Vishwamitra Insight
Issue #056
Six months after New Delhi compressed unlawful-content takedowns from thirty-six hours to three, the real change is not the clock. It is the conversion of Safe Harbour from a default shield into a privilege that platforms keep only if they enforce the state’s digital border in real time.
By Santhosh Vishwamitra
Executive Memorandum
On 10 February 2026, MeitY notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E)). They took effect on 20 February 2026. The amendment inserts a statutory definition of Synthetically Generated Information, folds that category into the existing meaning of “information,” and ties due diligence for SGI to continued protection under Section 79 of the IT Act, 2000.
The central benefit is speed and visibility: a three-hour window after a court order or reasoned government intimation, a two-hour window for complaints about non-consensual intimate imagery and related bodily-privacy harms, and a requirement that lawful synthetic audio-visual content carry a prominent label plus permanent provenance metadata.
The central concern is structural. Platforms no longer sit as passive hosts waiting for “actual knowledge.” They are expected to deploy technical measures, verify user declarations on Significant Social Media Intermediaries, and treat failure to act on known unlawful SGI as a due-diligence breach. That is a shift in who holds the border of the Indian information space.
Introduction
A deepfake does not wait for a legal department. A cloned voice can move through a messaging group before a compliance team in another time zone has opened the ticket. That mismatch between the speed of synthetic media and the old thirty-six-hour takedown window is the problem the 2026 amendment was written to close.
The policy question is larger than content moderation. It is whether a large democracy can force globally designed platforms to treat Indian law as an operating constraint rather than a downstream request. Safe Harbour under Section 79 was designed for a world in which intermediaries transmitted other people’s speech. Synthetically generated audio and video collapse the distance between tool, publisher, and harm. The amendment tries to close that distance by making due diligence a live condition, not a policy page.
The tension is familiar and unresolved: state capacity versus platform architecture, user safety versus over-removal, sovereignty versus the design choices of firms that serve hundreds of millions of Indian users from another time zone.
Context
India already had an intermediary framework. The IT Rules, 2021, later amended in 2022, 2023, and October 2025, required due diligence, grievance officers, and removal of specified unlawful categories once a platform had actual knowledge. The Supreme Court’s reading of Section 79 in Shreya Singhal v. Union of India still matters: “actual knowledge” is not a private complaint by itself. It is a court order or a government direction.
What changed between 2023 and early 2026 was not the existence of harmful content. It was the cost of producing it. Voice cloning, face-swap tools, and image models made impersonation, non-consensual intimate imagery, fake endorsements, and fabricated event footage cheap enough to industrialise. MeitY’s October 2025 draft proposed a broad definition of synthetic information and a rigid labelling rule: a mark covering at least 10 percent of a visual surface, or a disclaimer running through the first 10 percent of an audio clip.
Industry bodies, including Nasscom and IAMAI members, argued that a fixed-percentage watermark was unworkable across formats and would catch routine edits. The notified text of 10 February 2026 accepted part of that critique. The final definition is limited to audio, visual, or audio-visual material that appears real and is likely to be perceived as indistinguishable from a person or a real event. Text-only AI output is outside SGI. Routine good-faith editing, colour correction, compression, accessibility work, and ordinary document design are carved out where they do not misrepresent substance.
The 10 percent metric did not survive. The final standard is qualitative: labels must be prominent, easily noticeable, and adequately perceivable. Audio SGI must carry a prefixed audio disclosure. Permanent metadata or another provenance mechanism, including a unique identifier of the computer resource used, must be embedded where technically feasible, and intermediaries must not enable its removal.
The government presented the package as a response to user harm and national integrity, not as a speech code. That official framing should be recorded as a claim. Whether compressed clocks and metadata duties produce safer networks or merely more cautious platforms is an empirical question the first six months only begin to answer.
What the Amendment Actually Does
The definition that does the work
Synthetically Generated Information is not a synonym for every AI output. Two limbs must both be met: the material must appear authentic, and it must depict a person or event in a way that can be mistaken for reality. A clearly labelled cartoon, a stylised illustration, or a text summary generated by a language model does not become SGI merely because a model was used.
