Govt Amends IT Rules, with focus on AI content

Why the IT Rules 2026 Take Aim at AI Content

Three hours—this is all the time social media platforms now have to take action under the amended Information Technology (IT) Rules, 2026, when a lawful order is issued in critical cases such as takedowns of harmful AI-generated content. This is a stark reduction from the previously allowed 36 hours, and it underscores the government’s urgency amid the escalating challenges posed by artificial intelligence (AI) technologies. But urgency is a double-edged sword in policymaking. While the amendments create stronger safeguards against deepfakes, child sexual abuse material (CSAM), and non-consensual intimate imagery (NCII), there are legitimate fears that they also risk overburdening platforms with impractical timelines and unclear compliance thresholds.

The New Rules Target Synthetic Media

At the center of the amendments is a legal recognition of “synthetic media”—a category that includes AI-generated content designed to mimic real people or events with the potential to deceive viewers. Under the new rules, this content must be explicitly labeled, with directives requiring platforms and intermediaries to embed persistent metadata or other provenance markers that trace it back to its source. This provenance is non-negotiable: intermediaries are forbidden from allowing the removal or tampering of these markers.

Other measures amplify platform accountability further. Social media platforms must now ask users at the time of upload to declare whether any content is AI-generated. A mechanism for verification of these declarations, though unspecified in its technical details, becomes the responsibility of platforms—potentially adding layers of moderation complexity. Moreover, law enforcement authorities, specifically officers ranked Deputy Inspector General (DIG) or above, are empowered to issue takedown orders for non-compliant or harmful content.

The rules introduce much tighter timelines for action. For less urgent cases, response durations have also been shortened: from 15 days to 7 for resolving certain complaints, and from 24 hours to 12 for compliance with specific orders. Failure to meet these deadlines carries the specter of criminal litigation under social media intermediary laws. The government has further mandated that platforms educate users about prohibited content and recourse mechanisms at least once every three months—up from the previous, arbitrary annual practice.

The Case For: Combatting the Risks of AI-Driven Misinformation

The rationale for these changes is grounded in recent alarming trends. Globally, deepfake technology has been weaponized, with cases ranging from synthetic pornography targeting activists and politicians to AI-generated scams costing millions. In India, a 2023 Internet and Mobile Association of India report estimated a 38% surge in AI-driven online impersonation scams within two years. Add to this the growing instances of NCII and CSAM proliferating unfettered due to algorithmic loopholes that major platforms have failed to address.

By emphasizing mandatory labeling and metadata for synthetic content, the government follows a clear logic: traceability. Much as vehicle registration helps track drivers in hit-and-run cases, these markers aim to create an accountability trail for malicious use of AI systems. The tighter deadlines, though ambitious, aim to disrupt the lifecycle of harmful viral content—a critical necessity in cases of deepfakes, where early containment greatly reduces reach.

Countries like Singapore have taken similar steps, notably under their Protection from Online Falsehoods and Manipulation Act (POFMA). Singapore’s swift takedown protocols and stringent fines have acted as substantial deterrents to the spread of AI-generated fake news. Importantly, POFMA provisions focus not just on intermediaries but also on platforms hosting user-uploaded AI content. India’s amendments appear to follow this blueprint to some extent, by enforcing time-bound escalations and proactive content governance from intermediary platforms.

Criticisms: Procedural Haste and Risks of Overreach

While the regulatory intent may be laudable, the execution framework raises unsettling questions. For starters, the technical feasibility of persistent metadata enforcement remains ambiguous. AI systems, especially open-source ones like those behind popular deepfake apps, operate in decentralized digital ecosystems. Ensuring that small platforms—or worse, private AI generators on darknet markets—comply with metadata requirements seems nearly impossible. How will the government enforce this against overseas platforms, let alone anonymous generators?

Additionally, the reduction of response times to three hours in critical cases borders on being impractical. Even the largest platforms like Facebook and X (formerly Twitter), with their multi-billion-dollar moderation budgets, have struggled to meet existing deadlines. For smaller entities, these compressed timelines could either result in arbitrary compliance (mass takedowns of flagged content without merit) or complete non-compliance under duress—both outcomes with significant free speech implications.

There is also the potential for misuse of these rules against dissent. Enabling law enforcement officers ranked DIG or above to issue takedown orders—without judicial approval—could lead to overreach in politically sensitive cases. This echoes some troubling trends under India’s IT Rules, 2021, where critics argued that similar takedown powers were selectively employed against government critics. The bureaucracy’s track record of impartial enforcement remains far from reassuring.

Learning From Singapore’s Focus on Proportionality

Singapore’s POFMA, often cited as a model for tackling AI-driven misinformation, showcases one potential alternative approach. Instead of mandating single-digit response times across the board, Singapore tiers its takedown deadlines based on the scale of risk—differentiating between “critical harm” content and less urgent violations. This ensures both precision and operational feasibility for platforms. Furthermore, POFMA orders require oversight from Ministers, limiting the scope of purely administrative decisions from law enforcement officers.

In contrast, India’s framework introduces layers of rapid compliance without addressing institutional oversight mechanisms. Here, the risk lies in conflating operational efficiency with accountability: faster takedown actions do not automatically mean better governance, especially if independent checks are undermined in rushed proceedings.

Balancing Speed and Scrutiny

Where do the IT Rules of 2026 leave us? On paper, they represent a concerted attempt to preemptively address a very real digital governance crisis fueled by synthetic media. In practice, they risk creating more questions than they resolve. The focus on labelling and traceability is a welcome development—it underscores emerging global standards for ethical AI usage. But the procedural demands, particularly the three-hour takedown window, are likely overreaching for all but the largest platforms.

India now has a rare opportunity to lead the global conversation on managing AI content. But leading requires balancing ambition with realism. As implementation unfolds, much will depend on whether the government chooses to treat compliance challenges as opportunities for collaborative evolutions—rather than punitive enforcement for its own sake.

Practice Questions for UPSC

Prelims Practice Questions

Frequently Asked Questions