India’s 2026 IT Rules Amendments: AI Labeling, Deepfake Compliance, Safe Harbour, and the Path to Wider AI Governance
PoliticalMarketerOn this page14 sections
India’s 2026 IT Rules amendments are India’s first binding intermediary rules written specifically around realistic synthetic media.
The amendments bring synthetically generated information, or SGI, into the due diligence framework under the Information Technology Act, 2000, and the IT Rules, 2021. They require covered intermediaries to prevent unlawful synthetic media, label permitted SGI, retain provenance information where technically feasible, warn users about misuse, and act within shorter grievance and takedown windows.
The rules matter to social networks, AI image and video tools, voice cloning services, messaging services, publishers, advertisers, creators, enterprises, and users whose identity can be affected by deepfakes.
They also form one layer of a wider Indian AI governance model built around existing law, sector regulation, data protection, technical standards, risk assessment, and new national AI governance bodies.
How India Reached the 2026 AI Content Rules
India’s 2026 framework was developed through several stages rather than through one general AI law. The policy path began with responsible AI principles, moved through intermediary accountability and data protection, and then added AI-specific duties for synthetic media.
The National Strategy for Artificial Intelligence in 2018 introduced the “AI for All” approach and placed responsible AI within India’s long-term technology policy. Follow-up work in 2021 set out principles for responsible AI design, development, and deployment.
The IT Rules, 2021, notified on February 25, 2021, under the Information Technology Act, created detailed due diligence duties for intermediaries and significant social media intermediaries. The 2022 amendments strengthened user protection and created the Grievance Appellate Committee mechanism. The 2023 amendments expanded due diligence in areas such as online gaming and false or misleading information relating to Central Government business.
Government advisories in December 2023 and March 2024 then made clear that existing intermediary duties also applied to risks arising from synthetic content tools. In March 2024, the Cabinet approved the IndiaAI Mission with an outlay of ₹10,371.92 crore over five years, covering compute, datasets, indigenous AI development, skills, startup financing, applications, and Safe and Trusted AI.
The Digital Personal Data Protection Rules, 2025 operationalized the Digital Personal Data Protection Act, 2023. An October 2025 amendment to the IT Rules also tightened the process for government removal notices under Rule 3(1)(d). A separate October 2025 draft then proposed an SGI framework with a fixed 10 percent label requirement. After consultation, the final Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 were notified on February 10, 2026 and came into force on February 20, 2026.
Quick Facts About India’s 2026 IT Rules Amendments
The final rules focus on realistic synthetic audio, images, and video, not every output produced with AI.
- The rules took effect on February 20, 2026.
- SGI covers realistic synthetic audio, visual, or audiovisual information depicting a person or event as real or authentic.
- Pure AI-generated text is not SGI, though unlawful text remains subject to other legal duties.
- Routine editing, color correction, compression, noise reduction, transcription, and similar good-faith changes can fall outside SGI when they do not materially misrepresent the source.
- Permitted SGI requires a prominent disclosure and permanent provenance information where technically feasible.
- The final law does not contain the draft’s 10 percent label-size rule.
- Significant social media intermediaries must obtain a user SGI declaration and use reasonable technical verification before publication.
- Certain response windows now run for seven days, 36 hours, three hours, or two hours depending on the legal trigger.
What Counts as Synthetically Generated Information
Synthetically generated information is a legal category aimed at realistic synthetic media that can be mistaken for a natural person or real-world event. The definition is narrower than the everyday phrase “AI-generated content.”
Rule 2(1)(wa) covers audio, visual, and audiovisual information artificially or algorithmically created, generated, modified, or altered using a computer resource, where the result appears real, authentic, or true and portrays a person or event in a way likely to be perceived as indistinguishable from reality. Deepfake video, cloned voices, face swaps, realistic fake photographs, and synthetic recordings can fall within that definition.
The final rules exclude routine or good-faith editing that does not materially change the substance, context, or meaning of the original material. Examples include brightness correction, color balance, compression, background-noise removal, transcription, and video stabilization. Good-faith document preparation and accessibility work can also be excluded when they do not create false records or materially manipulate content.
