IRDAI Information and Cyber Security Guidelines 2026: logs, reporting and changes

The short answer

On 6 April 2026 IRDAI issued the IRDAI Information and Cyber Security Guidelines, 2026, revising the guidelines of 24 April 2023. They set minimum standards for all insurers, foreign reinsurance branches, intermediaries such as brokers, corporate agents, web aggregators and TPAs, and the Insurance Information Bureau.¹ The core rules people search for are still there: ICT infrastructure logs kept for a rolling 180 days within India¹, and cyber incidents reported to CERT-In within 6 hours with a copy to IRDAI.¹ The bigger changes are in governance: quarterly risk committee meetings, a CISO independent of IT, tighter exception approvals and more frequent external testing.¹

Who the guidelines cover

The covering circular, reference IRDAI/GA&HR/CIR/MISC/51/4/2026, directs all insurers including foreign reinsurance branches, insurance intermediaries covering brokers, corporate agents, web aggregators, TPAs, IMFs, insurance repositories and others, and the Insurance Information Bureau of India to adhere to the guidelines from the current financial year.¹ The 2026 guidelines themselves are Annexure B; Annexure A summarises the changes from 2023.¹

If you sell software to an insurer or TPA, you are not named, but your customer’s obligations reach you: vendor access, outsourcing terms and cloud contracts all appear in the controls.

What changed from 2023

Annexure A lists the amendments. The ones most likely to change day-to-day work:

The exception rule is worth noting. Many security programs accumulate long-running exceptions. Under the new hierarchy, anything older than a year needs board approval, which makes them visible.

Logs: 180 days, in India

The logging section of the 2026 guidelines says:

• ICT infrastructure logs are kept for a rolling period of 180 days within the Indian jurisdiction, as per CERT-In directions.¹
• Logging facilities and log information are protected against tampering and unauthorised access.¹
• Logs are made available to law enforcement, IRDAI, CERT-In and CSIRT-Fin when required.¹
• Clocks are synchronised to an agreed accurate time source.¹

The 180-day rule comes from CERT-In. Its Directions of 28 April 2022 ask covered entities to keep ICT system logs “securely for a rolling period of 180 days” within Indian jurisdiction², and to synchronise clocks to NIC or NPL time servers or sources traceable to them.² IRDAI’s guidelines point to those directions rather than restating every detail.

Two practical points. First, “protected against tampering” is a design requirement, not a policy line. If the same admin account that runs a system can edit its logs, the logs don’t meet the intent. Second, the 180 days is a floor for ICT logs; the guidelines also say activity logs and audit trails are kept per your record retention requirements, which may be longer.¹

Privileged access and vendors

The access control section is direct about privileged users:

• Activities of privileged users such as system administrators are logged and independently reviewed on a regular basis.¹
• Sharing privileged IDs is prohibited.¹
• Vendors and contractors don’t get privileged access without close supervision and monitoring, with the business reason documented.¹

These rules were written for people. They apply just as well to service accounts used by automation. A shared “integration” login with admin rights is exactly the kind of shared privileged ID the guidelines prohibit.

Incident reporting: 6 hours

The guidelines say the organisation “shall mandatorily report cyber incidents to Cert-In within 6 hours of noticing or being brought to notice about such incidents with a copy to IRDAI and other concerned regulators.”¹ They also expect enterprise-wide monitoring of security incidents by a SOC on a 24x7 basis.¹

Six hours is short. It assumes you can tell, quickly, what happened and which systems were involved. That depends on the logs above being complete and searchable, and on knowing which accounts touched what.

Our post on CERT-In directions for hospitals covers the CERT-In side in more detail, including which incident types are reportable.

Where AI tools and agents fit

The 2026 guidelines, as we read them, don’t set rules specific to AI agents. But insurers and TPAs are adding AI to claims intake, pre-authorisation and fraud review, and those tools need accounts, data access and sometimes write access. The general controls apply to them:

• Give each AI tool its own identity. A shared login breaks the privileged-ID rule and makes the 6-hour report harder to write.¹
• Log what the tool did, not just that it ran. “Agent session started” won’t help a CERT-In report. Record the action, the target system and the result.
• Keep the tool’s logs out of its own reach. The tamper-protection requirement means an AI tool with write access shouldn’t be able to alter its own audit trail.¹
• Treat the AI vendor as a vendor. Outsourcing approvals, cloud provider checks and privileged-access supervision all apply.¹

For health insurance specifically, AI records also matter for claims timelines and disputes. Our post on AI records for pre-authorisation and the NHCX post cover the claims side, and our insurers page shows how agent actions get recorded and checked.

A checklist

1. Read the 2026 guidelines and Annexure A on IRDAI’s site; don’t work from the 2023 version.¹
2. Move ISRMC meetings to at least quarterly and set up exception approvals by duration.¹
3. Check the CISO reporting line.¹
4. Schedule external grey or white box tests every 6 months for internet-facing systems.¹
5. Keep ICT logs 180 days in India, protected from tampering, with synchronised clocks.¹
6. Remove shared privileged IDs, including for automation and AI tools.¹
7. Rehearse a 6-hour CERT-In report from your current logs.¹
8. Start a cryptographic asset inventory.¹

Questions people ask

Do the 2026 guidelines replace the 2023 guidelines?

The circular says the revised guidelines are issued in view of the evolving threat landscape and industry feedback, revising the April 2023 guidelines.¹ Work from the 2026 text.

Do they apply to TPAs and brokers?

Yes. The circular names brokers, corporate agents, web aggregators and TPAs among the intermediaries that must adhere.¹

How long must insurers keep logs?

ICT infrastructure logs for a rolling 180 days within India; other audit trails per your retention requirements.¹

This post summarises IRDAI’s published documents and is not legal advice; check IRDAI’s site for the current text. To see agent actions recorded with approvals in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).

Written with AI assistance and checked against our claims register.