Summary
- MeitY amended the IT Rules, 2021 through G.S.R. 120(E), notified on 10 Feb 2026 and in force from 20 Feb 2026. The legal basis is Section 87(1) and 87(2)(z) and (zg) of the IT Act, 2000.
- It defines "synthetically generated information" (SGI) in Rule 2(1)(wa): audio, image or video that is made or altered by a computer so that it looks real and could pass for a real person or real event. Routine edits, normal document or slide preparation, and accessibility aids (captions, translation) are carved out.
- Text alone is not SGI. MeitY's FAQ (Q8) confirms a chatbot-written article is outside the SGI definition, although the general unlawful-content duties still apply to it.
- Any intermediary whose tool can create or spread SGI must (new Rule 3(3)): use technical measures to stop unlawful SGI, put a prominent visible label (or a spoken prefix for audio) on lawful SGI, embed permanent metadata with a unique identifier where technically feasible, and never let users strip either.
- Significant social media intermediaries (SSMIs) must also ask uploaders to declare whether content is SGI, verify that declaration with technical tools, and label confirmed SGI (new Rule 4(1A)).
- Timelines got much tighter: 3 hours to act on a court order or authorised government intimation (was 36 hours), 2 hours for intimate imagery and impersonation complaints (was 24), 36 hours for other removal complaints (was 72), and 7 days to resolve grievances (was 15).
Who it applies to
- All intermediaries for the faster timelines, quarterly user notices and the general rule that "information" includes SGI (Rules 2(1A), 3(1), 3(2)).
- Intermediaries offering a tool that can create, alter, publish or share SGI for Rule 3(1)(ca) and Rule 3(3). MeitY's FAQ (Q20) names AI image and video generators, voice cloning tools and platforms that spread such media.
- SSMIs for Rule 4(1A) and the hardened Rule 4(4). SSMI means a social media intermediary with registered users in India above the notified threshold (Rule 2(1)(v)); a PIB release of 6 Aug 2026 gives that threshold as 50 lakh (5 million) users.
- Foreign companies: the Rules do not contain an express extraterritorial clause, but they are written around users in India (for example the SSMI threshold counts registered users in India), and MeitY applies them to global platforms serving Indian users. Treat yourself as covered if Indians use your service.
- Open question: whether a pure AI model provider is an "intermediary" under the IT Act is debated. MeitY's FAQ assumes AI generation tools are covered, so plan on that basis.
Key dates
- MeitY publishes draft SGI amendments and explanatory note for consultation (comments due 2025-11-06)
- Separate amendment G.S.R. 775(E) notified, rewriting Rule 3(1)(d) on who may issue takedown intimations (in force 2025-11-15)
- Final amendment notified in the Gazette as G.S.R. 120(E); MeitY publishes FAQs
- Amendment comes into force
- Corrigendum G.S.R. 148(E) corrects a statute reference (BNS read with BNSS)
- MeitY publishes draft Second Amendment Rules, 2026 for consultation (advisories made binding via new Rule 3(4))
- MeitY adds a proposed change to Rule 3(3)(a)(ii): label to stay visible for the whole duration of visual content; comments due 2026-05-07
Full date record
| Date | Event |
|---|---|
| 2023-11-07 to 2024-03-15 | MeitY deepfake and AI advisories precede the rules (see MeitY AI and Deepfake Advisories) |
| 2025-10-22 | Draft SGI amendment published for comment (draft proposed a label covering at least 10% of the screen or first 10% of audio) |
| 2025-10-22 | G.S.R. 775(E) rewrites Rule 3(1)(d) (senior officer intimations), in force 2025-11-15 |
| 2025-11-06 | Comment deadline on the SGI draft |
| 2026-02-10 | G.S.R. 120(E) notified; MeitY FAQs released |
| 2026-02-20 | Amendment in force |
| 2026-02-26 | Corrigendum G.S.R. 148(E) |
| 2026-03-30 | Draft Second Amendment Rules, 2026 published (Rule 3(4): obey MeitY advisories as part of due diligence) |
| 2026-04-21 | Further proposal: continuous label for full duration of visual SGI; comments due 2026-05-07 |
| 2026-10-19 | No notified Second Amendment found on MeitY or the Gazette at time of checking |
Penalties and enforcement
- Rule 7: failure to observe the Rules removes the Section 79(1) safe harbour and exposes the intermediary to punishment under any law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023.
- Rule 4(1A) proviso: an SSMI that knowingly permits, promotes or fails to act on SGI in breach of the Rules is deemed to have failed due diligence.
- Rule 2(1B): removing content (including by automated tools) in compliance with the Rules does not by itself cost safe harbour. This protects good-faith takedowns.
- Users who misuse SGI tools face penalties under the IT Act, BNS, POCSO, the Representation of the People Act and other listed laws (Rule 3(1)(ca)(i)).
