IT Amendment Rules 2026: India's Three-Hour Takedown Regime for Deepfakes and AI-Generated Content

The Ministry of Electronics and Information Technology (MeitY) notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 on 10 February 2026, with the rules taking effect from 20 February 2026. These amendments introduce a comprehensive regulatory framework for synthetically generated information (SGI), commonly known as deepfakes and AI-generated content. The centrepiece of the new regime is a mandatory three-hour takedown window for unlawful AI-generated content and a two-hour window for non-consensual intimate imagery, including deepfake intimate content. The rules also impose labelling and metadata obligations on platforms, require user declarations for AI-created content, and apply to any platform serving Indian users regardless of where the platform is incorporated.

Definition of Synthetically Generated Information

The 2026 amendment formally introduces the concept of Synthetically Generated Information under Rule 2(1)(wa), defined as audio, visual, or audio-visual information that is artificially or algorithmically created, generated, modified, or altered. The critical aspect of this definition is that it uses a perceptual threshold rather than a technical one. The test is not whether a specific AI technology was used to create the content, but whether the output appears real and is likely to be perceived as indistinguishable from authentic content by a reasonable person. This broad, technology-neutral definition ensures that the rules remain applicable as AI generation technologies evolve. It covers content generated by large language models, generative adversarial networks, diffusion models, voice cloning tools, and any future technology that produces synthetic media. Importantly, the rules specifically exempt routine editing operations such as colour correction, cropping, basic filters, and standard photo or video editing that does not create deceptive synthetic content. This exemption protects ordinary creative and editorial work from being caught within the regulatory net.

The Three-Hour and Two-Hour Takedown Obligations

The most operationally significant provision is the mandatory takedown timeline. Intermediaries must remove non-consensual intimate imagery, including AI-generated deepfake intimate content, within two hours of receiving a complaint or becoming aware of the content. For other categories of unlawful synthetic content, including AI-generated misinformation, impersonation, and content that threatens public order or national security, the takedown window is three hours. This represents a dramatic acceleration from the previous 36-hour compliance window under the 2021 Rules. The compressed timeline places India among the jurisdictions with the most aggressive content removal requirements globally. For platforms, this means that moderation teams must be staffed and operational around the clock, with automated detection tools supplementing human review to meet the timeline. Failure to comply with the takedown requirements exposes intermediaries to the loss of their safe harbour protection under Section 79 of the Information Technology Act, 2000, making them directly liable for the content they host.

Labelling, Watermarking, and Metadata Requirements

Beyond takedowns, the rules impose proactive obligations on platforms regarding AI content identification. All intermediaries must clearly and prominently label AI-generated or synthetically generated content in a manner visible to users viewing or interacting with the content. The label must be persistent, meaning it cannot be removed, altered, or suppressed by users or downstream platforms. Platforms must also ensure that AI-related watermarks and metadata embedded in synthetic content are preserved and not stripped during upload, processing, or redistribution. This requirement interacts with emerging technical standards for content provenance, such as the Coalition for Content Provenance and Authenticity (C2PA) framework, though the Indian rules do not mandate any specific technical standard. Platforms must additionally obtain user declarations at the point of upload where content has been created or materially altered using AI systems. This declaration mechanism shifts part of the identification burden to content creators, though platforms remain ultimately responsible for ensuring compliance.

Extraterritorial Application and Global Platform Compliance

The rules apply to any intermediary that offers services to Indian users, has users in India, or targets the Indian market, regardless of where the intermediary is incorporated or where its servers are located. This extraterritorial application means that global platforms such as social media networks, video hosting services, messaging applications, and AI content generation tools must comply with the Indian takedown timelines and labelling requirements if they have an Indian user base. For platforms incorporated outside India, compliance requires appointing a Chief Compliance Officer, a Nodal Contact Person, and a Resident Grievance Officer within India, all of whom must be resident in India. The combination of the three-hour takedown window and extraterritorial application creates a significant compliance challenge for platforms that operate across multiple jurisdictions with different content moderation timelines and standards.

Practical Implications and Open Questions

The IT Amendment Rules 2026 represent India's most direct regulatory response to the proliferation of AI-generated synthetic media. For platforms, the immediate compliance priorities are deploying or upgrading automated detection systems for synthetic content, establishing 24/7 moderation capacity to meet the two-hour and three-hour takedown windows, implementing persistent labelling systems for identified AI content, and building user declaration workflows into upload processes. For content creators using AI tools, the declaration requirement means that failure to disclose the use of AI in creating or modifying content could result in platform-level consequences including content removal and account restrictions. For individuals who are victims of deepfake content, particularly non-consensual intimate deepfakes, the two-hour takedown window provides a significantly faster remedy than was previously available. Several open questions remain, including how platforms will reliably detect AI-generated text (as opposed to images and video, where detection is more developed), how the exemption for routine editing will be interpreted in practice, and whether the compressed takedown timelines are technically achievable for platforms without large-scale moderation infrastructure. These questions will likely be resolved through OGAI guidance and judicial interpretation in the coming months.