India’s March 2026 AI Rules: The 3-Hour Takedown & Safe Harbour Guide

India’s AI Rules 2026: What the IT Rules Amendment Changes

India’s AI rules for 2026 sit inside the IT Rules Amendment 2026, which regulates synthetically generated information (SGI), the legal term for realistic AI-generated audio and video. Unlawful content must now come down within three hours, where the old limit was 36. Permitted SGI must carry a visible label and embedded metadata, and a platform that fails these duties can lose its Section 79 safe harbour.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 came into force on February 20, 2026, after the Ministry of Electronics and Information Technology (MeitY) notified them on February 10, 2026, under G.S.R. 120(E). From that day, passive hosting stopped being a safe default for platforms.

For years, intermediaries ran on a reactive model: respond to complaints, remove what is flagged, move on. The 2026 rules end that model and require compliance to be wired into the product itself.

Whether you run a generative AI startup or a global social network, the rules reach you.

The change goes well past a cosmetic edit to the IT Rules, 2021. The Amendment Rules, published in the Gazette of India Extraordinary, create a new legal category, Synthetically Generated Information (SGI), and attach hard deadlines and liability triggers to it. The text leaves little room for interpretation.

The amendment also sits inside India’s Viksit Bharat 2047 ambition of becoming a developed nation by the centenary of independence, a picture in which AI is an amplifier and a risk surface at once. In remarks at the World Economic Forum in Davos in January 2026, Union Minister Ashwini Vaishnaw described India’s regulatory posture as “techno-legal”: law alone cannot govern deepfakes and impersonation, so technical safeguards must do part of the work.

The 2026 Amendment Rules state that philosophy most clearly so far, and AI governance in India is no longer advisory.

At A Glance: India’s AI Regulatory Framework 2026

The short version of the IT Rules Amendment 2026:

• Notified on February 10, 2026 under G.S.R. 120(E) and in force from February 20, 2026.
• Creates a legal category, Synthetically Generated Information (SGI): realistic AI-generated audio, visual or audio-visual content that passes for a real person or event. Pure text sits largely outside it.
• Unlawful content must come down in three hours (down from 36) after a court order or an authorised officer’s intimation. Complaints on nudity, sexual acts, morphed content and impersonation get two hours (down from 24).
• Permitted SGI needs a visible label (a prefixed disclosure for audio) and embedded metadata, and intermediaries cannot let either be stripped.
• SSMIs, platforms with more than 5 million registered users in India, must take a user declaration at upload and verify it with automated tools.
• Missing the deadline, or knowingly allowing harmful SGI, can cost an intermediary its Section 79 safe harbour.
• A Draft Second Amendment (March 30, revised April 21) would make the SGI label continuous. It is still a consultation draft as of AZB’s September 8 tracker.

What Is Synthetically Generated Information (SGI) Under India’s 2026 AI Rules?

Synthetically Generated Information sits at the centre of the 2026 Amendment Rules. Every takedown clock and labelling duty, and most of the compliance burden, flows from this one definition.

According to the updated IT Rules text published by MeitY, SGI (defined in Rule 2(1)(wa)) means: “audio, visual or audio-visual information which is artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that such information appears to be real, authentic or true and depicts or portrays any individual or event in a manner that is, or is likely to be perceived as indistinguishable from a natural person or real-world event.”

The definition is narrow on purpose. Deepfake videos and voice clones that mimic a CEO’s cadence or a politician’s tone fall inside it. So do AI-generated photographs that put real people in situations they never faced.

It covers audio, visual and audio-visual content. Pure text sits largely outside it, at least today. Text becomes a problem only when it forms part of an unlawful act, such as a script paired with a deceptive synthetic video. Language model output is not SGI by itself, so companies developing chatbots and writing tools have room to operate, though no permanent immunity.

Also Read: Viksit Bharat G RAM G Act 2025 Explained: Why MGNREGA Was Repealed and What the 125-Day Rural Job Guarantee Means

What Does Not Count as SGI? Good-Faith Exclusions

The drafters saw the risk of overreach. Not every digital edit deceives, and an algorithmic touch-up is not automatically a threat, so the Rules carve out practical exclusions.