- Enforcement is through takedown orders from courts or authorised officers (Joint Secretary level, or DIG level for police, under Rule 3(1)(d)), the Grievance Appellate Committees, and prosecution. No fine schedule is set in the Rules themselves.
What it means for an Indian company
- If you run a GenAI image, video or voice feature for users: you are almost certainly in Rule 3(3). Build visible labels, embedded provenance (for example C2PA style metadata with a unique ID) and block lists for the prohibited categories before launch.
- If you run a community, marketplace or social feature: the 3 hour and 2 hour clocks mean you need a staffed, 24x7 takedown path. A weekday-only trust and safety team will miss deadlines.
- If you only use GenAI internally (drafting, analytics) and publish nothing to users, these SGI duties largely do not bite, but your vendor may be covered.
- If you are an SSMI (over 50 lakh registered Indian users): add an upload-time "is this AI-generated?" declaration, a detector to check it, and labels on confirmed SGI.
- Update terms of service and send a user notice at least every three months (Rule 3(1)(c)), plus SGI-specific warnings if you offer generation tools (Rule 3(1)(ca)).
Obligations
Showing 17 of 17
| ID | Obligation | Reference | Applies to | Controls |
|---|---|---|---|---|
| ITR2026-01 | Work out which features create or spread SGI, using the definition and its three exclusions, and treat SGI as "information" for all unlawful-content duties. | Rule 2(1)(ca), 2(1)(wa), 2(1A) | Both | |
| ITR2026-02 | Tell users at least once every three months, in English or an Eighth Schedule language, that breaches can lead to removal or account suspension, legal liability, and reporting of offences. | Rule 3(1)(c) | Both | |
| ITR2026-03 | If you offer an SGI tool, also warn users that misusing it can attract penalties under named laws and may lead to removal, account suspension, identity disclosure to a victim, and reporting. | Rule 3(1)(ca) | Both | |
| ITR2026-04 | When you learn of an SGI violation (on your own or via complaint), act quickly: remove content, suspend the account without destroying evidence, and take the other listed steps. | Rule 3(1)(cb) read with 3(1)(ca)(ii) | Both | |
| ITR2026-05 | Report offences that the law requires to be reported (for example under BNSS or POCSO) to the appropriate authority. | Rule 3(1)(c)(iii), 3(1)(ca)(ii)(IV) | Both | |
| ITR2026-06 | Remove or disable access to unlawful content within 3 hours of a court order or a written, reasoned intimation from an authorised officer. | Rule 3(1)(d) | Both | |
| ITR2026-07 | Acknowledge grievances within 24 hours and resolve them within 7 days. | Rule 3(2)(a)(i) | Both | |
| ITR2026-08 | Resolve complaints asking for removal of Rule 3(1)(b) content within 36 hours (some sub-clauses excepted). | Rule 3(2)(a)(i), first proviso | Both | |
| ITR2026-09 | Remove content showing a person's private areas, nudity, sexual acts or impersonation (including morphed images) within 2 hours of a complaint by or for that person. | Rule 3(2)(b) | Both | |
| ITR2026-10 | Deploy technical measures so users cannot create or share unlawful SGI, especially CSAM, intimate imagery without consent, false documents or records, explosives or arms content, and deceptive depictions of real people or events. | Rule 3(3)(a)(i) | Both | |
| ITR2026-11 | Label all other (lawful) SGI prominently on screen, or with a spoken prefix for audio, so viewers know at once it is synthetic. | Rule 3(3)(a)(ii) | Both | |
| ITR2026-12 | Embed permanent metadata or another provenance mechanism, including a unique identifier, that identifies your computer resource as the source, to the extent technically feasible. | Rule 3(3)(a)(ii) | Both | |
| ITR2026-13 | Do not let anyone modify, hide or remove the label, metadata or unique identifier (no "remove watermark" or "export without metadata" option). | Rule 3(3)(b) | Both | |
| ITR2026-14 | SSMIs: before content goes live, ask the uploader to declare whether it is SGI. | Rule 4(1A)(a) | Deployer | |
| ITR2026-15 | SSMIs: use proportionate technical tools to check whether the declaration is accurate, considering the content's nature, format and source. | Rule 4(1A)(b) and Explanation | Deployer | |
| ITR2026-16 | SSMIs: where declaration or detection confirms SGI, show a clear label or notice before publication; never publish SGI without declaration or label. | Rule 4(1A)(c) and Explanation | Deployer | |
| ITR2026-17 | SSMIs: deploy (no longer just "endeavour" to deploy) technical measures to proactively find rape or child abuse depictions and re-uploads of removed content, with human oversight and periodic review of automated tools for accuracy, fairness, bias and privacy impact. | Rule 4(4) and provisos | Deployer |
Controls that do the most work here
- SC-AI-023 Label AI-generated and synthetic content5 obligations
- SC-AI-035 Takedown and response timelines4 obligations
- SC-AI-036 Deepfake and impersonation safeguards4 obligations
- SC-AI-034 Unlawful and prohibited content safeguards3 obligations
- SC-AI-025 Public AI transparency statement and notices2 obligations
- SC-AI-028 Customer grievance redressal for AI2 obligations
Evidence an auditor will ask for
- An inventory of every feature that can generate, edit or distribute audio, image or video, with an SGI yes or no decision and the exclusion relied on.