Pure written output sits outside the SGI definition. An AI-generated article or chatbot response can still be unlawful information under other provisions, but the SGI-specific labeling and provenance duties focus on audio, visual, and audiovisual material. Mixed content can still be covered. A fake AI photograph paired with misleading text remains SGI because the image itself is synthetic media.
Who Must Comply and What Each Layer Requires
The 2026 rules distinguish general intermediary duties from enhanced pre-publication duties for significant social media intermediaries. The difference affects product design, upload flows, moderation, verification, and grievance handling.
Rule 3(3) applies where an intermediary offers a computer resource that enables or supports the creation, generation, modification, alteration, publication, transmission, sharing, or dissemination of SGI. Official examples include AI image and video generation tools, voice synthesis services, voice cloning tools, realistic media manipulation services, and services used to publish or distribute SGI.
Covered intermediaries must use reasonable and appropriate technical measures to prevent users from creating or distributing SGI that violates applicable law. They also face labeling, provenance, anti-removal, warning, and enforcement duties.
Significant social media intermediaries carry an additional pre-publication layer. Before content is displayed, uploaded, or published, an SSMI must ask the user whether the material is SGI. It must then use reasonable and appropriate technical measures, including automated tools or other suitable mechanisms, to test the declaration based on the content’s nature, format, and source. When declaration or verification identifies SGI, the service must display a clear and prominent notice.
This means an AI generation tool, a hosting service, and a large social network can face overlapping but different duties depending on their role in the content chain.
AI Labels, Provenance Metadata, and the Removed 10 Percent Rule
Permitted SGI can remain online, but users must be able to identify it as synthetic. The final framework combines visible or audible disclosure with technical provenance.
For visual and audiovisual SGI, the disclosure must be clear, prominent, easily noticeable, and adequately perceivable. Audio requires a prominent prefixed disclosure. The content must also carry permanent metadata or another suitable provenance mechanism, to the extent technically feasible, including a unique identifier that can identify the intermediary computer resource used to create, modify, or alter it.
Intermediaries must not enable modification, suppression, or removal of the required label, permanent metadata, or unique identifier. Export and editing functions therefore need to preserve required markers.
The 10 percent requirement belongs to the October 2025 draft, not the final February 2026 law. The draft required the marker to cover at least 10 percent of a visual display or the initial 10 percent of an audio item. The final rule replaced that numeric standard with a prominence test.
That difference is important for platform specifications, newsroom policies, creator guidance, and compliance documents. A draft proposal should not be treated as the current binding standard.
Unlawful SGI, Deepfakes, and Proactive Prevention
The SGI framework does more than require disclosure. Covered intermediaries must use reasonable and appropriate technical measures to prevent categories of synthetic media that violate applicable law.
Official guidance identifies child sexual exploitation and abuse material, non-consensual intimate imagery, obscene or sexually explicit content, material invasive of bodily privacy, false documents or electronic records, certain synthetic material connected to explosives, arms, or ammunition, and deceptive portrayals of people or real-world events.
The impersonation category has broad practical reach. Examples include a fake video of an election candidate making remarks never made, a cloned celebrity endorsement, a fake executive instruction to transfer funds, an emergency scam call using a family member’s cloned voice, or synthetic news footage depicting an event that did not occur.
The same technology can therefore produce very different legal outcomes. A synthetic voice used transparently for accessibility can be lawful. A cloned voice used to impersonate a person for fraud can fall into an unlawful category. The rule focuses on unlawful output and deceptive presentation, not on banning generative AI itself.
Takedown and Grievance Timelines
The 2026 amendments shorten several response windows, but each deadline applies to a defined trigger. The three-hour and two-hour periods do not apply to every complaint.
When an intermediary receives actual knowledge through a court order or a reasoned intimation from an authorized government officer or agency under Rule 3(1)(d), the specified unlawful information must be removed or disabled within three hours. The earlier period was 36 hours.
General user grievances under Rule 3(2)(a)(i) must be resolved within seven days, reduced from 15 days. Certain grievances seeking removal or disabling of access carry 36 hours, reduced from 72 hours.
