparable instruments from the European Union, the United Kingdom and the United States, this project finds that CERT-In's technical diagnosis is current and, in key respects, more demanding than comparable foreign instruments, but that it lacks the binding legal architecture, proportionate penalty structure, and accompanying criminal- law reform needed to convert that diagnosis into enforceable regulation. It concludes with calibrated recommendations for closing this gap.