- Screenshots and specs of on-screen labels and audio prefixes, per format (image, video, audio, live).
- Provenance design: metadata standard used, unique identifier scheme, and test results showing the identifier survives download, re-encode and re-upload.
- Proof there is no feature to remove labels or metadata (product spec, release notes, abuse tests).
- Safety classifier and block list documentation for each Rule 3(3)(a)(i) category, with red team results.
- Terms of service, onboarding warnings, and logs proving user notices go out at least every three months.
- Takedown and grievance tickets with timestamps (received, acknowledged, actioned) showing the 3 hour, 2 hour, 36 hour and 7 day clocks were met.
- A procedure to check that a government intimation comes from an authorised officer of the right rank.
- Evidence preservation records for suspended accounts, and records of mandatory offence reports.
- For SSMIs: the upload declaration flow, detector validation reports, and the periodic review of automated tools required by Rule 4(4).
Common mistakes
- Treating every AI-touched file as SGI. Colour correction, noise reduction, captions and template slides are expressly excluded.
- The opposite mistake: assuming chatbot text is unregulated. It is outside SGI, but Rule 3(1)(b) unlawful content duties still apply.
- Relying only on invisible metadata. The Rules require both a visible (or audible) label and embedded provenance.
- Relying only on user self-declaration. SSMIs must verify with technical tools.
- Running a business-hours takedown team. Three hours from receipt means nights and weekends too.
- Still sending the annual user reminder. It is now quarterly.
- Suspending abusive accounts in a way that wipes logs. The Rules say suspension must not vitiate evidence.
- Quoting the October 2025 draft's "10% of screen" label rule. The final text dropped the fixed percentage in favour of "prominent visibility".
Glossary
- Intermediary: a service that stores or transmits content on behalf of others, such as a social network, marketplace or hosting service.
- SSMI (significant social media intermediary): a social media service with more registered Indian users than the government threshold (50 lakh per PIB).
- SGI (synthetically generated information): realistic audio, image or video made or altered by a computer that could pass for a real person or event.
- Safe harbour (Section 79): the legal protection that stops a platform being liable for user content, provided it follows the due diligence rules.
- Provenance metadata: hidden data inside a file that records where and how it was made.
- Actual knowledge: the trigger for the 3 hour clock, which arises only from a court order or a reasoned written intimation from an authorised officer.
- NCII: non-consensual intimate imagery, including AI-made "morphed" nudes.
- BNS / BNSS: Bharatiya Nyaya Sanhita (the new penal code) and Bharatiya Nagarik Suraksha Sanhita (the new criminal procedure code).
Key takeaways
- Binding since 20 Feb 2026: India now legally requires visible labels plus tamper-proof provenance on lawful synthetic audio, images and video.
- Unlawful SGI (CSAM, NCII, forged documents, weapons content, deceptive deepfakes of real people or events) must be blocked by technical measures, not just removed on complaint.
- SSMIs carry an extra upload-time declare, verify and label duty.
- Takedown clocks are now 3 hours (orders), 2 hours (intimate imagery and impersonation), 36 hours (other removal complaints) and 7 days (grievances).
- Text-only AI output is outside SGI, but general unlawful-content duties still apply.
- Watch the draft Second Amendment: if notified, it would make MeitY advisories part of binding due diligence.
Official sources
- Gazette of India, G.S.R. 120(E), 10 Feb 2026 (bilingual), accessed 2026-10-19
- MeitY FAQs on the Amendment Rules, 2026, accessed 2026-10-19 (MeitY notes the FAQ is not a legal document)
- Consolidated IT Rules, 2021 as amended, MeitY (Feb 2026), accessed 2026-10-19
- Consolidated IT Rules showing corrigendum G.S.R. 148(E), MeitY (Mar 2026), accessed 2026-10-19
- MeitY notice inviting comments on draft SGI amendments, 22 Oct 2025, accessed 2026-10-19
- MeitY explanatory note on the draft SGI amendments, 22 Oct 2025, accessed 2026-10-19
- MeitY notice on draft Second Amendment Rules, 30 Mar 2026 and draft text, accessed 2026-10-19
- MeitY notice extending consultation and proposing continuous labels, 21 Apr 2026, accessed 2026-10-19
- PIB, "Government Strengthens Regulatory Framework to Address AI-Generated Deepfakes", 6 Aug 2026, accessed 2026-10-19
- PIB, Rajya Sabha reply on child online safety citing the 2026 amendment, 25 Mar 2026, accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.