The exclusions cover routine editing and technical corrections such as colour correction, noise reduction, compression, formatting changes and transcription. They hold as long as the edit does not materially alter the substance, context or meaning of the content.

A news photographer adjusting white balance is not creating synthetic media, and a podcast editor removing background hiss has not crossed a regulatory line. Without these carve-outs, the whole creative economy would sit under regulatory threat.

Good-faith creation of documents, presentations, PDFs, training material and academic outputs is also excluded, even when the content is illustrative or hypothetical. The condition is that the work must not produce a false document or a false electronic record.

The law has no quarrel with simulation in a teaching or drafting setting. Its target is deception dressed up as authenticity.

Accessibility tools get their own exclusion. Tools that make content clearer, or easier to translate, describe, search or discover, stay outside the SGI net so long as they do not materially manipulate the underlying audio-visual content. Auto-captioning and audio description are enhancements, not impersonations.

Text-to-speech is a closer call. MeitY’s FAQ treats a realistic synthetic voice announcement as permitted SGI that needs a prefixed audio disclosure.

For business, the signal is plain. The law goes after deception that convincingly passes for reality and leaves innovation and creative work alone. Compliance plans across the sector will be drawn along that line between enhancement and impersonation.

Also Read: India’s Welfare State Reforms: From Constitutional Commitment to Digital Governance and Rural Employment Overhaul

The 3-Hour Takedown Rule Under India’s 2026 AI Rules

The three-hour clock is the most visible change in the 2026 rules. The amended Rule 3(1)(d) now requires intermediaries to remove or disable access to unlawful information, including unlawful SGI, within three hours of receiving actual knowledge through a court order or a reasoned written intimation from an authorised government officer.

The 2021 rules gave intermediaries 36 hours to act. That was tight but workable. The 2026 amendment cuts the window by about 91.7%.

MeitY’s FAQ puts the complaint clock for nudity, sexual acts, morphed content and impersonation at two hours, down from 24, the same 91.7% cut. Other timelines moved less. General grievance disposal went from 15 days to seven, and the expedited removal grievance clock from 72 hours to 36.

This is no policy tweak, because it resets what operations teams are expected to do. An order may arrive in Hindi, Tamil, Telugu, Bengali or a mix of them, at 2:17 a.m. on a Sunday, about content already reshared thousands of times across mirrored accounts.

India has a single time zone, so a team abroad gets no chance to catch up in the morning. A three-hour clock in that setting demands near-real-time legal triage.

Global platforms with Trust & Safety teams in San Francisco or Dublin cannot route everything through a distant compliance desk and hope for the best. In practice the amendment calls for localised 24/7 compliance cells, language expertise, escalation paths that hold under pressure and automated detection that pre-flags high-risk SGI before an order arrives.

Redundancy matters too: if human review falters, the systems must hold, and if the systems misfire, people must catch it.

Two-Hour Deadline for NCII and Impersonation Complaints (Rule 3(2)(b))

Rule 3(2)(b) gives intermediaries just two hours to remove or disable access once the affected person, or someone acting for them, files a complaint. The rule covers nudity, sexual acts, morphed content and impersonation, including Non-Consensual Intimate Imagery (NCII), and it is not limited to synthetic media.

The earlier window was 24 hours. The cut puts dignity and harm prevention ahead of procedural comfort. Deepfake pornography and sexually manipulative synthetic media have done severe personal damage in recent years, and the rule-makers appear unwilling to let procedural lag add to it.

Platforms need workflows that sort urgency instantly. An NCII complaint cannot sit in the same queue as a routine defamation notice, so triage has to be smart and fast.

Response time is now a legal risk variable. Every minute between notice and action carries exposure, which makes compliance a core operating function.

Smaller intermediaries may find this the hardest part of the 2026 rules. Larger ones will need to spend on new systems and staffing. Either way, leisurely review cycles are over.

SGI Labelling and Metadata Rules Under the 2026 IT Rules

Taking content down is half the story. The 2026 rules also govern what stays up.

