The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 govern AI-generated content and takedown times for every Indian platform. They cut the takedown limit from thirty-six hours to three.
Quick Take
- MeitY notified G.S.R. 120(E) on February 10, 2026. It took effect on February 20, 2026.
- Takedown after a valid order dropped from 36 hours to 3 hours.
- Complaints about morphed or intimate images must be acted on within 2 hours.
In This Article
- Is your startup an intermediary under the IT Rules?
- What are the new takedown clocks in 2026?
- What counts as synthetically generated information?
- What must an AI product do about labelling?
- What extra duties fall on a significant social media intermediary?
- Can a user appeal your moderation decision?
- What happens if you miss a deadline?
- The compliance checklist for 2026
MeitY is the Ministry of Electronics and Information Technology. It notified the amendment on February 10, 2026 and gave platforms ten days to comply.
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 have carried these duties since 2021. The 2026 amendment shortened almost every clock in them.
Is your startup an intermediary under the IT Rules?
An intermediary is any person who receives, stores, sends or provides a service on behalf of another person. Web hosts, search engines, marketplaces and payment sites are all intermediaries.
Rule 3 applies to every intermediary. It does not carry a user threshold, a revenue floor or a headcount test.
A ten-person startup with a comments section is covered. So is a job board, a review site and a file sharing tool.
Rule 4 adds heavier duties for a significant social media intermediary. That label applies only above a user threshold notified by the Central Government.
Rule 6 gives MeitY a further power. The ministry may order any intermediary that is not a significant social media intermediary to follow the Rule 4 duties anyway.
That order needs a written reason and a finding of material risk of harm. It is a real risk for a fast-growing consumer app.
What are the new takedown clocks in 2026?
The 2026 amendment shortened five separate timelines. The table below sets out what changed.
| Obligation | Old limit | New limit | Rule |
|---|---|---|---|
| Remove content after a court order or government intimation | 36 hours | 3 hours | 3(1)(d) |
| Act on a complaint about nudity, a sexual act, impersonation or a morphed image | 24 hours | 2 hours | 3(2)(b) |
| Resolve a takedown request raised as a grievance | 72 hours | 36 hours | 3(2)(a) |
| Resolve any other user grievance | 15 days | 7 days | 3(2)(a) |
| Remind users of the consequences of breaking your terms | Once a year | Every 3 months | 3(1)(c) |
The three-hour clock starts only on actual knowledge. Rule 3(1)(d) now defines that narrowly.
Actual knowledge arises from a court order, or from a written and reasoned intimation by an authorised officer. That officer must be at least a Joint Secretary, or a Director where no Joint Secretary is appointed.
Where the police issue the intimation, the officer must be at least a Deputy Inspector General of Police. A random email from a stranger does not start the clock.
Two older duties did not change. An intermediary must preserve removed content for 180 days, and must answer a lawful government request for information within 72 hours.
What counts as synthetically generated information?
Rule 2(1)(wa) defines synthetically generated information as audio, visual or audio-visual content made or altered by a computer resource so that it looks real. It must also portray a person or event in a way likely to be seen as indistinguishable from the real thing.
The definition is often shortened to SGI. Text is not included. The rule covers audio, images and video.
Three uses sit outside the definition. The first is routine or good-faith editing, formatting, colour correction, noise reduction, transcription or compression that does not change the meaning.
The second is routine document work. Making a deck, a PDF, a training module or a template does not create SGI, as long as no false document results.
The third is accessibility work. Translation, description, captioning and searchability improvements are outside the definition.
MeitY dropped an earlier proposal from its October 22, 2025 draft. That draft would have forced a watermark covering at least 10% of the visual surface area.
What must an AI product do about labelling?
Rule 3(3) applies to any intermediary whose product lets a user create, alter or share synthetically generated information. That covers most Indian generative AI startups.
Such an intermediary must deploy technical measures to stop users producing unlawful SGI. The rule names child sexual abuse material, non-consensual intimate imagery, false documents, and content relating to explosives, arms or ammunition.
Lawful SGI must be labelled. Visual output needs a label with prominent visibility that is easily noticeable and adequately perceivable.
Audio output needs a prominently prefixed audio disclosure. That means the disclosure comes first, before the content.
Rule 3(3)(a)(ii) adds a provenance duty. The output must carry permanent metadata or a unique identifier, to the extent technically feasible, that identifies the computer resource used to make it.
Rule 3(3)(b) closes the obvious loophole. The intermediary must not build any feature that lets a user strip the label or the metadata.
