Amendment Rules, 2026,<\/a> issued under the IT Act, 2000, amend the 2021 rules and apply to all online intermediaries, including social media platforms, messaging services, content-hosting websites and AI-based platforms.<\/p>\nThe amendments, effective from 20 February 2026, significantly expand the regulatory scope by explicitly bringing artificial-intelligence-generated, synthetic and manipulated content\u2014such as deepfakes, voice cloning and algorithmically altered text, images, audio or video\u2014within the definition of regulated online content.<\/p>\n
By doing so, the rules remove any ambiguity about whether AI-generated material is covered and treat such content on par with other forms of user-generated information under Indian law.<\/p>\n
Who are the new rules applicable to?<\/h2>\n
Issued under Section 87 of the IT Act, 2000, these rules amend the 2021 IT Rules. They apply to all intermediaries, including social media platforms, messaging apps, video-sharing platforms, AI-driven content platforms, any service that hosts, publishes, transmits, or enables access to user-generated content.<\/p>\n
When will they come into effect?<\/h2>\n
They come into force from February 20, 2026<\/p>\n
What are the new definitions?<\/h2>\n
The rules now explicitly define content that is:<\/em><\/p>\n\n- Generated wholly or partly by AI, algorithms, or automated systems<\/li>\n
- Includes text, images, audio, video, or mixed formats<\/li>\n
- Covers deepfakes, altered visuals, voice cloning, and simulated identities<\/li>\n<\/ul>\n
This ends ambiguity about whether AI-generated material is regulated\u2014it clearly is.<\/p>\n
Which content is regulated?<\/h2>\n
Content is treated as regulated if it \u2014 alters reality in a deceptive way; is capable of misleading users about facts, identity, or events; is presented as authentic without disclosure<\/p>\n
What does it mean for social media companies and platforms?<\/h2>\n
Platforms must now take active responsibility, not just reactive steps.<\/em><\/p>\na) Reasonable efforts to prevent violations<\/strong><\/p>\nIntermediaries must:<\/em><\/p>\n\n- Prevent hosting or circulation of unlawful content<\/li>\n
- Use automated tools, human review, or other appropriate measures<\/li>\n
- Regularly review their systems to reduce misuse<\/li>\n<\/ul>\n
Failure to act despite knowledge is treated as non-compliance<\/p>\n
b) Prohibited content categories<\/strong><\/p>\nPlatforms must act against content that violates:<\/em><\/p>\n\n- Indian laws (criminal, civil, regulatory)<\/li>\n
- National security and public order<\/li>\n
- Court orders or government directions<\/li>\n
- User safety and dignity (harassment, impersonation, deception)<\/li>\n<\/ul>\n
What are the rules on takedown and access restriction?<\/h2>\n
Mandatory response to orders when directed by courts, government authorities under valid legal powers<\/p>\n
Platforms must remove content, disable access, restrict visibility<\/p>\n
Failure or delay is treated as a violation of the rules.<\/p>\n
What if there is a delay?<\/h2>\n
The amendments shorten and clarify response timelines, signaling that delays can attract penalties. Partial compliance is not sufficient.<\/p>\n
What is the \u201c3-hour window”? When does it apply?<\/h2>\n
The 3-hour window is an emergency compliance timeline built into the amended IT Rules framework. It applies in exceptional, high-risk situations, not routine complaints.<\/p>\n
When an intermediary receives a lawful direction relating to content that poses an immediate and serious risk, such as:<\/em><\/p>\nThreats to national security or public order<\/p>\n
Risk of violence, riots, or mass harm<\/p>\n
Content linked to terrorism, child sexual abuse material, or severe impersonation<\/p>\n
Time-sensitive misinformation likely to cause real-world harm<\/p>\n
In such cases, platforms are expected to remove, block, or disable access within 3 hours of receiving the direction.<\/p>\n
This window exists because waiting 24 hours can be too late for rapidly spreading digital harm.<\/p>\n
The 3-hour window is not optional and not advisory. Failure to act within this period is treated as prima facie non-compliance, even if action is taken later.<\/p>\n
What is the labelling clause?<\/h2>\n
The labelling clause relates mainly to AI-generated, synthetic, or manipulated content.<\/p>\n
Intermediaries must ensure that users are not misled into believing synthetic or AI-generated content is real, especially when:<\/em><\/p>\nA real person\u2019s identity, voice, image, or likeness is used<\/p>\n
Content could influence public opinion, trust, or behaviour<\/p>\n
Content is presented as factual or authentic<\/p>\n
Platforms may comply by:<\/em><\/p>\nLabeling content as \u201cAI-generated”, \u201csynthetic”, or \u201cmanipulated”<\/p>\n
Adding contextual warnings<\/p>\n
Reducing visibility or distribution if labelling is not possible<\/p>\n
Removing the content if it is deceptive or harmful<\/p>\n
Who is responsible?<\/h2>\n