Rule 2(1A) then does something quieter and more consequential. It states that references to “information” used to commit unlawful acts include SGI. Synthetic media is not a parallel statute. It rides the existing unlawful-content machinery of Rule 3(1)(b), Rule 3(1)(d), and the Significant Social Media Intermediary duties in Rule 4.
Two clocks, not one
Public discussion often collapses the timelines. They are distinct.
| Trigger |
Content |
Old window |
New window |
Rule |
| Court order or reasoned government intimation |
Unlawful information, including SGI |
36 hours |
3 hours |
Rule 3(1)(d) |
| User complaint on specified sensitive categories |
Nudity, sexual imagery, morphed or non-consensual intimate content, and related impersonation covered by the clause |
24 hours |
2 hours |
Rule 3(2)(b) |
| Grievance on prohibited categories under Rule 3(1)(b) |
Specified unlawful content |
72 hours |
36 hours |
First proviso to Rule 3(2)(a)(i) |
| Ordinary grievance |
Other complaints |
15 days |
7 days |
Rule 3(2)(a)(i) |
The three-hour clock is not a general user-report SLA. It starts when the platform receives actual knowledge in the Shreya Singhal sense: a court order or a reasoned written intimation from an authorised officer. The two-hour clock is a grievance clock for a narrow band of bodily-privacy and impersonation harms. Mixing the two produces the false impression that every deepfake on the internet must vanish in 180 minutes.
Due diligence as a live condition
New Rule 3(3) requires intermediaries that enable creation, modification, or dissemination of SGI to deploy reasonable and appropriate technical measures, including automated tools, so that users cannot generate or circulate SGI that violates existing law. Prohibited categories include child sexual exploitation material, non-consensual intimate imagery, false electronic records, and deceptive portrayals of persons or events where the law already forbids them.
Lawful SGI must be labelled and fingerprinted. Rule 4(1A) then places extra duties on Significant Social Media Intermediaries: obtain a user declaration on whether content is SGI, use technical measures to verify that declaration before publication, and display a clear label when the content is synthetic. Knowingly permitting, promoting, or failing to act on SGI in breach of the rules is deemed a failure of due diligence.
That last sentence is the Safe Harbour hinge. Section 79 immunity is conditional. It is not withdrawn by a separate ministerial decree each time a clip slips through. It lapses when the statutory conditions are not met. Rule 2(1B) offers a limited shield in the other direction: removing or disabling SGI with reasonable technical measures in compliance with the Rules will not, by itself, be treated as a breach of the hosting conditions in Section 79(2). Platforms are pushed to act, and then told that acting will not automatically make them publishers.
Traceability as a geopolitical instrument
Permanent metadata and a unique identifier tied to the computer resource used to create or alter the file are not merely consumer-protection labels. They are an attempt to make synthetic media attributable inside Indian jurisdiction. A watermark a user can crop away is a courtesy. A provenance mark the platform is forbidden to let users strip is an enforcement design.
Compared with the European Union’s risk-tiered AI Act, India’s model is timeline-centric and intermediary-centric. Brussels classifies systems by risk and imposes obligations on providers of general-purpose models. New Delhi classifies content by harm and imposes obligations on the hosts and tools that put that content in front of Indian users. One regime regulates the factory. The other regulates the warehouse and the shopfront. Both claim user protection. They allocate power differently.
The overlooked mechanism is not the label. It is the linkage: SGI is defined, then folded into “information,” then attached to due diligence, then attached to Section 79. Remove any one of those four steps and the amendment becomes a guidance note. Keep all four and Safe Harbour becomes a performance contract.
Evidence from the First Six Months
The rules have now been in force since 20 February 2026. Public evidence of operational change is uneven, which is itself a finding. Gazette text travels faster than engineering roadmaps.
What can be stated with confidence:
- The legal baseline is no longer ambiguous. SGI is a defined term. The three-hour and two-hour clocks are in the notified text, restated in MeitY FAQs dated 10 February 2026, and repeated in later government briefings.
- The draft’s 10 percent labelling rule is not law. Analyses from Freshfields, Khaitan & Co, JSA, Nasscom, MediaNama, and Indian Express all record the same change from numeric threshold to a prominence standard.
- Safe Harbour remains the enforcement lever. PIB and later official statements in August 2026 restated that failure to observe IT Rules obligations can cost an intermediary the Section 79 exemption and expose it to action under applicable law.