Two duties sit side by side. Under Rule 3(3)(a)(i), an intermediary that offers a resource for creating or sharing SGI must use reasonable technical measures to stop users from producing child sexual abuse material, non-consensual intimate imagery, false documents or records, content on explosives or arms, and deceptive depictions of real people or events (MeitY FAQ). Labelling under Rule 3(3)(a)(ii) applies to the permitted SGI that remains.

Permitted SGI that stays on a platform must carry a clear label, never one tucked into a dropdown. Visual content needs a visible disclosure such as “Synthetically Generated” or an equivalent, placed where an ordinary user cannot reasonably miss it. Audio needs more: an audible disclosure, a spoken acknowledgement that the voice or recording was artificially generated or substantially altered.

The label tries to interrupt the moment of deception. Once viewers know they are watching synthetic media, the persuasive force changes. Not always, but often enough to matter.

Metadata and Anti-Tampering Duties for Digital Provenance

A label is only the surface layer. Beneath it, the rules add what amounts to a digital chain of custody for AI-generated content. Intermediaries under the labelling duty must embed permanent metadata and a unique identifier in the file, to the extent technically feasible. These markers record where the content came from and which tool made it.

The identifiers have to persist. Rule 3(3)(b) bars intermediaries from allowing anyone to modify, suppress or remove the label or the embedded identifiers, because provenance is useless if it disappears at export.

That ban reaches product design. A “clean export” button that quietly strips metadata is potentially non-compliant. So is a third-party API integration that lets users bypass provenance tagging.

The duty reaches well beyond social media. Cloud-based creative suites, video editors, AI image generators and voice cloning services all sit in the synthetic content pipeline, and each should check whether its product design lets metadata be stripped.

A watermark overlay alone does not satisfy the rules, which expect layers: a visible disclosure, provenance embedded in the file, and controls that stop anyone tampering with either. Drop one layer and the system weakens. Drop two and the exposure is serious.

India’s approach treats authenticity in the AI age as a technical property, engineered into systems and carried inside the file itself.

Extra SGI Duties for SSMIs: Social Media Platforms Above 5 Million Users

Scale changes the obligations. Significant Social Media Intermediaries (SSMIs), meaning platforms with more than 5 million registered users in India, already faced closer scrutiny under the 2021 Rules. The 2026 amendment adds SGI-specific duties that raise their compliance load.

The logic is straightforward: the larger the audience, the greater the harm if synthetic content spreads unchecked.

User Declarations and Independent Detection Duties for SSMIs

Rule 4(1A) adds a user declaration at upload. Before publishing content that includes or may include synthetic material, the user must declare whether it does, through a disclosure interface the platform provides.

That declaration carries legal weight, and platforms cannot hide behind it. SSMIs also carry an independent verification duty. They must deploy automated tools and technical detection systems to cross-check user declarations against the content itself.

Pairing declaration with detection closes a loophole. A dishonest user cannot click “No AI used” and push liability upstream. Platforms must apply “reasonable and appropriate technical measures” to judge for themselves whether content is synthetic.

That phrase leaves room for technology to change, and it warns that token compliance will fail.

In practice, expect some mix of the following:

• Integration of deepfake detection models
• Provenance verification APIs
• Automated anomaly detection systems
• Risk-scoring pipelines that flag high-probability synthetic content

Global platforms may need to buy detection from specialist vendors. Homegrown startups may have to develop their own. Either way, detection is now a cost of operating at scale in India.

Platforms used to argue, with some plausibility, that users had misled them. That defence narrows under the 2026 rules. Being deceived by your own users no longer shields a platform that failed to deploy adequate detection.

Platforms sitting just under the 5 million user line should read this section twice. Growth now brings regulatory acceleration, and crossing the threshold triggers a new set of duties.

Loss of Safe Harbour Under Section 79: What Intermediaries Risk

For years, Section 79 of the IT Act, 2000 worked as a legal shield for intermediaries. A platform that did not initiate or modify user content, and acted expeditiously once notified of unlawful material, was spared direct liability. Safe harbour underpinned India’s platform economy.

