IT Rules 2026: AI-made audio, images and video
Since 20 February 2026, platforms must block harmful AI-made audio, images and video that look real, and label the rest. Large social media platforms must also ask you to declare AI-made content before it goes live.
What it means for you
Creator
LawOn a large social media platform, you must say whether your post is AI-made (Rule 4(1A)(a)).
LawMaking a banned fake can bring penalties under other laws. Your account can be suspended (Rule 3(1)(ca)).
Good practiceKeep the platform's label on. Keep your original files in case someone challenges your post.
Business or agency
LawThe duties in these Rules fall on platforms, not on you directly. Your ads still go through the platform's declaration and label steps.
Good practiceTell clients when a person, voice or event in an ad is AI-made. Get written consent from anyone whose face or voice you recreate.
Platform
LawIf your tool can make or change such content, block the banned kinds and label the rest (Rule 3(3)).
LawMeet the new removal times: 3 hours, 36 hours and 2 hours (Rule 3(1)(d) and Rule 3(2)).
Good practiceWrite down how your checks work, so you can show what you did if asked.
What counts as AI-made media
The Rules use the term "synthetically generated information" (SGI). In plain words, it is AI-made or AI-altered audio and video that looks real. It also covers images. The test is simple: would a person think it shows a real person or a real event?
It covers only audio, visual and audio-visual content. Plain text is not covered. MeitY's FAQ says a chatbot-written article on its own is not SGI. It may still break other laws (MeitY FAQ, Q8).
Three kinds of everyday editing are left out, as long as they do not change the meaning:
- routine edits such as colour fixes, noise reduction, compression or transcription;
- making normal documents, slides, PDFs, training or research material, as long as no false record is made;
- tools used only for accessibility, translation, clarity or search.
Official text — Rule 2(1)(wa), IT Rules 2021 as amended by G.S.R. 120(E)
What platforms must do
Every platform whose tool can make or change such content must:
- use reasonable technical checks to stop banned fakes (Rule 3(3)(a)(i));
- label all other such content clearly. Audio needs a spoken notice at the start (Rule 3(3)(a)(ii));
- add permanent metadata or another provenance marker with a unique identifier, where technically feasible (Rule 3(3)(a)(ii));
- not let anyone remove or hide the label or metadata (Rule 3(3)(b));
- warn users that misuse can bring penalties, removal and account suspension (Rule 3(1)(ca)).
Significant social media intermediaries have extra duties. These are social media platforms with more than fifty lakh (5 million) registered users in India (Rule 2(1)(v); MeitY notification S.O. 942(E), 25 February 2021). Before content goes live, they must:
- ask users to declare whether it is AI-made (Rule 4(1A)(a));
- use technical checks to verify that declaration (Rule 4(1A)(b));
- show a clear label when the content is confirmed as AI-made (Rule 4(1A)(c)).
Banned kinds and takedown times
Platforms must stop AI-made content that breaks any law. The Rules name four kinds (Rule 3(3)(a)(i)):
- child sexual abuse material, intimate images shared without consent, or obscene content;
- false documents or false electronic records;
- content about making explosives, arms or ammunition;
- fakes that deceive people about a real person's identity, voice or actions, or about a real event.
| What | Before | Now | Rule |
|---|---|---|---|
| Remove content after a court order or authorised government notice | 36 hours | 3 hours | Rule 3(1)(d) |
| Resolve a user complaint | 15 days | 7 days | Rule 3(2)(a)(i) |
| Act on certain removal complaints about unlawful content | 72 hours | 36 hours | Rule 3(2)(a)(i), proviso |
| Remove nudity, sexual or impersonation content (including morphed images) after a complaint | 24 hours | 2 hours | Rule 3(2)(b) |
Safe harbour
"Safe harbour" means a platform is not held liable for what its users post, if it meets set conditions. This protection is in Section 79 of the IT Act.
Removing content to follow these Rules does not cost a platform this protection. This includes removal by automated tools (Rule 2(1B)).
Some large platforms knowingly allow, promote or ignore rule-breaking AI content. They are treated as failing their due diligence (Rule 4(1A), proviso).
Where it came from, and when it started
On 22 October 2025, MeitY published a draft and asked for comments. That draft proposed that labels cover at least 10% of the image, or the first 10% of the audio. The final Rules do not include that figure. They require labels with "prominent visibility" instead.
The final Rules were notified on 10 February 2026 as G.S.R. 120(E). They came into force on 20 February 2026 (MeitY FAQ, Introduction).
A separate, earlier amendment, G.S.R. 775(E) of 22 October 2025, is also law. It changed how platforms receive government takedown notices (Rule 3(1)(d)). It took effect on 15 November 2025.
What's still open
Draft Second Amendment Rules, 2026 (draft, not notified). MeitY published this draft in March 2026. It has no G.S.R. number and no start date. As drafted, it would:
- make platforms follow MeitY's written advisories, directions and codes as part of due diligence (proposed Rule 3(4));
- apply the news-content oversight rules to news posted by ordinary users, not just publishers (proposed Rule 8(1));
- let the oversight committee hear matters the Ministry refers to it (proposed Rule 14);
- keep other data-retention laws in force alongside Rule 3(1)(g) and (h).
It does not add new rules about AI-made content.
Sources
In force — checked 2026-10-06. Opened the IT Rules, 2021, consolidated to 10 February 2026.
Advisory — not binding — checked 2026-10-06. Opened the MeitY FAQs on the IT Amendment Rules, 2026.
Status unverified — no status check recorded
Draft — checked 2026-10-06. Opened the Draft IT Second Amendment Rules, 2026.
Hit by a deepfake or impersonation?
A short helper that points you to the right complaint route for deepfake, voice-clone, impersonation or scam cases.
Run it nowAm I a Data Fiduciary?
If you also handle user data, check whether DPDP duties apply to you alongside these platform rules.
Run it now