- Government research funding for detection, including multi-institution deepfake detection projects cited in official material, shows New Delhi is not relying on platform goodwill alone. Detection capacity inside the state is being built in parallel.
What cannot yet be treated as settled:
- How often the three-hour clock is actually started by a valid government intimation rather than by informal pressure.
- Whether SSMI declaration-and-verify systems catch a meaningful share of undeclared SGI, or whether users simply tick a box.
- The volume of over-removal of lawful satire, parody, and political speech that uses synthetic techniques without crossing the “indistinguishable from reality” threshold.
- The compliance gap between large SSMIs with Indian grievance teams and smaller intermediaries that received their first formal notice after 20 February.
Absence of a published, platform-by-platform compliance ledger after six months is a limitation of the public record, not proof that nothing changed. Law-firm briefings and industry notes after 10 February show firms rewriting internal playbooks. Whether live systems match the letter of Rule 3(3) and Rule 4(1A) is harder to audit from outside.
Competing Perspectives
The sovereignty view. Supporters treat the amendment as overdue alignment of law with technology. A state that cannot compel removal of a fabricated riot clip or a non-consensual intimate deepfake within hours does not control its information space. Labels and metadata are the minimum price of operating a synthesis tool in that space. On this view, Section 79 was never a human right of corporations. It was a bargain: immunity in exchange for due diligence. The bargain has been repriced.
The intermediary view. Platforms argue that a three-hour government-order clock, applied across time zones, forces either 24-hour legal benches in India or automated over-blocking. Verification of user declarations at SSMI scale is probabilistic. False negatives leave harmful SGI up. False positives suppress lawful speech. Permanent metadata also raises a separate fight: how much identity of the generating system must be stored, and who can demand it.
The rights view. Civil-liberties critics accept the harm of NCII and CSAM and still worry about the combination of shortened clocks and “reasoned intimations” from government officers. Compression of time reduces the chance of meaningful internal review before content disappears. If political speech can be dressed as deceptive SGI, a three-hour duty becomes a prior-restraint machine in practice even if the statute still requires unlawfulness.
These are not three versions of the same complaint. They disagree on who should absorb error: the user who is impersonated, the speaker whose clip is pulled, or the platform that must guess under a clock.
Counterarguments and Limitations
The amendment does not repeal Shreya Singhal. The three-hour duty still needs a court order or a reasoned government intimation for the Rule 3(1)(d) clock. That is a real constraint. It is also a thinner constraint than it looks, because the quality of “reasoned” intimations is not independently audited in public.
The rules do not ban synthetic media. Lawful SGI may circulate if labelled. Satire that is obviously not a real person or a real event sits outside the definition. That carve-out is genuine. Its usefulness depends on whether automated classifiers can tell a parody from an impersonation at the speed the grievance clocks now demand.
Safe Harbour is not formally abolished. Rule 2(1B) even tries to protect automated takedowns done in compliance with the Rules. The practical risk is different: immunity becomes so tightly coupled to technical performance that a single missed NCII complaint, or a failed metadata implementation, can be argued as a systemic due-diligence failure. That argument will be tested in courts. It has not been settled by the gazette.
Implementation capacity is uneven. A two-hour NCII window assumes staffed grievance channels, working hash-matching, and the ability to distinguish a complaint that meets the clause from one that does not. Those conditions are closer to true for the largest SSMIs than for smaller hosts. A rule that only the largest firms can obey becomes, in effect, a barrier to entry dressed as safety policy.
International comparison should stay modest. India’s model is unusually fast on takedown clocks among large democracies. It is not “the world’s first AI law.” It is a targeted amendment to an existing intermediary code. Overclaiming originality weakens the analysis.
Implications
For ordinary users, the visible change should be labels on realistic synthetic clips and faster action on intimate-image abuse. The less visible change is a thicker layer of automated filtering before a post goes live on large platforms. Some harmful content will be stopped. Some lawful content will be slowed or dropped because the cost of a miss now includes Section 79 risk.
For businesses, especially firms that sell generation tools into the Indian market, Rule 3(3) is the operational document. If the product can produce a face or a voice that looks real, the product is inside the due-diligence perimeter. Labelling, anti-stripping controls, and blocks on prohibited categories are no longer optional product features.