A separate two-hour period applies to complaints involving specified categories such as nudity, sexual content, morphed material, and impersonation under Rule 3(2)(b). The earlier deadline was 24 hours. This route is especially relevant to non-consensual intimate imagery and deepfake abuse.
The amended framework also permits one or more specially authorized police officers, each not below the rank of Deputy Inspector General of Police, to issue relevant reasoned intimations where the police administration is the issuing authority.
Platforms therefore need intake systems that identify the legal basis of every request immediately. Court orders, authorized government notices, ordinary grievances, urgent removal requests, and victim complaints need different routing and deadlines.
Safe Harbor and the Shift Toward Technical Due Diligence
Section 79 safe harbor remains central to India’s intermediary liability model. The 2026 amendments do not remove safe harbor, but they make technical and operational due diligence more important for services dealing with SGI.
The rules clarify that removing or restricting access to information, including SGI, in compliance with the rules does not by itself violate the Section 79 conditions that protect intermediary status.
At the same time, an SSMI that knowingly permits, promotes, or fails to act on SGI in breach of the rules can be treated as having failed to exercise due diligence. Failure to meet applicable due diligence requirements can expose an intermediary to loss of Section 79 protection and legal action under other laws.
Compliance now reaches product and engineering decisions. A covered service may need technical prevention, upload declarations, verification, labeling, provenance retention, user warnings, account enforcement, record preservation, and fast legal-notice routing.
Intermediaries offering SGI creation tools must also warn users that unlawful synthetic media can attract penalties or punishment. General user awareness duties now apply at least once every three months rather than once a year.
A practical compliance system should therefore map where SGI enters the service, distinguish ordinary editing from realistic synthetic media, classify permitted and prohibited uses, preserve required markers, route urgent complaints correctly, document automated detection limits, and maintain human review where context is necessary.
How the 2026 Rules Fit India’s Wider AI Governance Model
The 2026 IT Rules regulate one part of AI risk, mainly intermediary duties around synthetic media and unlawful online content. India’s broader model also covers data protection, sector regulation, safety testing, standards, risk classification, compute, public AI infrastructure, and cross-government coordination.
The India AI Governance Guidelines, released on November 5, 2025, use seven guiding principles: Trust is the Foundation, People First, Innovation over Restraint, Fairness and Equity, Accountability, Understandable by Design, and Safety, Resilience and Sustainability. Their recommendations cover infrastructure, capacity building, policy and regulation, risk mitigation, accountability, and coordinated governance bodies.
The guidelines state that a separate horizontal AI law was not required at that stage because many AI harms can be handled through existing laws. They also call for continuing review of gaps and targeted legal changes where current law is inadequate.
That model combines several layers. The IT Act and IT Rules address intermediary liability and online harms. The Digital Personal Data Protection Act, 2023 and its 2025 Rules govern digital personal data. Consumer, criminal, copyright, competition, and sector-specific laws can apply depending on the AI use and resulting harm. Sector regulators remain responsible within areas such as finance, telecom, securities, insurance, and healthcare.
The guidelines also propose an India-specific AI risk assessment and classification framework, common standards for content authentication, data integrity, fairness, and cybersecurity, regulatory sandboxes for higher-risk uses, and a national AI incident database with local reporting and feedback loops.
New AI Governance Bodies and the 2026 Implementation Phase
India moved from policy recommendations to formal coordinating bodies in April 2026. This is one of the most important changes after the November 2025 governance guidelines.
On April 16, 2026, the government constituted the AI Governance and Economic Group, or AIGEG, as a high-level inter-ministerial body for national AI governance strategy, policy coordination, responsible AI adoption, and economic issues including labor-market effects.
On April 18, 2026, the Technology and Policy Expert Committee, or TPEC, was constituted as a standing expert advisory body supporting AIGEG with technical, legal, policy, and strategic input.
The IndiaAI Safety Institute, or AISI, is being developed as the technical safety arm. Its proposed work includes AI safety research, risk assessment, system testing, draft standards, evaluation methods, capacity building, and coordination with regulators and public bodies. Official updates in 2026 described AISI as being established to support domestic AI safety research and technical governance.
