iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, AI is regulated in India, but not by one all-purpose AI Act. As of 25 October 2026, the applicable framework is distributed across the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as amended in 2026, and the Digital Personal Data Protection (DPDP) Rules, 2025. The duties depend on what an organization does, whether it is an intermediary or significant social media intermediary, whether its service handles realistic synthetic media, and whether it processes personal data. The 2026 IT Rules amendments specifically address realistic synthetic audio, visual and audiovisual content, while MeitY guidance also discusses safeguards for AI platforms. Businesses should classify their role and use case before deciding which controls apply; consumers should not assume that every AI-generated item will be labelled or that every complaint has the same remedy.
Is AI regulated in India through one dedicated law?
No. India’s current approach uses existing, technology-neutral law plus targeted amendments and data-protection rules. The Ministry of Electronics and Information Technology (MeitY) states that the Information Technology Act, 2000 applies to computer resources, including AI-enabled systems. Intermediary duties arise under the IT Rules, 2021, and the 2026 amendments add provisions dealing with synthetic audio, visual and audiovisual material. Personal-data processing is a separate compliance track under the DPDP Act and the DPDP Rules, 2025.
This structure means two companies using the same model can face different duties. A platform hosting user uploads may be an intermediary; a large social network may also be a significant social media intermediary (SSMI); a company using an AI tool internally may primarily need to address privacy, contracts, security and sector-specific rules. The sources reviewed do not support a blanket rule that every business using generative AI has identical obligations.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat changed in the 2026 IT Rules amendments?
MeitY’s FAQ identifies the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified as G.S.R. 120(E) on 10 February 2026 and stated to have come into force on 20 February 2026. The amendment introduces the “synthetically generated information” (SGI) concept and adds due-diligence requirements, with additional duties for SSMIs.
#1 Best Overall
| Date or instrument | What it establishes | How to use it |
|---|---|---|
| Information Technology Act, 2000 | Technology-neutral legal foundation covering computer resources, including AI systems. | Start by identifying the service, conduct and intermediary status under the Act and Rules. |
| IT Rules, 2021, as amended | Intermediary due diligence, grievance and content-related duties. | Apply the notified legal text to the organization’s actual role and activities. |
| G.S.R. 120(E), 10 February 2026 | Amendment notification identified by MeitY for SGI and related due diligence. | Use the effective-date statement and the notified amendment, not a summary alone. |
| 20 February 2026 | Effective date stated in MeitY’s FAQ for the 2026 amendment rules. | Review content and workflows operating from this date onward. |
| DPDP Rules, 2025, 14 November 2025 | Official MeitY listing records publication of the data-protection rules. | Check the current commencement schedule and provisions before relying on a deadline. |
MeitY expressly warns that its FAQ is explanatory rather than binding. Its 10 February 2026 FAQ says: “The FAQ is not a legal document and in no way whatsoever replaces, amends or alters any part of the IT Act/ IT Rules, 2021 (as amended).” For compliance decisions, read the notified rules and any current MeitY material.
Who can be affected by India’s AI rules?
The actor, content, conduct and data involved determine the practical exposure. The following distinctions are more useful than asking whether a company is simply an “AI company.”
| Actor | Typical activity | Issues to assess |
|---|---|---|
| Intermediary | Hosts, transmits or enables access to information supplied by users. | IT Rules due diligence, unlawful-content handling, notices, grievance processes and any SGI duties triggered by the service. |
| Significant social media intermediary | Operates a service that meets the SSMI threshold under the IT Rules. | Additional declarations, technical verification, prominent labelling and other enhanced due diligence described by MeitY. |
| AI service provider | Offers a model, API, chatbot, image tool or other AI platform. | Whether it is an intermediary or computer resource, what safeguards it uses, and how it handles unlawful or misleading outputs. |
| Business user | Deploys an external or internal model for marketing, support, hiring, analysis or operations. | Personal-data processing, confidentiality, accuracy, human review, contractual allocation of responsibility and sector rules. |
| Consumer or creator | Creates, uploads, forwards or reports synthetic media. | Platform terms, disclosure expectations, privacy and defamation risks, and available grievance channels. |
What counts as synthetically generated information?
