The IT Amendment Rules 2026 quietly reshaped how every platform operating in India — from a two-person SaaS startup to a national media house — must handle AI-generated content, and most businesses still don’t fully understand what changed or why it applies to them. Notified by the Ministry of Electronics and Information Technology (MeitY) on 10 February 2026 and enforced from 20 February 2026, these rules introduced a new legal category called “Synthetically Generated Information” (SGI), slashed takedown timelines from 36 hours to as little as 2–3 hours, and tied a platform’s safe harbour protection directly to how fast and how accurately it responds. I run both a SaaS product and a digital media platform, so I’m not writing this as theory — these are the exact compliance questions I’ve had to work through myself. In this guide, I’ll break down what SGI actually means, who counts as an “intermediary” under these rules, the new due diligence framework, and what founders and publishers specifically need to fix before they get caught out.
What Are the IT Amendment Rules 2026?
The IT Amendment Rules 2026 are formally the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified via Gazette Notification G.S.R. 120(E) on 10 February 2026. They amend the existing IT Rules, 2021 to specifically bring deepfakes and other AI-generated media within the intermediary due-diligence framework — something the 2021 rules never explicitly addressed. The amendment took effect on 20 February 2026, giving platforms just a 10-day runway between notification and enforcement to adjust their content moderation systems, terms of service, and internal escalation processes.
What Counts as “Synthetically Generated Information” (SGI)?
This is the single most important definition in the entire amendment, and it’s worth reading carefully because it’s built around how content appears to a viewer, not around whether AI was technically used to make it.
Under the amendment, Synthetically Generated Information is defined as audio, visual, or audio-visual content that is artificially or algorithmically created, generated, modified, or altered using a computer resource, in a manner that makes it appear real, authentic, or true, and that depicts or portrays an individual or event in a way that is — or is likely to be perceived as — indistinguishable from a natural person or a real-world event.
Three things matter here for founders and publishers:
- It’s effect-based, not tool-based. A photo edited to look like a real, unaltered event can qualify as SGI even if the editing tool wasn’t marketed as “AI.” Conversely, obviously stylised or clearly labelled synthetic content is less likely to trigger the same obligations.
- Text is excluded — for now. AI-generated text content does not fall within the SGI definition, though it remains subject to existing unlawful-content obligations under the IT Rules and IT Act. If your SaaS tool only generates or edits text, SGI-specific labelling rules don’t directly apply, but general takedown obligations still do.
- It covers modification, not just creation. A real photo or video that’s been algorithmically altered to misrepresent what actually happened also qualifies — this is directly relevant if your SaaS product allows users to edit images, audio, or video, even without “generating” content from scratch.
The New Due Diligence Framework: What Changed From the 2021 Rules
| IT Rules 2021 (Old) | IT Amendment Rules 2026 (New) | |
|---|---|---|
| AI content status | Not specifically addressed | Explicitly defined as “Synthetically Generated Information” (SGI) |
| Takedown timeline (court/govt-flagged unlawful content) | Up to 36 hours | 3 hours |
| Takedown timeline (non-consensual intimate imagery, including deepfake nudity) | Not separately specified | 2 hours |
| Labelling of AI content | Voluntary | Mandatory, clear and prominent |
| Provenance metadata | No requirement | Required where technically feasible, and cannot be stripped |
| Consequence of non-compliance | Risk of losing safe harbour | Same, but with a dramatically shorter compliance window |
The compressed takedown window is the change that should worry SaaS founders most. Going from 36 hours to 3 hours (or 2, for the most sensitive category) effectively removes the buffer that many smaller platforms relied on — a manual review process that took a day is no longer defensible.
Who Does This Apply To? “Intermediary” Status for SaaS Founders
A common misunderstanding I keep running into: founders assume these rules only apply to large social media platforms. They don’t. Under the IT Act’s definition, an “intermediary” includes any platform that receives, stores, or transmits electronic records on behalf of another person — which covers a huge range of SaaS products, not just Instagram-scale platforms.
