India’s 2026 Deepfake Regulations: Compliance Obligations for Digital Platforms and Businesses Under the IT Rules

Introduction

The rapid development of artificial intelligence (AI) has made it possible to generate realistic images, videos and audio recordings that may be difficult to distinguish from authentic content. While these technologies offer significant opportunities for businesses, entertainment, advertising and digital communication, their misuse has raised concerns about misinformation, impersonation, fraudulent representations and unlawful online content.

India’s regulatory approach to AI-generated content has evolved in response to these risks. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules), already established due diligence obligations for intermediaries operating in the digital ecosystem. However, the amendments notified by the Ministry of Electronics and Information Technology (MeitY) on 10 February 2026 introduced a more specific framework for addressing synthetically generated information, including deepfakes and other forms of realistic AI-generated media. The amendments came into effect on 20 February 2026.

The amendments are significant because they move beyond responding to unlawful content after publication and introduce more explicit obligations concerning the identification, labelling and prevention of certain forms of synthetic content. They also impose tighter timelines for action by intermediaries and strengthen the compliance framework applicable to platforms that enable the creation or dissemination of such material.

For digital platforms, AI service providers, businesses using generative AI and organisations distributing AI-generated content, the new framework raises important operational and legal questions. This article examines the key changes under the amended IT Rules, their implications for platform compliance and the measures businesses should consider when developing or deploying AI-generated content.

Understanding Synthetically Generated Information Under the IT Rules

A central feature of the 2026 amendments is the introduction of the concept of synthetically generated information (SGI) into the IT Rules framework.

SGI broadly covers audio, visual or audiovisual information created, generated, modified or altered artificially or algorithmically using a computer resource in a manner that appears real or authentic and depicts an individual or event in a way that is, or is likely to be perceived as, indistinguishable from a natural person or real-world event. This brings realistic AI-generated videos, manipulated images, voice cloning and comparable synthetic audiovisual material within the framework.

The definition is relevant because it focuses on the realistic appearance of the content and its potential to be perceived as authentic. Consequently, the legal assessment may depend not merely on whether AI was used, but also on the nature of the resulting material and the manner in which it represents individuals or events. At the same time, not every use of AI or digital editing necessarily falls within the definition. The amended framework recognises exclusions for certain routine or good-faith editing, document preparation and accessibility-related improvements, subject to the prescribed conditions.

For example, ordinary colour correction, compression, translation or improvements to audio clarity would not automatically constitute SGI where the relevant exclusion applies. By contrast, altering a recording to make it appear that a person made a statement they never made may raise substantially different legal and compliance concerns.

This distinction is important for businesses that routinely use AI tools for marketing, training, advertising, content production and customer communication. Organisations should assess the nature of the output and the applicable legal requirements rather than treating all AI-generated material as either automatically prohibited or automatically permissible.

Mandatory Labelling and Traceability of AI-Generated Content

One of the important changes introduced by the 2026 amendments concerns the identification of permissible synthetic content.

The amended framework requires covered intermediaries to ensure that permissible SGI is clearly and prominently labelled. It also provides for permanent metadata or provenance markers, including identifiers linked to the relevant computer resource, where required under the applicable provisions. Intermediaries must not permit these labels or markers to be removed or modified in contravention of the Rules. These requirements seek to make synthetic content more identifiable and reduce the possibility of audiences being misled into believing that fabricated material is genuine.

For businesses, the implications extend beyond social media platforms. Organisations using AI-generated advertisements, promotional videos, digital spokespersons or synthetic audiovisual material should review how such content is produced, labelled and distributed, taking into account the applicable obligations of the relevant parties.

A business commissioning an AI-generated video, for instance, should not assume that contractual arrangements with a content-production agency automatically resolve every compliance issue. The parties should identify who is responsible for labelling, maintaining relevant records, checking the accuracy of representations and ensuring that the content is distributed in accordance with applicable requirements.