The 2026 rules tighten the conditions attached to it. Under the amended rules, intermediaries lose Section 79 protection if they fail to comply with the 3-hour takedown mandate after receiving a valid court order or government intimation. They also risk forfeiting that immunity if they knowingly promote, host or allow the continued circulation of harmful SGI after becoming aware of it.

“Becoming aware” carries heavy legal weight. For the three-hour clock, actual knowledge comes only from a court order or a reasoned written intimation from an authorised officer. The test for SSMIs under Rule 4(1A) is wider: did the platform knowingly permit, promote or fail to act on non-compliant SGI? A user grievance, a third-party notice or a flag from the platform’s own detection tools could all be read as knowledge there.

For the gravest categories of synthetic harm, the standard now sits close to strict liability. A platform that deliberately avoids knowing what its own systems surface should not expect that avoidance to protect it.

The harms the rules have in mind are concrete: deepfake-driven identity impersonation, non-consensual intimate imagery, AI-generated child sexual abuse material (explicitly linked to the POCSO Act, 2012) and electoral manipulation through synthetic media. The rule-makers treat these as foreseeable risks of AI systems, not edge cases.

The Rules also remove one worry platforms had. MeitY’s FAQ states that removing or disabling information, SGI included, in line with the Rules does not breach the conditions in Section 79(2)(a) or 79(2)(b), and that holds when the removal runs through reasonable technical measures such as automated tools. Proactive moderation of this kind does not, by itself, cost a platform its immunity.

SSMIs face a sharper test. Under Rule 4(1A), one that knowingly permits, promotes or fails to act on SGI in breach of the Rules is treated as having failed due diligence.

One more provision may quietly change what victims can do. Under Rule 3(1)(cb), as MeitY’s FAQ explains it, where applicable law requires it and due process is followed, a platform may have to hand information identifying a user who created or spread unlawful SGI to the complainant or a competent authority. Read with the Bharatiya Nyaya Sanhita, 2023, and the Indecent Representation of Women (Prohibition) Act, 1986, this gives survivors of deepfake-based harassment a more direct route to legal recourse.

For many victims, anonymity has been the most frustrating part of digital harm. The amendment narrows it, but only in defined circumstances.

For platforms the stakes climb. One that misses the takedown timeline or ignores credible knowledge, and leaves blind spots in its own systems, risks a fine and, worse, the collapse of its safe harbour. Once that protection falls away, civil or even criminal exposure under several statutes becomes possible.

Compliance now protects the legal basis that lets platforms run at scale without assuming liability for all user speech. Safe harbour is conditional, and the conditions have tightened.

India’s Techno-Legal AI Governance: How It Differs From the EU, US and China

India’s 2026 AI regulatory posture is a deliberate position in the global AI governance debate. It was not a knee-jerk reaction to deepfakes.

India’s approach sits between laissez-faire and heavy prescription. Call it pragmatic and techno-legal.

The European Union’s AI Act sorts AI systems by risk category, with detailed and compliance-heavy obligations. Critics say it mirrors EU regulatory culture more than the needs of emerging economies trying to scale quickly.

The United States has leaned toward federal pre-emption and national uniformity. The aim is to reduce state-level fragmentation and smooth the path for industry expansion.

China, through amendments to its cybersecurity framework, keeps stressing centralised oversight and state supervisory authority.

India diverges from all three. Its model is principle-based yet enforceable: it talks about growth and inclusion but attaches hard deadlines, and it avoids blanket bans in favour of surgical liabilities.

That balance was on display at the India AI Impact Summit 2026 in New Delhi, the first global AI summit hosted in the Global South.

The summit was organised around seven Chakras, or thematic working groups: Human Capital, Inclusion, Safe and Trusted AI, Science, Resilience and Innovation, Democratising AI Resources, and AI for Economic Development. Three Sutras sit underneath them: People, Planet and Progress.

Those principles filter into the 2026 Amendment Rules. The SGI definition protects people from synthetic impersonation and reputational harm, and the good-faith exclusions protect accessibility and education. The SSMI duties demand accountability at scale without freezing innovation.

Capacity matters too. At Davos, Vaishnaw pointed to the operationalisation of a common national compute facility under the IndiaAI Mission, with more than 38,000 GPUs available through a public-private partnership at roughly one-third of global cost.