Rule 4(1A) goes further for a significant social media intermediary. It must ask uploaders to declare whether content is synthetic, deploy tools to check that declaration, and label anything the check confirms.
What extra duties fall on a significant social media intermediary?
A significant social media intermediary must appoint three named people in India. Rule 4(1) lists a Chief Compliance Officer, a nodal contact person and a Resident Grievance Officer.
The Chief Compliance Officer carries personal liability. Rule 4(1)(a) makes that officer answerable in proceedings where the platform failed to do its due diligence.
The nodal contact person handles 24×7 coordination with law enforcement. All three must be resident in India.
Rule 4(1)(d) adds a monthly compliance report. It must list complaints received, action taken, and how many links the platform removed through its own proactive monitoring.
Rule 4(4) requires proactive detection tools for two categories. The first is content depicting rape or child sexual abuse. The second is content identical to something already removed under Rule 3(1)(d).
Those tools need human oversight. Rule 4(4) also requires a periodic review of accuracy, bias and the effect on user privacy.
Rule 4(8) protects the user. Before a significant social media intermediary removes content on its own accord, it must tell the user the reason and give a route to dispute it.
Can a user appeal your moderation decision?
Yes. Rule 3A lets a user who is unhappy with your Grievance Officer appeal to a Grievance Appellate Committee.
The Central Government appoints each committee. It has a chairperson and two whole-time members, of whom one is ex-officio and two are independent.
The user has 30 days from your Grievance Officer’s reply to file. The committee aims to decide within 30 calendar days.
A user may also appeal where your Grievance Officer said nothing at all inside the seven-day window. Silence is appealable.
The whole process runs online. Rule 3A(6) requires digital filing through to decision.
Rule 3A(7) is the part founders miss. Every order of the Grievance Appellate Committee must be complied with, and a report on that compliance must be uploaded to your own website.
What happens if you miss a deadline?
Rule 7 removes safe harbour. An intermediary that fails to observe these rules loses the protection of section 79(1) of the Information Technology Act, 2000.
Losing safe harbour means the platform can be treated as the publisher of what its users posted. Liability then runs under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023.
The 2026 amendment also added a protection worth knowing. Rule 2(1B) says that removing content in order to comply does not by itself break safe harbour.
Before the amendment, platforms worried that active moderation would cost them their intermediary status. Rule 2(1B) settles that question.
The compliance checklist for 2026
- Name a Grievance Officer and publish the name and contact details on your home page or one click from it.
- Build a route that can act on a two-hour complaint outside office hours.
- Set a quarterly reminder to send users the consequences notice under Rule 3(1)(c).
- Store removed content and its records for 180 days without altering the evidence.
- Check whether any government intimation you receive came from an officer of the required rank.
- If your product generates audio, images or video, ship the label and the metadata before you ship the feature.
- Publish a compliance report on your site for any Grievance Appellate Committee order you receive.
| Duty | Every intermediary | Significant social media intermediary |
|---|---|---|
| Grievance Officer and published contact details | Yes | Yes |
| 3-hour takedown on actual knowledge | Yes | Yes |
| SGI labelling and metadata under Rule 3(3) | Yes, if the product generates SGI | Yes |
| Chief Compliance Officer resident in India | No | Yes |
| Nodal contact person for 24×7 law enforcement | No | Yes |
| Monthly compliance report | No | Yes |
| User declaration and verification under Rule 4(1A) | No | Yes |
About the IT Amendment Rules, 2026
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 were notified by MeitY on February 10, 2026 through gazette notification G.S.R. 120(E). They came into force on February 20, 2026. The amendment inserts a definition of synthetically generated information, adds labelling and provenance duties, and shortens takedown and grievance timelines across the 2021 Rules.
What this means for you: if your product hosts user content or generates audio, images or video, put a named human on call this week. Rule 7 costs you safe harbour, not just a fine.
StartupFeed Insight
The two-hour clock in Rule 3(2)(b) is the one that will catch Indian startups, not the three-hour clock everyone is writing about. A three-hour takedown follows a court order or a Joint Secretary’s letter, and those arrive during working hours. A morphed-image complaint arrives at 2am on a Sunday. Meeting it needs a rota, not a policy document. Watch for the first safe harbour case against a small Indian platform under Rule 7. StartupFeed expects it to turn on a missed two-hour window rather than on labelling.
Harshvardhan Kothari, Technology and Policy Correspondent
Frequently Asked Questions
Have a tip? Write to us at editorial@startupfeed.in.
