India's IT Rules on synthetically generated information

What is synthetically generated information?

Rule 2(1)(wa) defines it as "audio, visual or audio-visual information which is artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that such information appears to be real, authentic or true and depicts or portrays any individual or event in a manner that is, or is likely to be perceived as indistinguishable from a natural person or real-world event".

Two limits follow from the wording. Text is outside it. So is content that does not look real: a cartoon or an obviously stylised image does not meet "likely to be perceived as indistinguishable".

A proviso excludes three kinds of routine work: good-faith editing, formatting, colour adjustment, noise reduction, transcription or compression that does not materially alter the substance or meaning; good-faith preparation of documents, presentations, educational or training materials and research outputs that does not produce a false document or false electronic record; and use solely to improve accessibility, clarity, quality, translation, description, searchability or discoverability.

Who does it bind?

Intermediaries under the Information Technology Act, 2000. The labelling duty in rule 3(3) falls on an intermediary that "offers a computer resource which may enable, permit, or facilitate the creation, generation, modification, alteration, publication, transmission, sharing, or dissemination of information as synthetically generated information". That description fits a generation service as well as a platform that hosts the result.

Rule 4(1A) adds duties for significant social media intermediaries, a class the principal rules define by a registered-user threshold in India (5,000,000 users, from memory; the threshold notification was not re-read for this page).

What exactly is required?

Prevent unlawful synthetic content. Rule 3(3)(a)(i) requires "reasonable and appropriate technical measures, including automated tools" so that users cannot create or share synthetic content that breaks the law, including child sexual abuse material and non-consensual intimate imagery, false documents or electronic records, content about preparing explosives or arms, and content that "falsely depicts or portrays a natural person or real-world event" in a manner likely to deceive.

Label and embed the rest. Under rule 3(3)(a)(ii), all other synthetic content must be "prominently labelled in a manner that ensures prominent visibility in the visual display that is easily noticeable and adequately perceivable, or, in the case of audio content, through a prominently prefixed audio disclosure". The same sub-clause requires that it "shall be embedded with a permanent metadata or other appropriate technical provenance mechanisms, to the extent technically feasible, including a unique identifier, to identify the computer resource of the intermediary used to create, generate, modify or alter such information".

Do not let either be removed. Rule 3(3)(b): "the intermediary shall not enable the modification, suppression or removal of the label, permanent metadata, including the unique identifier".

Tell users. Rule 3(1)(c) now requires every intermediary to remind users of its rules at least once every three months, and rule 3(1)(ca) requires those offering synthetic-content tools to add that misuse may attract penalties and lead to removal, account suspension and, where the law allows, disclosure of the user's identity to a victim.

For significant social media intermediaries, rule 4(1A) requires, before display, upload or publication: a user declaration of whether the content is synthetically generated; "appropriate technical measures, including automated tools or other suitable mechanisms, to verify the accuracy of such declaration"; and, where either confirms it, a clear and prominent label or notice. An explanation says the responsibility extends to ensuring "that no synthetically generated information is published without such declaration or label".

The same amendment shortened general takedown times: the window in rule 3(1)(d) for acting on court orders and government notices went from thirty-six hours to three, the grievance period from fifteen days to seven, and the window in rule 3(2)(b) from twenty-four hours to two.

What happens if you don't?

The amendment sets no fine. Its lever is due diligence. The proviso to rule 4(1A) says that where it is established that a significant social media intermediary "knowingly permitted, promoted, or failed to act upon" synthetic content in contravention of the rules, it "shall be deemed to have failed to exercise due diligence". An intermediary that fails due diligence loses the protection of section 79 of the Act, the safe harbour for third-party content, and becomes answerable for it under the general law (from memory: this is rule 7 of the principal rules, which the amendment touches only to update a statutory reference).

In the other direction, rule 2(1B) clarifies that removing content, including by automated tools, in compliance with the rules does not breach the conditions of the safe harbour.

What is pending?

AZB & Partners' tracker of September 2026 records a draft Second Amendment to the same rules, released on 30 March 2026 and reissued with changes on 21 April 2026, with comments open until 7 May 2026. One proposal in it is that information about synthetic content "must be shown in a continuous and clearly visible label throughout the duration of the content". The tracker lists it as a draft for consultation. We have not read the draft and have not confirmed whether it has since been finalised: UNVERIFIED.

How does it compare with Article 50?

	India, IT Rules as amended	EU AI Act Article 50
Since	20 February 2026	2 August 2026
Content	Realistic audio, images and video; not text	All synthetic audio, image, video and text
Visible label	Required, prominent	Not required of providers; deployers disclose deepfakes
Machine-readable mark	Permanent metadata or other provenance mechanism, with a unique identifier	Machine-readable and detectable; technique left open
Removal	The intermediary must not enable it	The Code of Practice asks signatories to preserve marks
Consequence	Loss of safe harbour	Up to EUR 15 million or 3% of turnover

India is the only one of the two to require the identifier in terms, and the only one to require the visible label on everything in scope. A signed manifest that names the generating service and carries a unique identifier, bound to the file by a watermark so it survives stripping, is a direct reading of "permanent metadata or other appropriate technical provenance mechanisms".

What this means if you ship AI generation

If your generation service is used in India and its output could pass for a real person or event, you need the visible label and the embedded identifier now, and your product must not offer a way to take either off. If your output is plainly not realistic, or is text, the definition does not reach it. If you run a large platform, the declaration, verification and labelling step sits in front of every upload.

SignUnder's signed manifests carry the generating service and a unique identifier, with a watermark as the binding that survives stripping; it is pre-launch and the waitlist is on the homepage.

Changes

• 2026-10-13 — First published, from the gazette text of G.S.R. 120(E) as published by the Ministry.

SignUnder is not a law firm and this is not legal advice. Every rule here cites its primary source and the date we read it, and anything not read from a primary source is marked.