What it means
- Stop your AI tools and platform from being used to create, host or spread unlawful content, such as:
- child sexual abuse material and non-consensual intimate imagery,
- false documents or records, content on explosives or arms,
- deceptive depictions of real people or events, election misinformation,
- other content prohibited under Rule 3(1)(b) of the IT Rules.
- Use layered defences: clear rules in terms of service, input and output filters, proactive detection, human moderation and periodic review.
- ISO 27001 reuse: None. New for AI, not covered by ISO 27001.
Why it matters
- The 2026 IT Rules require technical measures so users cannot create or share unlawful synthetic content, and require SSMIs to proactively detect child abuse depictions and re-uploads of removed content.
- MeitY advisories ask that AI tools on platforms do not enable unlawful content and do not threaten electoral integrity, and that AI platforms add filters, moderation and human oversight.
- Failure can mean loss of safe harbour under Section 79 of the IT Act and criminal exposure.
Checklist
- Map the prohibited content categories in Rule 3(1)(b) and the 2026 SGI categories to your content policy.
- Put the content policy in terms of service and show reminders at registration, login and upload (SC-AI-025 Public AI transparency statement and notices).
- Apply input filters (block prompts seeking prohibited content) and output filters (classify generated text, images, audio and video before release).
- Use hash matching and classifiers for known CSAM and re-uploads of removed content (SSMIs: mandatory).
- Add extra safeguards around elections: block or flag generation of candidate likenesses and voting misinformation (SC-AI-036 Deepfake and impersonation safeguards).
- Staff a human moderation queue for borderline cases, with culturally informed reviewers for Indian languages and religious content (SC-AI-026 Human oversight and override).
- Test filters with adversarial prompts and jailbreaks regularly (SC-AI-029 AI-specific security controls (prompt injection, model abuse), SC-AI-018 Robustness and adversarial testing (red teaming)).
- Review filter accuracy, false positives and bias periodically; record outcomes.
- Connect detection to takedown and reporting workflows (SC-AI-035 Takedown and response timelines, SC-AI-031 AI incident management and regulator reporting).
Evidence examples
- Content policy mapped to IT Rules categories.
- Filter and classifier configuration with blocked categories.
- Hash-matching integration records (SSMIs).
- Moderation queue metrics: volumes, decision times, reviewer languages.
- Adversarial filter test results and fixes.
- Periodic accuracy and bias review of automated moderation tools.
Common pitfalls
- English-only filters on a platform used in Hindi, Tamil or Bengali.
- Filters on text prompts but not on uploaded reference images.
- Relying entirely on the model vendor's safety layer without testing it.
- No re-upload detection, so removed content returns within hours.
Satisfies
- BindingEU AI Act
- BindingTexas TRAIGA
- SupervisoryMeitY AI and Deepfake Advisories
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- A.6.2.6 operation and monitoring
- A.9.2 processes for responsible use
- A.9.4 intended use
ISO/IEC 27001
No direct equivalent
SOC 2
No direct equivalent
Key takeaways
- Layer defences: rules, input filters, output filters, detection and human moderation.
- Indian platforms must cover regional languages and election content.
- Test filters adversarially and review them for accuracy and bias.