Similarly, businesses should consider whether their existing content approval processes adequately distinguish between authentic recordings, materially altered content and synthetic representations. Labelling is not, by itself, a defence for otherwise unlawful content. A synthetic representation may still raise legal concerns where it violates applicable law, even if the audience is informed that AI was used to produce it.

Due Diligence Obligations for Intermediaries

The 2026 amendments strengthen the due diligence framework applicable to intermediaries under the IT Rules. In particular, intermediaries providing computer resources that enable or facilitate the creation or dissemination of SGI are required to implement reasonable and appropriate technical measures, including automated tools or other suitable mechanisms, to prevent users from creating or disseminating unlawful synthetic content.

The framework addresses categories of unlawful content that include child sexual exploitation material, non-consensual intimate imagery, certain obscene or sexually explicit content, false documents or electronic records, and deceptive synthetic depictions of individuals or real-world events, as specified in the Rules.

These obligations are relevant to the design and operation of digital services. Platforms and service providers may need to assess whether their existing systems, moderation procedures and escalation mechanisms are sufficient to meet the applicable requirements.

The compliance exercise may involve reviewing the following:

• Technical safeguards: Whether appropriate measures are in place to identify and prevent prohibited synthetic content.
• User policies: Whether terms of service and community guidelines clearly address unlawful AI-generated material and the consequences of misuse.
• Reporting mechanisms: Whether users can report potentially unlawful content through accessible and effective channels.
• Escalation procedures: Whether complaints and legally binding directions are routed to the appropriate teams without avoidable delay.
• Record-keeping: Whether relevant decisions, notices and actions are documented in a manner consistent with applicable legal requirements.

The precise measures required will depend on the nature of the service, the intermediary’s role, the relevant provisions of the IT Rules and the risks associated with the functionality offered. A uniform compliance model may not be appropriate for every platform or AI service provider.

Tighter Takedown Timelines and Grievance Redressal

The amended IT Rules also introduce significantly shorter timelines for certain intermediary obligations. The changes make timely escalation and response particularly important for platforms handling complaints about synthetic content.

Under the amended framework, intermediaries are required to act within three hours of receiving a qualifying court order or reasoned intimation from the appropriate government or its agency for the removal or disabling of access to unlawful information. The amendments also shorten certain grievance redressal periods, including timelines applicable to complaints concerning individual content and specified high-risk categories.

These timelines must be read in conjunction with the specific provision governing the nature of the complaint or direction. The three-hour requirement applicable to qualifying government or court directions should not be treated as a universal deadline for every complaint concerning AI-generated content.

For intermediaries, the practical challenge is to ensure that the relevant teams can identify the applicable category, verify the nature of the notice, escalate the matter and take the required action within the prescribed period.

A delayed response may expose an intermediary to regulatory and legal risks, including questions concerning compliance with its due diligence obligations and the availability of safe harbour protection under Section 79 of the Information Technology Act, 2000.

Accordingly, platforms should review their grievance redressal systems, staffing arrangements, escalation matrices and internal response protocols. Procedures designed around earlier timelines may no longer be adequate for categories of matters subject to the amended requirements.

For businesses using third-party platforms to distribute AI-generated material, these developments also underline the importance of maintaining accurate content records and ensuring that complaints can be investigated and addressed promptly.

Enhanced Obligations for Significant Social Media Intermediaries

The amended framework imposes additional requirements on significant social media intermediaries (SSMIs). These intermediaries are subject to enhanced due diligence obligations concerning synthetic content, including requirements relating to user declarations and technical measures to verify whether uploaded content constitutes SGI. They must also ensure that qualifying synthetic content is appropriately identified in accordance with the Rules.

The enhanced requirements are intended to address the scale at which synthetic content can circulate on major platforms. At that scale, reliance solely on users to identify AI-generated material may be insufficient. For affected platforms, compliance may therefore require a combination of user-facing disclosures, technical verification systems, content labelling procedures and internal mechanisms for addressing violations.