If your SaaS tool lets users:
- Upload, edit, or export images, audio, or video (even simple editing features)
- Share generated or modified media with others through your platform
- Host user-generated content of any kind, including documents that embed images
…you likely qualify as an intermediary, and the SGI due diligence obligations apply to you, regardless of your company’s size. Running a document/PDF-focused SaaS product, for instance, doesn’t automatically exempt you — if your tool allows embedding or exporting altered images or media within documents, that functionality can bring you within scope.
What Publishers Specifically Need to Know
Digital media publishers face a distinct set of obligations under the Digital Media Ethics Code portion of the rules, layered on top of the SGI framework:
- Labelling obligations extend to published content, not just user uploads — if your newsroom uses AI-generated or AI-edited images/video in a story, prominent labelling and provenance metadata requirements apply just as much as they would to a platform hosting third-party uploads.
- The 3-hour and 2-hour takedown windows apply to reader-submitted content on comment sections, user galleries, or any interactive feature where readers can upload media.
- Editorial correction workflows need to be fast enough to meet the new timelines — a correction or takedown process built for a “next business day” cadence simply won’t hold up.
The practical overlap here is significant: a media platform that also allows any form of reader-submitted visual content is now operating under both the Digital Media Ethics Code obligations and the intermediary due-diligence obligations simultaneously.
Step-by-Step Compliance Checklist for SaaS Founders and Publishers
- Audit your product for SGI-triggering features — any upload, edit, or export functionality involving images, audio, or video.
- Build (or contract) automated detection capability — manual moderation alone cannot realistically meet a 2–3 hour response window at scale.
- Implement mandatory, prominent labelling for any content your platform detects or knows to be synthetically generated.
- Preserve provenance metadata through your content pipeline — and ensure your export/edit functions don’t inadvertently strip it, since the rules explicitly prohibit removal of this metadata.
- Rewrite your internal escalation SOP around the compressed timelines — a designated grievance officer with a documented, testable 2-hour and 3-hour response protocol, not just a policy on paper.
- Update your Terms of Service and content policy to reflect SGI definitions, user obligations, and your platform’s labelling and takedown commitments.
- Document every takedown decision and its timestamp — in a safe-harbour dispute, your ability to prove timely action is the core of your defence.
If you’re unsure whether your specific product features bring you within the intermediary definition, or your existing content policy needs a rewrite to reflect the new timelines, it’s worth getting a compliance review of your platform’s terms and moderation workflow before an incident forces the question — retrofitting compliance after a complaint is far more expensive than building it in now.
Safe Harbour: What’s Actually at Risk
Safe harbour protection under Section 79 of the IT Act is what shields intermediaries from liability for content posted by their users, provided they meet due diligence obligations. The IT Amendment Rules 2026 make the timeline for meeting those obligations dramatically stricter — miss the 3-hour or 2-hour window on a flagged piece of unlawful SGI, and a platform risks losing that protection entirely for the content in question.
Once safe harbour is lost, the platform itself can be held directly liable for the unlawful content, alongside whatever liability arises under other applicable laws — including, in serious cases involving personal data, potential overlap with penalties under the Digital Personal Data Protection Act, 2023. This is precisely why the compressed timeline isn’t a minor operational inconvenience — it changes the actual legal exposure a platform carries.
Common Compliance Gaps I’m Seeing (That Most Guides Don’t Mention)
- Founders assuming “we’re too small to matter.” Intermediary status doesn’t scale with company size — a five-person SaaS team with an image-editing feature has the same due diligence obligation as a large platform, just with fewer resources to meet it.
- Confusing “voluntary AI disclosure” with the new mandatory labelling requirement. Many platforms already had an optional “AI-generated” tag; that’s no longer sufficient where SGI applies — labelling must be prominent and consistent, not opt-in.
- Export/download features silently stripping metadata. If your product lets users download or re-export edited media, check whether your pipeline preserves or destroys provenance metadata in that process — this is a technical gap, not just a policy one.
- Treating the Digital Media Ethics Code and intermediary rules as separate compliance tracks. For a publisher with reader-upload features, they overlap, and a compliance plan addressing only one leaves a real gap.