Under the explanation summarized in MeitY’s FAQ, SGI is limited to audio, visual or audiovisual information that is made or altered to appear real or authentic and is likely to be perceived as indistinguishable from a real person or event. Pure written text, by itself, is not SGI under that definition. Text accompanying a synthetic video or audio file can still matter when the conduct involves an unlawful act.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Examples likely to fall within the concept
- A generated video that makes a real person appear to say something they never said.
- An altered recording presented as an authentic event.
- A realistic synthetic voice or face used in a clip that could reasonably be mistaken for genuine.
Examples MeitY’s FAQ says are excluded when conditions are met
- Noise reduction or comparable technical clean-up that does not materially manipulate the underlying meaning.
- Adding captions or translating content without material manipulation.
- Formatting a document or making accessibility-oriented changes that do not create a false impression of an event or person.
The exclusion is not a blanket safe harbour. The notified rules control, and the facts, presentation and likely audience perception matter. A routine edit can become problematic if it is used to make a real event appear different or to mislead viewers.
What must intermediaries do about realistic synthetic media?
MeitY’s FAQ describes a layered approach rather than a single labelling rule for every AI output. An intermediary should first determine whether the material is SGI, whether it is unlawful, and whether the service qualifies as an SSMI.
Core controls described for intermediaries
- Prevention and response: Take measures aimed at preventing unlawful SGI and respond to notices through the applicable due-diligence and grievance mechanisms.
- Disclosure for permitted material: Use labels or provenance identifiers for SGI that is allowed to remain available, in the manner required by the notified rules.
- Time-sensitive handling: Account for tightened response timelines described in the amendments rather than relying on a generic moderation queue.
- Recordkeeping: Preserve the classification, notice, action and escalation history needed to demonstrate how a complaint was handled.
Additional SSMI expectations
For significant social media intermediaries, MeitY’s FAQ describes stronger declarations, technical verification and prominent labelling. An SSMI should therefore test how labels appear on mobile and desktop interfaces, how provenance survives downloads or reposts, and how users can challenge an incorrect classification. The exact thresholds and wording must be taken from the notified rules.
Does MeitY’s AI advisory create a universal AI code?
No. The February 2026 advisory applies existing IT Act and intermediary duties to AI platforms and focuses on unlawful or misleading religious content. It urges practical safeguards such as moderation, human oversight, culturally informed review, and examination of training data, model outputs and grievance systems.
These are important risk-management directions for an AI platform operating in the covered context, but the advisory is not a comprehensive statute that imposes every listed operational recommendation identically on every business. A company should document which parts relate to its role, audience, content and risk profile, then map those controls to the binding Act and Rules.
What does the DPDP Act mean for AI systems?
The DPDP regime is the privacy workstream, separate from the SGI provisions. An AI product can trigger data-protection questions when it collects prompts, uploads, voice recordings, images, identifiers, employee information, customer records or inferred profiles. The official MeitY listing records publication of the DPDP Rules, 2025, on 14 November 2025.
The materials reviewed here do not establish the complete phased commencement schedule, every entity-specific duty or a full checklist for a particular AI deployment. Do not infer that publication alone makes every provision immediately enforceable, or that a model’s provider automatically bears all responsibility for a customer’s use.
Practical privacy questions before deployment
- List every personal-data field entering prompts, fine-tuning files, logs, evaluation sets and support tickets.
- Identify the organization deciding why the data is processed and the providers processing it on that organization’s behalf.
- Check notices, consent or other permitted grounds, retention, deletion, security and individual-request procedures under the current DPDP requirements.
- Decide whether data can be minimized, de-identified or kept out of model training and telemetry.
- Verify the current commencement notification and any sector-specific privacy requirements before setting a compliance deadline.
How should a business build an AI-compliance process?
A defensible process starts with a written inventory, not with a generic “AI policy.” Use the following sequence for each product, workflow or experiment.
- Describe the use case: Record the model, inputs, outputs, users, jurisdictions, publication channels and whether the system creates, edits, hosts or merely analyzes content.
- Classify the organization: Decide whether the service is an intermediary, an SSMI, an AI platform operating a computer resource, a business user, or more than one of these.
- Classify the output: Mark realistic audio, visual and audiovisual material separately from pure text and from routine accessibility or formatting edits.
- Map personal data: Document collection, prompts, training, inference, logging, vendors, transfers, retention and deletion.