The planned national AI incident database is related to this work. The governance guidelines propose a federated reporting model in which local or sector databases can feed structured information into a national system. The goal is to identify recurring harms, understand causes, improve risk classification, and support oversight. Full operation of the database is presented as a medium-term action, not as a completed nationwide system.
What Changed After the February 2026 Amendment
The February amendment is binding, but later actions show that the policy process is still active.
On March 16, 2026, the government issued an advisory addressing the generation, hosting, publication, transmission, sharing, or uploading of abusive, defamatory, objectionable, derogatory, and misleading SGI. Government statements later in 2026 continued to stress technical prevention, labeling, metadata, and shorter removal periods.
A second set of IT Rules changes was released for consultation on March 30, 2026, and updated in April. The April draft proposed continuous and clearly visible SGI labeling throughout the duration of visual content. It also proposed making certain written ministry clarifications, advisories, orders, directions, standard operating procedures, codes of practice, and guidelines part of intermediary due diligence when issued within the stated legal framework.
As of October 28, 2026, the ministry’s policy page still lists these measures as draft amendments. They should therefore be treated as proposed changes, not as replacements for the binding February text.
For current SGI labeling, the binding rule requires a prominent visual label or prefixed audio disclosure. Continuous labeling throughout the duration of visual content belongs to the later draft unless a final notification brings that wording into force.
What the Rules Mean for Platforms, AI Companies, Newsrooms, Brands, and Creators
The 2026 amendments affect different actors at different points in the synthetic-content chain. Compliance depends on function, not only on whether an organization markets itself as an AI company.
Social platforms need upload declarations where required, verification logic for SSMI duties, labels, rapid grievance handling, notice routing, account enforcement, and technical moderation for unlawful SGI.
AI image, video, and voice tools need controls against prohibited synthetic media, user warnings, output labeling, provenance mechanisms where technically feasible, and protection against removal of required markers.
Newsrooms need internal rules for synthetic images, reenactments, voice generation, translation, and AI-assisted editing. Ordinary color correction or transcription is not automatically SGI, but realistic synthetic depictions of people or events require closer review.
Brands and advertisers need to know whether creative assets contain realistic synthetic depictions, whether endorsements are genuine, and whether the receiving platform will classify an asset as SGI.
Creators need to distinguish harmless editing from deceptive impersonation, false event depiction, morphed intimate imagery, or other unlawful uses. Lawful synthetic media can still require disclosure.
Enterprises should also treat voice cloning and executive impersonation as security risks. A fake audio instruction to transfer funds can be both a content-governance problem and a fraud vector, linking AI governance with identity checks, approval controls, employee training, and incident response.
The Path to Broader AI Governance in India
India’s current direction is a layered AI governance model rather than a single comprehensive AI statute. The model combines existing law, targeted amendments, data protection, sector rules, technical standards, risk tools, safety research, public infrastructure, and central policy coordination.
The 2026 SGI rules show how that model can become binding in a specific area where immediate online harm is identified. The AI Governance Guidelines show the wider direction, with graded responsibility, risk assessment, incident reporting, voluntary standards where suitable, technical testing, sector oversight, and future legal changes when gaps become clear.
The IndiaAI Mission supplies capability and infrastructure. The DPDP framework governs personal-data use. AIGEG provides cross-government policy coordination. TPEC supplies expert advice. AISI is intended to provide technical safety research and testing. Sector regulators continue to govern domain-specific AI uses. The IT Rules provide a direct enforcement route for AI-related online harms.
Several issues remain open, including synthetic-media detection accuracy, provenance interoperability, responsibilities across the AI value chain, open-source models, copyright and training data, liability for agentic systems, audit methods, incident reporting, cross-border services, and the point at which voluntary measures should become binding.
Through October 2026, India is moving from general responsible-AI principles toward enforceable duties in selected higher-risk areas while retaining a wider risk-based and sector-led model. The February 2026 IT Rules are best understood as one binding layer in a larger AI governance system that is still developing.