IT Amendment Rules 2026 vs. Older IT Rules: A Quick Reference
| Aspect | Before (2021 Rules) | After (2026 Amendment) |
|---|---|---|
| Legal recognition of deepfakes/AI content | None specific | Formally defined as SGI |
| Response time for flagged unlawful content | 36 hours | 3 hours (2 hours for NCII/deepfake nudity) |
| Labelling requirement | Optional | Mandatory and prominent |
| Provenance metadata | Not addressed | Required, non-strippable |
| Text-based AI content | Governed generally | Explicitly excluded from SGI definition |
Frequently Asked Questions About the IT Amendment Rules 2026
1. When did the IT Amendment Rules 2026 come into effect?
MeitY notified the rules on 10 February 2026 via Gazette Notification G.S.R. 120(E), and they came into force on 20 February 2026, giving platforms a 10-day window to prepare before enforcement began.
2. What is “Synthetically Generated Information” (SGI) under the new rules?
SGI is audio, visual, or audio-visual content that is artificially or algorithmically created, generated, modified, or altered using a computer resource in a way that makes it appear real, authentic, or indistinguishable from a genuine person or event.
3. Does the IT Amendment Rules 2026 apply to AI-generated text content?
No. Text generated by AI is explicitly excluded from the SGI definition, though it remains subject to existing unlawful-content obligations under the general IT Rules and IT Act framework.
4. What is the new takedown timeline under the IT Amendment Rules 2026?
Platforms must remove court-flagged or government-flagged unlawful content within 3 hours (down from 36 hours under the old rules), and within 2 hours for complaints involving non-consensual intimate imagery, including deepfake nudity.
5. Does a small SaaS startup qualify as an “intermediary” under these rules?
Yes, if the platform receives, stores, or transmits electronic records — including any feature allowing users to upload, edit, or share images, audio, or video — it can qualify as an intermediary regardless of company size, and the due diligence obligations apply accordingly.
6. What happens if a platform misses the 3-hour or 2-hour takedown window?
The platform risks losing its safe harbour protection under Section 79 of the IT Act for that specific content, exposing it to direct legal liability rather than the limited liability intermediaries normally enjoy.
7. Is labelling of AI-generated content mandatory now?
Yes. Under the 2026 amendment, labelling of synthetically generated information must be clear, prominent, and mandatory — a voluntary or opt-in “AI-generated” tag is no longer sufficient where SGI provisions apply.
8. What is “provenance metadata” and why does it matter?
Provenance metadata is embedded information identifying content as synthetically generated or modified. The new rules require this metadata where technically feasible and explicitly prohibit it from being stripped out during editing, export, or redistribution.
9. Do digital media publishers have separate obligations under these rules?
Yes. Publishers are governed by the Digital Media Ethics Code portion of the framework, which includes labelling obligations for AI-generated content used in published stories, in addition to the same takedown timelines applicable to reader-submitted content.
10. Can a platform be penalised for content it didn’t create but merely hosted?
Yes, if the platform fails to meet its due diligence obligations — including timely takedown and proper labelling — after gaining actual knowledge of unlawful synthetically generated content, it can lose safe harbour protection and face liability for that content.
11. How is this different from the earlier 2021 IT Rules on content takedown?
The core changes are the introduction of the SGI category (not present in 2021), a drastic reduction in takedown timelines (36 hours to 2–3 hours), and new mandatory labelling and non-strippable provenance metadata requirements that didn’t exist before.
Conclusion
The IT Amendment Rules 2026 didn’t just tighten a few timelines — they fundamentally redefined what “reasonable due diligence” looks like for any platform touching AI-generated or AI-edited media in India, and that includes far more SaaS products and publishers than most founders realise. The businesses that will struggle aren’t the ones without a compliance policy on paper; they’re the ones whose actual technical pipeline — detection, labelling, metadata preservation, and escalation speed — can’t keep pace with a 2-to-3-hour clock. If you’re building or running a platform that touches user-generated media in any form, this is worth auditing now, not after your first complaint arrives.
If you want a practical, product-level compliance audit rather than a generic policy template, I’d be happy to walk through your specific SaaS features or publishing workflow and flag exactly where the SGI obligations actually bite — it’s a very different conversation once you’re looking at your own product rather than the regulation in the abstract.