These requirements also raise operational questions. Automated detection systems may not identify every instance of synthetic content, while inaccurate classifications may result in lawful material being incorrectly labelled or restricted. Platforms must therefore assess the effectiveness of their technical safeguards and establish suitable procedures for handling disputed classifications. The objective is not simply to deploy detection technology, but to ensure that the overall compliance framework operates consistently with the applicable legal obligations.

Implications for Businesses Using Generative AI

Although the amended IT Rules place specific obligations on intermediaries and other covered entities, businesses using generative AI should also consider the legal risks associated with the content they commission, create, publish or distribute. The use of AI in advertising, recruitment, employee training, customer engagement and corporate communications may create situations in which synthetic content is mistaken for an authentic recording or representation.

For example, a company may use an AI-generated spokesperson in a marketing campaign, produce a synthetic demonstration video or use voice-generation tools to localise promotional content. Depending on the manner in which the content is created and distributed, the relevant legal considerations may include labelling, authorisation, accuracy of representations, contractual responsibilities and compliance with applicable platform policies.

Businesses should consider adopting internal controls that address the following areas.

• AI-use policies: Organisations should define the permitted uses of generative AI and identify categories of content that require additional review or approval.
• Content verification: AI-generated or materially altered content should be reviewed for misleading representations, unauthorised use of third-party material and other legal risks before publication.
• Vendor and agency contracts: Agreements with marketing agencies, production houses and AI service providers should clearly allocate responsibility for content review, required disclosures, record retention and responses to complaints.
• Approval procedures: Content involving realistic depictions of identifiable individuals, sensitive subjects or representations of actual events may warrant enhanced review before release.
• Incident response: Businesses should establish procedures for investigating complaints, preserving relevant records, coordinating with service providers and addressing unlawful or misleading content.

These measures can help organisations identify potential risks at an early stage. However, their implementation should be proportionate to the nature of the business, the content produced and the legal obligations applicable to the organisation.

Balancing Content Regulation With Innovation and Legitimate Expression

The regulation of synthetic content presents a continuing challenge: preventing unlawful or deceptive uses of AI without unnecessarily restricting legitimate innovation. AI-generated material has applications across film production, education, accessibility, advertising and creative industries. A regulatory approach that treats every instance of synthetic content as inherently unlawful could impose unnecessary restrictions on these uses.

The amended IT Rules distinguish between permissible synthetic content that is subject to applicable identification requirements and synthetic content that violates the law. This distinction is important for businesses and platforms developing policies for the use of AI. At the same time, labelling alone cannot resolve every legal issue. A fabricated representation may be unlawful because of its content, purpose or manner of distribution, irrespective of whether it carries an AI-generated label. Conversely, the use of AI does not automatically make a lawful creative or commercial activity impermissible.

A proportionate approach requires organisations to assess the content, the relevant legal provisions and the circumstances of its use, rather than relying exclusively on automated detection or disclosure.

Conclusion

India’s 2026 amendments to the IT Rules represent an important development in the regulation of AI-generated content. By introducing a more explicit framework for synthetically generated information, strengthening due diligence requirements, prescribing labelling and traceability measures, and reducing certain response timelines, the amendments place greater emphasis on the systems through which synthetic content is created and distributed.

For intermediaries and significant social media intermediaries, the changes require careful attention to technical safeguards, content identification, user disclosures and grievance redressal procedures. Businesses using generative AI should also review their content approval processes, contractual arrangements and internal policies to identify potential compliance risks.

The effectiveness of the framework will depend on how these requirements operate in practice, including how technical measures are implemented, how complaints are handled and how lawful expression is distinguished from prohibited content.

As generative AI becomes more integrated into business operations and digital communication, organisations will need to treat AI-content governance as an ongoing compliance consideration rather than a one-time policy exercise. A clear understanding of the amended IT Rules and a proportionate approach to implementation can help businesses navigate the evolving regulatory environment while continuing to use AI responsibly.

Last Updated on 22 October, 2026