IT Rules amendments on synthetically generated information

What it is

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, usually called the IT Rules, set the due diligence that intermediaries must observe in India to keep the safe harbour in section 79 of the Information Technology Act 2000. On 10 February 2026, MeitY amended them by notification G.S.R. 120(E) to address harms from synthetically generated information, including deepfakes. The amendments followed a draft published in October 2025 and came into force on 20 February 2026.

They are the first binding Indian rules written specifically for AI-generated content. MeitY’s India AI Governance Guidelines rely on existing law such as the IT Rules rather than a new AI statute, and this amendment is that approach in practice.

Who it applies to

The duties apply to intermediaries, the platforms and services that host, transmit or provide access to third-party information. Two groups carry the AI-specific duties.

• Intermediaries that offer synthetic content tools. Any intermediary whose computer resource may enable, permit or facilitate the creation, modification, publication or sharing of synthetically generated information falls under rule 3(3) and the extra user notice in rule 3(1)(ca).
• Significant social media intermediaries. Social media intermediaries with 50 lakh (five million) or more registered users in India carry the declaration and verification duties in rule 4(1A).

Rule 2(1A) also makes every reference to information used to commit an unlawful act include synthetically generated information, so the general takedown and grievance duties reach AI-generated content too.

An organisation that uses AI internally, or builds AI into a product without offering users the ability to create or share realistic synthetic media, is not caught by rule 3(3) for that use. It still sits under the IT Act, the Bharatiya Nyaya Sanhita 2023 and the DPDP Act for what its AI does.

What it requires

For intermediaries offering synthetic content tools, rule 3(3) has two parts.

• Block unlawful synthetic content. Deploy reasonable and appropriate technical measures, including automated tools, so users cannot create or share synthetic content that breaks the law. The rule names child sexual abuse material, non-consensual intimate imagery, false documents or electronic records, content about making explosives or weapons, and content that falsely depicts a real person or event in a way likely to deceive.
• Label and mark the rest. Every other piece of synthetic content must be prominently labelled, visibly on screen or through a prefixed audio disclosure, and embedded with permanent metadata or another technical provenance mechanism, to the extent technically feasible, including a unique identifier for the tool that made it. The intermediary must not let anyone modify, suppress or remove the label or metadata.

Under rule 3(1)(ca), such intermediaries must also tell users that misusing the tool can attract penalties under the IT Act, the Bharatiya Nyaya Sanhita and other named laws, and can lead to removal of the content, suspension of the account and, where the law allows, disclosure of the user’s identity to the complainant. Rule 3(1)(c) now requires intermediaries to remind users of the consequences of non-compliance at least once every three months.

Significant social media intermediaries must, under rule 4(1A), get a user declaration on whether content is synthetic before it goes up, verify it with technical measures suited to the content’s nature, format and source, and label confirmed synthetic content.

The amendment tightened timelines. Removal after a court order or reasoned government intimation fell from 36 hours to three. Action on complaints about intimate imagery and impersonation fell from 24 hours to two, and general grievances must now be resolved in seven days rather than 15. New rule 2(1B) confirms that removing content in good faith under the rules, including with automated tools, does not cost an intermediary its safe harbour.

Key dates

• 22 October 2025. MeitY publishes draft amendments on synthetically generated information for consultation.
• 10 February 2026. The amendment rules are notified as G.S.R. 120(E).
• 20 February 2026. The amendments come into force.
• 30 March 2026. MeitY publishes further draft amendments for consultation. A notice of 21 April 2026 adds a proposal that labels on visual synthetic content stay continuously visible for the whole duration, and extends comments to 7 May 2026.

Check MeitY and the Gazette of India for whether the further draft has been notified.

How it relates to other frameworks

The IT Rules sit beside India’s other AI-relevant rules rather than replacing them. The India AI Governance Guidelines are voluntary and point to the IT Rules for content harms. The DPDP Act and Rules govern the personal data in a deepfake or a voice clone, and the RBI FREE-AI framework covers AI in regulated finance.

Internationally, the closest comparisons are Article 50 of the EU AI Act, which requires providers to mark AI-generated content in a machine-readable way and deployers to disclose deepfakes, and China’s labelling measures covered under China’s AI rules. India’s regime is distinctive in placing the duty on intermediaries, in requiring the label to be visible as well as machine-readable, and in pairing it with very short takedown windows.

For an organisation offering generative features, the practical work is a register of which systems generate realistic audio, images or video, an enforced rule set that blocks prohibited requests, a labelling and provenance method that survives download and re-upload, and a takedown process that can meet three hours.

A note on this page

This is Aicura’s reading of the amended IT Rules, written to help you understand them. It is not legal advice and it is not the Rules themselves. Read the consolidated Rules and the Gazette notification published by MeitY, and take advice on how they apply to your organisation.