- Set human review: Define when a trained reviewer must approve publication, investigate a complaint, assess cultural context or stop an automated response.
- Implement provenance and notices: For permitted SGI, design labels or identifiers that remain visible in the user interface and survive ordinary sharing where the rules require it.
- Build grievance and escalation paths: Publish contact points, assign owners, track deadlines and preserve decisions, notices and evidence.
- Test before release: Run realistic impersonation, misleading-context, accessibility-edit and privacy scenarios; retest after model, prompt, vendor or interface changes.
- Monitor legal updates: Check the latest notified IT Rules, MeitY FAQ or advisory, DPDP commencement notices and any regulator or sector guidance.
What do Indian consumers need to know?
Consumers are most likely to encounter the framework through platform labels, provenance indicators, moderation and grievance handling. A realistic synthetic clip may receive a label or other identifier, while a routine caption, translation or noise-reduction edit may not. The presence or absence of a label is not, by itself, proof that content is genuine or unlawful.
If you see suspicious synthetic media
- Save the URL, account name, date, screenshots and the original file if available.
- Use the platform’s reporting or grievance channel and describe the specific impersonation, deception, privacy or unlawful-content concern.
- Do not amplify the clip while investigating; forwarding it can increase harm and create additional legal or platform-policy issues.
- Escalate through the platform’s published process if the first response is incomplete, keeping the ticket number and timestamps.
The amendments tighten some response timelines, but the applicable remedy depends on the platform, the content and the facts. No source reviewed supports a promise that every consumer complaint will produce removal or that every AI-generated item will carry a label.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What are the most common compliance mistakes?
| Mistake | Why it fails | Better approach |
|---|---|---|
| Treating every AI output as SGI | The definition focuses on realistic synthetic audio, visual or audiovisual information, not all machine-generated material. | Classify the medium, realism, presentation and likely audience perception. |
| Assuming the FAQ is the law | MeitY says the FAQ does not replace or alter the Act or Rules. | Use the notified text for thresholds, wording, exceptions and deadlines. |
| Applying SSMI controls to every startup | Enhanced duties attach to the relevant category, not simply to the use of an AI model. | Determine intermediary and SSMI status from the current rules. |
| Combining privacy and content compliance | SGI duties and DPDP obligations address different risks and triggers. | Run a content/intermediary assessment and a separate personal-data assessment. |
| Relying on automated moderation alone | Context, culture, impersonation and misleading presentation can defeat a simple classifier. | Use documented human escalation and culturally informed review where risk warrants it. |
What remains uncertain, and where should you verify?
India’s framework is still developing and the available explanatory material is not a substitute for legal text. The sources considered here do not resolve every sectoral rule, the complete DPDP commencement schedule, or the application of the regime to a particular model, dataset or business structure. Check the current notified IT Act and IT Rules, the latest MeitY materials, DPDP commencement notifications and any applicable sector regulator before making a high-stakes decision.
For most organizations, the immediate practical answer is to inventory AI uses, identify intermediary and SSMI status, separate realistic synthetic media from ordinary edits, map personal data, and assign owners for labels, moderation, grievances and legal updates. That approach is more reliable than asking whether a single “AI law” applies to the company as a whole.
Frequently Asked Questions
Do India’s 2026 AI rules regulate model training itself?
The materials summarized here focus on intermediary due diligence, realistic synthetic media and safeguards for AI platforms; they do not establish a general training-compute or model-training licensing regime. Training can still involve privacy, intellectual-property, security or sector obligations that must be assessed separately.
Best Value
Can a company outside India ignore these requirements if its model is hosted abroad?
Location of hosting alone does not answer the question. Examine where the service is offered, which users and intermediaries are involved, what content is handled and whether Indian law applies to the activity; obtain advice on the specific structure before relying on a territorial assumption.
What evidence should a platform keep after removing or labelling synthetic media?
Keep the notice or detection signal, content snapshot or hash, classification rationale, reviewer or system action, user communication, timestamps and appeal outcome. Retain it under a documented schedule that also respects applicable data-minimization and deletion duties.
Are accessibility edits always outside the synthetic-media rules?
No automatic exemption should be assumed. MeitY’s FAQ gives captions, translation without material manipulation, noise reduction and document formatting as examples of excluded activity when stated conditions are met; the notified rules and the actual presentation determine the result.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
