AI on your website: the 2026 synthetic-content rules and what else applies

India has not enacted an AI-specific statute. AI use is governed by existing law: the Information Technology Act, 2000 and the rules under it, the Digital Personal Data Protection Act, 2023 and its 2025 Rules, consumer law, and sector regulators. The one set of binding, AI-specific obligations in force is the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, which deal with synthetically generated information.

New Rule 2(1)(wa) defines synthetically generated information (SGI) as audio, visual or audio-visual information artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that it appears real, authentic or true and is, or is likely to be perceived as, indistinguishable from a natural person or a real-world event.

The definition is limited to audio, visual and audio-visual content. Text-only AI output is not SGI. Text can still be unlawful information under the general obligations in Rules 3 and 4, and a new Rule 2(1A) clarifies that references to information used to commit an unlawful act include SGI.

The proviso to Rule 2(1)(wa) carves out routine, good-faith work. Per MeitY's FAQ, the exclusions cover:

• Routine editing, formatting, enhancement, technical correction, colour adjustment, noise reduction, transcription or compression, so long as it does not materially alter, distort or misrepresent the substance, context or meaning of the content.
• Routine good-faith creation of documents, presentations, PDFs, educational or training material and research outputs, including illustrative, hypothetical or template-based content, so long as no false document or false electronic record is produced.
• Use of tools solely to improve accessibility, clarity, quality, translation, description, searchability or discoverability, where no material part of the content is generated or manipulated — subtitles, captions, translation, audio description, auto-summaries.

AI-generated fake certificates, forged IDs, fabricated official letters or fabricated electronic records fall outside these exclusions.

The new Rule 3(3), "Due diligence in relation to synthetically generated information", applies where an intermediary offers a computer resource that enables or facilitates the creation, generation, modification, alteration, publication, transmission, sharing or dissemination of SGI. On MeitY's reading that includes AI image or video generation and editing tools, voice synthesis and voice-cloning tools, tools that manipulate audio or visual content into realistic synthetic media, and services that facilitate publication or dissemination of SGI.

If your site merely publishes your own content, Rule 3(3) is not aimed at you. If it lets users generate, upload, transform or share media, work through the obligations below.

• Rule 3(3)(a)(i) — deploy reasonable and appropriate technical measures, including automated tools, so users cannot create or share unlawful SGI. The Rule expressly names child sexual exploitative and abuse material, non-consensual intimate imagery and obscene or sexually explicit content invasive of bodily privacy; SGI creating false documents or false electronic records; SGI relating to preparation, development or procurement of explosive material, arms or ammunition; and SGI falsely depicting a natural person or a real-world event by misrepresentation likely to deceive, including of identity, voice, conduct, action or statement.
• Rule 3(3)(a)(ii) — where SGI is not in a prohibited category, label it. Visual and audio-visual content must carry a label or notice that is prominently visible in the display. Audio must carry a prominently prefixed audio disclosure. In both cases embed permanent metadata or a technical provenance mechanism, to the extent technically feasible, including a unique identifier that allows the content to be identified as SGI and identifies the computer resource used to create or alter it.
• Rule 3(3)(b) — do not enable modification, suppression or removal of the label, the embedded metadata or the unique identifier. MeitY's FAQ gives "remove watermark" and "export without metadata" as functions an intermediary should not offer.
• Rule 3(1)(ca) — an intermediary offering a computer resource that enables SGI creation must warn users that violations involving unlawful SGI may attract penalties or punishment under the IT Act and other laws, prominently and at onboarding as well as periodically.

The 2026 amendments cut several existing deadlines. If your terms of use or grievance page still quote the older periods, they are now wrong.

New Rule 4(1A) requires a significant social media intermediary, before allowing a user to display, upload or publish information, to obtain a declaration from the user as to whether the content is SGI, to deploy reasonable and appropriate technical measures including automated tools to verify the correctness of that declaration before publication, and where SGI is confirmed, to display it with a clear and prominent label. Self-declaration alone is not sufficient. Under the proviso, an intermediary that knowingly permits, promotes or fails to act on SGI in contravention of the Rules is deemed to have failed to exercise due diligence.

The amendments also clarify that removing or disabling access to information, including through automated tools, in compliance with the Rules does not by itself breach the conditions in Section 79(2)(a) or 79(2)(b) of the IT Act.

• MeitY published the India AI Governance Guidelines — Enabling Safe and Trusted AI Innovation on 5 November 2025 under the IndiaAI Mission. These are guidance, not binding rules, and the stated approach is to rely on existing law rather than a dedicated AI statute in the near term.
• MeitY issued an advisory to intermediaries on AI models and generative AI on 15 March 2024 under the IT Act and the IT Rules, 2021; it was revised in supersession of the earlier text. Advisories are not rules, but they indicate the regulator's expectations on labelling and user information.
• The Reserve Bank of India released the report of its committee on a Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial Sector on 13 August 2025. Regulated entities in finance should read it alongside RBI's outsourcing and IT governance directions.
• IS/ISO/IEC 42001:2023, the AI management system standard, has been adopted by the Bureau of Indian Standards. Certification is voluntary and does not substitute for statutory compliance, but it is a recognised way to evidence governance.

Training on, or inference over, personal data is processing. The DPDP Act applies in full: a Section 5 notice describing the purpose, consent obtained for that purpose under Section 6, purpose and storage limitation, security safeguards under Section 8(5), breach notification under Section 8(6), and the rights of access, correction and erasure in Sections 11 to 13. A chatbot or assistant that receives personal data typed by a user is collecting personal data, and where a third-party model provider processes it, that provider is a Data Processor who must be engaged under a valid contract under Section 8(2).

• State in your privacy policy which AI features exist, what data they receive, and who the model provider is.
• If users can generate or transform media on your site, label the output as synthetically generated and embed provenance metadata with a unique identifier.
• Do not offer functions that strip that label or metadata.
• Warn users at signup, and periodically, that unlawful synthetic content can attract penalties under the IT Act.
• Deploy filtering against the prohibited categories in Rule 3(3)(a)(i) if users can generate media.
• Update your terms of use and grievance page to the 3-hour, 2-hour, 36-hour and 7-day timelines, and refresh user notices at least quarterly.
• For an AI chatbot, do not let it give assurances your business cannot honour — the Consumer Protection Act, 2019 applies to representations made by your interface.
• Keep a record of the model, version and prompt-handling arrangements for each AI feature; it is the evidence of due diligence if questioned.