Regulation without capacity feels punitive. Pair it with sovereign compute, AIKosh datasets, multilingual initiatives like BHASHINI and the IndiaAI Safety Institute, and it starts to look strategic.

The thesis is simple: governance and innovation can run in parallel, because law shapes incentives while public compute lowers barriers.

Elsewhere, Australia’s National AI Plan and the European Data Protection Supervisor’s AI risk guidance offer useful templates for handling systemic risk. India’s distinguishing move is speed. It turned principles into enforceable obligations while the deepfake threat curve is still rising.

Whether other Global South economies will copy the model remains open. India is not importing regulatory philosophy wholesale. It is writing its own.

What Comes Next: Draft Second Amendment Rules and a Possible AI Law

The 2026 Amendment Rules are not the last word. MeitY’s Draft Second Amendment Rules, 2026, released on March 30 and revised on April 21, would make the SGI label a marker that stays clearly visible for the full duration of the content. They would also fold compliance with MeitY advisories and directions into the due diligence that safe harbour depends on.

Comments closed on May 7. AZB’s regulatory tracker dated September 8, 2026 still lists the draft as under public consultation, with no final notification reported.

The Digital India Act, long billed as the successor to the IT Act, has sat in draft since 2023. Separately, the Indian Express reported on July 22 that MeitY is weighing a standalone AI law outside the IT Act, 2000, with a consent-based approach to synthetic content and limits on the autonomy of agentic AI systems. No draft bill has been released with that report.

Agentic AI is where the harder questions live. If an autonomous AI agent creates and posts content on its own, who is the intermediary? Who holds “actual knowledge” in a fully automated pipeline? Is awareness tied to the system or to the people who run it?

The 2026 rules do not answer these questions. They do set a direction: proactive prevention and technical accountability, with explicit remedies for victims. Expect those principles to carry into whatever comes next.

AI Compliance Checklist for Businesses Under India’s 2026 SGI Rules

Any business that mixes AI with user-generated content in India has no room to wait and watch. The obligations are already live.

Map Your SGI Exposure

Conduct an AI risk assessment. Map every product feature and content pipeline that touches audio-visual data, API endpoints included. If a feature can algorithmically generate or modify a human likeness or voice, assume it may fall inside the SGI definition under the 2026 Rules. Scoping broadly and narrowing later is safer than the reverse.

Rewrite Your Grievance Redressal SOPs

The 3-hour window is mandatory, not aspirational. That means reworking workflows for sub-3-hour response: 24/7 staffing or automation, and multilingual intake with escalation trees that function without bureaucratic delay.

A compliance model that still runs on next-business-day review cycles is already out of step with the rules.

Put Provenance Controls in Place

Metadata management and anti-tampering controls are compliance prerequisites now, as are the labelling interfaces that sit on top of them. None of it is a “nice-to-have” transparency feature. Compliant systems should cost less than litigating the loss of safe harbour.

Check Your SSMI Status

Review your SSMI status. If your platform is approaching the 5 million registered user threshold in India, treat that milestone as regulatory acceleration.

User declaration workflows and automated SGI detection systems are mandatory for SSMIs under the amended IT Rules. They are legal obligations, not roadmap items.

Turn Early Compliance Into an Edge

India has placed a deliberate bet that a synthetic media regime that is enforceable and technically grounded will earn long-term trust in its AI sector. Businesses that adapt early can turn compliance into an advantage with users and regulators.

For those who delay, the margin for error has narrowed. The timelines do not bend, and the legal shield that once felt stable now has cracks.

FAQs: India’s AI Regulatory Framework 2026

Disclaimer

The content provided on this page is designed as an educational explainer to help simplify complex topics and is for general informational purposes only. While we make every effort to ensure the accuracy, completeness, and reliability of the information presented at the time of publication, facts and circumstances can change. The information provided here is on an “as is” basis and does not constitute professional, technical, or legal advice. This explainer should be used as a foundational guide for understanding the topic, and readers are encouraged to conduct their own independent research or consult with relevant professionals before taking any action based on this content.