Responsibility is shared:<\/p>\n
Users must not deliberately misrepresent synthetic content as real<\/p>\n
Platforms must take reasonable steps to detect, flag, or label such content once they are aware of it<\/p>\n
What happens if platforms don\u2019t follow these clauses?<\/h2>\n
For missing the 3-hour window:<\/strong><\/p>\nImmediate loss of safe harbour protection<\/p>\n
Potential criminal or civil liability<\/p>\n
Strong grounds for court or government enforcement action<\/p>\n
For violating the labelling requirement:<\/strong><\/p>\nContent treated as misleading or unlawful<\/p>\n
Mandatory takedown or restriction<\/p>\n
Repeated failure can count as systemic non-compliance.<\/p>\n
What are the time limits?<\/h2>\n
24 hours \u2013 Rapid response obligations: <\/strong>This is the most frequently triggered deadline.<\/p>\nIt applies to content affecting public order, safety, or sovereignty. Complaints involving illegal, deceptive, or harmful content. Initial response to serious user grievances<\/p>\n
What must be done?<\/em><\/p>\nAcknowledge the issue<\/p>\n
Take interim action (remove, restrict, downrank, or block access)<\/p>\n
Begin formal review<\/p>\n
Platforms cannot wait for full internal evaluation before acting.<\/p>\n
36 hours \u2013 Certain government directions<\/strong><\/p>\nWhere a lawful government order specifies this window (carried forward and reinforced from the 2021 framework), intermediaries must:<\/em><\/p>\nRemove or disable access to content within 36 hours<\/p>\n
Report compliance if required<\/p>\n
Failure counts as non-compliance under due-diligence obligations.<\/p>\n
72 hours \u2013 Information assistance to authorities<\/strong><\/p>\nWhen lawfully required, intermediaries must provide information, data assistance, user or content details (as permitted by law). This applies mainly to investigations and law-enforcement cooperation.<\/p>\n
24 hours \u2013 Grievance acknowledgement<\/strong><\/p>\nFor user complaints filed through the platform\u2019s grievance system, the complaint must be acknowledged within 24 hours. Silence or automated non-response is treated as failure of the grievance mechanism<\/p>\n
15 days \u2013 Final grievance resolution<\/strong><\/p>\nPlatforms must:<\/em><\/p>\nDecide and communicate a final outcome within 15 days<\/p>\n
Explain reasons for action or inaction<\/p>\n
Take corrective steps if violation is found<\/p>\n
Unresolved or ignored complaints weaken the platform\u2019s compliance record.<\/p>\n
\u201cWithout delay” \u2013 Self-detected violations<\/strong><\/p>\nIf a platform detects illegal or prohibited content through AI tools or internal review. Becomes aware of violations through any source<\/p>\n
Immediate \/ ongoing \u2013 Repeat offender action: <\/strong>For accounts repeatedly violating rules, platforms must take timely escalatory action. Continued tolerance can be treated as systemic failure<\/p>\nNo fixed hour count is given, but enforcement must be prompt and proportionate.<\/p>\n
As specified in order \u2013 Court directions<\/strong>: Courts may set custom timelines depending on urgency. These override general timelines. Even shorter compliance windows can be imposed.<\/p>\nWhat is expected of the companies?<\/h2>\n
Intermediaries are allowed\u2014and expected\u2014to deploy automated moderation tools, use AI detection systems for harmful or synthetic content, combine automation with human oversight<\/p>\n
However, tools must be proportionate, over-removal without review can still be challenged.<\/p>\n
What information is to be given to users?<\/h2>\n
Platforms must:<\/em><\/p>\nClearly inform users about prohibited content<\/p>\n
Explain consequences such as content removal, account suspension, reduced reach or visibility.<\/p>\n
Users must be able to understand why action was taken<\/p>\n
What is the action against repeat or serious offenders?<\/h2>\n
Intermediaries may suspend or terminate accounts, restrict posting or sharing features, limit visibility of content<\/p>\n
Especially in cases of repeated violations, serious harm or deception, coordinated misuse.<\/p>\n
Is there a grievance redressal framework?<\/h2>\n
Platforms must maintain an effective grievance mechanism, act on complaints within prescribed timelines, escalate unresolved issues appropriately.<\/p>\n
Non-response to grievances counts against compliance.<\/p>\n
What is Safe harbour under Section 79?<\/h2>\n
It protects intermediaries from liability for user content only if they follow the rules.<\/p>\n
Safe harbour is lost if:<\/p>\n
\u2022 Due diligence is not followed<\/p>\n
\u2022 Platforms knowingly allow illegal or harmful content<\/p>\n
\u2022 Orders are ignored or delayed<\/p>\n
Once safe harbour is gone, the platform can be directly sued or prosecuted<\/p>\n
Do they align with other laws?<\/h2>\n
The rules explicitly align with Bharatiya Nyaya Sanhita \/ criminal laws, cybersecurity laws, consumer protection laws and intellectual property laws.<\/p>\n