India’s 2026 IT Rules amendments mark a major shift from general intermediary responsibility toward specific duties for synthetic media. The rules create a legal framework for identifying, labeling, tracking, and removing unlawful AI-generated audio, images, and video. They also impose faster grievance and takedown timelines, stronger provenance requirements, and additional verification duties for significant social media intermediaries.
The amendments also show that India is building AI governance through multiple legal and technical layers rather than relying on one broad AI law. The IT Act and IT Rules address intermediary responsibility and online harms. The Digital Personal Data Protection framework governs personal data. The IndiaAI Mission supports infrastructure, research, compute, skills, and safe AI development. New bodies such as the AI Governance and Economic Group, Technology and Policy Expert Committee, and IndiaAI Safety Institute add policy coordination and technical oversight.
For platforms, AI companies, publishers, advertisers, creators, and enterprises, compliance now requires more than a written policy. Product design, content generation systems, upload workflows, provenance metadata, user disclosures, moderation, grievance handling, security controls, and legal response systems all need to work together.
India’s broader AI governance framework is still developing. Rules covering synthetic media are already binding, while areas such as AI incident reporting, safety testing, risk classification, agentic systems, copyright, training data, technical standards, and sector-specific controls continue to evolve. Organizations operating in India should therefore treat AI compliance as an ongoing governance process and monitor new notifications, standards, court decisions, and sector rules as they emerge.
India’s 2026 IT Rules Amendments: FAQs
India’s 2026 IT Rules amendments update the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules to introduce specific duties for synthetically generated information. The rules cover realistic AI-generated or substantially altered audio, images, and video, including deepfakes, face swaps, and cloned voices. They also strengthen labeling, provenance, grievance handling, and takedown requirements.
The amendments were notified on February 10, 2026, and came into force on February 20, 2026. From that date, covered intermediaries became subject to the new requirements relating to synthetic media, disclosure, technical safeguards, and shorter response periods.
Synthetically generated information, or SGI, generally refers to artificially or algorithmically created or materially altered audio, visual, or audiovisual content that appears realistic and can portray a person or event as authentic. Examples include deepfake videos, realistic AI images, cloned voices, and manipulated recordings.
Pure AI-generated text does not fall within the specific SGI definition used by the 2026 amendments. The SGI framework mainly focuses on realistic audio, visual, and audiovisual material. AI-generated text can still be subject to other Indian laws and intermediary duties when it contains unlawful material.
No. The rules do not prohibit all AI-generated media. Lawful synthetic content can remain available when applicable disclosure and provenance requirements are followed. Content that violates Indian law, such as certain impersonation, sexual abuse material, fraudulent synthetic media, or other prohibited content, can require removal or access restrictions.
Permitted SGI must carry a clear and prominent disclosure that allows users to recognize the content as synthetic. Audio content requires an appropriate audible disclosure. Covered services must also preserve permanent provenance information or similar technical markers where technically feasible.
No. The fixed 10 percent requirement appeared in the October 2025 draft. The final February 2026 rules replaced that proposal with a requirement for a clear, prominent, and adequately perceivable disclosure. Organizations should therefore follow the final notified requirements rather than relying on the earlier draft threshold.
Different deadlines apply to different legal situations. Certain court orders or authorized government notices can require action within three hours. General user grievances must generally be resolved within seven days. Some removal requests have 36 hours, while specified complaints involving nudity, sexual content, morphed material, or impersonation can require action within two hours.
Section 79 of the Information Technology Act provides conditional legal protection to eligible intermediaries for third-party content. Intermediaries must comply with applicable due diligence duties to retain that protection. Failure to meet relevant SGI, grievance, removal, or other intermediary obligations can increase the risk of losing safe harbor for the affected activity.
The 2026 amendments are one part of a broader Indian AI governance system. The IT Rules address intermediary duties and synthetic-media harms. The Digital Personal Data Protection framework governs personal data. The IndiaAI Mission supports AI infrastructure, research, skills, and safety. Bodies such as the AI Governance and Economic Group, Technology and Policy Expert Committee, and IndiaAI Safety Institute support wider policy coordination, technical assessment, and future AI governance development.