For global platforms, India has restated a doctrine it has used in other digital fights: access to the Indian user base is conditional on local legal time. The three-hour clock is a jurisdictional fact wearing the clothes of content policy. Firms that already run India-specific stacks for payments, maps, or app stores now face an India-specific stack for synthetic media.
For other governments in the Global South, the template is exportable: define the content, attach it to existing intermediary duties, compress the clock, and let Safe Harbour do the enforcement. That template will attract states that lack Brussels-style regulatory manpower and do not want to wait for model-level audits.
Second-order effects follow. Provenance metadata can aid victims and investigators. The same metadata can become a demand surface for law-enforcement access that goes beyond the original harm. Compressed grievance clocks can protect a person whose face was stolen. They can also train platforms to treat political controversy as a latency problem. Both outcomes are compatible with the same statutory text.
The Vishwamitra Verdict
India’s 2026 SGI amendment is a serious piece of statecraft wrapped in an intermediary rule. It is not a moral sermon about artificial intelligence. It is a redesign of liability so that platforms cannot claim ignorance while running the pipes through which synthetic impersonation travels.
The design is coherent. Definition, inclusion in “information,” technical due diligence, SSMI verification, compressed clocks, and Section 79 as the penalty for failure form a single chain. The October draft’s 10 percent watermark was the loud piece. The quiet piece, Safe Harbour as a performance condition, is the one that will matter in 2027.
The policy is not costless. Speed without published audit trails invites both under-enforcement against well-connected speakers and over-enforcement against everyone else. A qualitative labelling standard is more workable than a 10 percent box, and also easier to satisfy with a badge nobody notices. Metadata that cannot be stripped is only as good as the systems that write it at generation time, including tools that never touch an Indian server.
On the central question, the balance of power has moved. Global platforms still design the product. The Indian state now writes the service-level agreement for synthetic media on that product, and it has attached the oldest prize in intermediary law, immunity, to compliance with that agreement. That is the structural change. The rest is implementation.
Conclusion
Six months is long enough to read the statute and too short to declare victory over deepfakes. The amendment did what a capable regulator can do with existing machinery: it named the object, shortened the clock, and repriced immunity.
Readers should watch three tests, not the next celebrity clip. First, whether government intimations that start the three-hour clock are published in some accountable form. Second, whether SSMI verification catches undeclared SGI at a rate that justifies the burden. Third, whether courts treat a single operational miss as a Section 79 failure or demand a pattern.
Until those tests produce evidence, the honest position is limited. India has asserted digital sovereignty over synthetic audio-visual media through intermediary law. The assertion is real. The quality of the border it creates is still being built.
Our Approach
We aim to present global events with clarity, accuracy, and balance without taking sides. Every article is based on credible sources and verified information.
We do not follow the "breaking news" race. Instead, we focus on delivering thoughtful analysis and meaningful perspective on important developments.
If you notice any errors, feel free to reach out. We follow a transparent correction and update policy to ensure all changes are clearly reflected for our readers.
Sources
- Ministry of Electronics and Information Technology, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, G.S.R. 120(E), 10 February 2026; in force 20 February 2026. Gazette and MeitY document pages.
- MeitY, FAQs on amendments relating to Synthetically Generated Information, 10 February 2026.
- Press Information Bureau / official government briefings restating three-hour and two-hour timelines and Section 79 consequences, including August 2026 statements.
- Legal analyses: Argus Partners overview (20 February 2026); Freshfields briefing on key changes and the dropped 10 percent label rule; Veritas Legal clause analysis; Deloitte tax/tech note on revised timelines; JSA and Khaitan & Co client notes on draft-to-final differences.
- Reporting: The Indian Express, Mint, ThePrint, MediaNama, Economic Times on notification, labelling standard, and compressed clocks.
- Shreya Singhal v. Union of India, Supreme Court of India (2015), on actual knowledge and Section 79.
Follow The Dispatch
Vishwamitra Chronicles Network
Original reporting on science, geopolitics, and history.
Santhosh Vishwamitra
A developer, analyst, and the Founder & Editor of Vishwamitra Chronicles, dedicated to independent, evidence-based research on geopolitics, science, and history. - About the Author
Comments
Post a Comment