How do you rate your own AI risks before a regulator does it for you?

None of the new AI risk frameworks come with a compliance department. Your team shipped an AI feature last quarter, and regulators and industry bodies are publishing scoring rules faster than you can read them.

The clock is already running

India's CERT-In now requires reportable AI-related security incidents to be disclosed within six hours, according to The Indian Express. The deadline builds on CERT-In cybersecurity directions issued in 2022 that already required reporting of specified cyber incidents. Six hours is shorter than most teams' incident response meetings. Knowing what counts as reportable, before an incident forces the decision, is now part of the job.

• Six-hour disclosure window applies to AI security incidents.
• Builds on CERT-In's 2022 cybersecurity reporting directions.
• Framework covers organisations deploying AI systems.

A shared scorecard you can borrow

The Frontier Model Forum has published Version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats, per Crypto Briefing. It scores jailbreaks, techniques that make a model ignore its safety guardrails, on two axes: severity and likelihood. Version 1.0 signals the rulebook is still open to revisions. Still, it gives you a template: rate each risk by how bad it is and how likely it is.

• Score risks on severity and likelihood.
• Version 1.0 leaves room for future revisions.
• Built for labs and policymakers, usable by any team.

Data access is now a risk question too

India's draft DEPA for AI Training framework proposes secure data environments so startups can train models on data locked inside hospitals, banks and public agencies, Business Standard reports. It claims potential to unlock $500 billion in AI-driven value by 2030. The tradeoff changes your scoring: if you tap sensitive data, a privacy failure inherits the severity of that data, not of your model. Classification is not only about model behavior, it is about data flows.

• Secure data environments are the proposed middle ground.
• Privacy safeguards are part of the framework, not an afterthought.
• Draft status means requirements may shift.

What this does not solve

None of these frameworks gives you a full risk taxonomy for your product. The FMF framework covers only cyber jailbreaks. CERT-In covers incident reporting, not risk assessment. DEPA is a draft covering data sharing in India. You still need to decide which risks matter for your users, and these sources do not tell you how.

If you had to score every AI risk in your product on severity and likelihood today, which three would top the list?

Who on your team would answer a regulator's call within six hours of an AI security incident?

Spend 10 minutes listing every AI system you run and scoring each on severity and likelihood, so you have answers before a six-hour clock

Sources

The Indian Express, CERT-In six-hour AI incident reporting

Crypto Briefing, Frontier Model Forum jailbreak rating framework

Business Standard, India DEPA framework for AI training data