No New AI Law, Just New Headaches: How the 2026 IT Rules and DPDP Act Are Cornering Tech Intermediaries

The Illusion of a "Light-Touch" Approach to AI Regulation

For the past two years, the Indian tech bar has been waiting with bated breath for a standalone Artificial Intelligence Act. You can stop holding your breath. According to recent statements by MeitY Secretary S. Krishnan, the Indian government has formally decided to shelve the idea of a bespoke AI statute. Instead, the State is leaning on our existing, arguably strained, legal frameworks: the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and traditional Intellectual Property laws.

On paper, this sounds like a victory for "light-touch" regulation and a win for startup innovation. In practice, it is a compliance minefield. By refusing to legislate a specific AI framework, the government has essentially converted the DPDP Act and the IT Rules into India’s default AI governance codes. For practicing lawyers advising tech clients, the era of regulatory ambiguity is over—replaced by an aggressive enforcement posture that relies heavily heavily on intermediaries to do the government's policing.

The 3-Hour Guillotine: The February 2026 IT Rules Amendment

The most alarming development for intermediary liability practice is the 10 February 2026 amendment to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Aimed squarely at the proliferation of deepfakes and Synthetically Generated Information (SGI), the amendment has fundamentally rewritten the rules of content moderation.

Under the new amendment, the takedown timeline for specific AI-generated synthetic content has been compressed from a somewhat manageable 72 hours down to a draconian 3 hours. This is a massive shift in intermediary obligations under Rule 3.

"Balancing urgency and liberty is no longer just an academic debate; it is an operational nightmare for grievance officers who now have three hours to adjudicate complex technical and speech issues."

Why does this matter for your practice? If you represent social media platforms, web hosts, or AI-generative platforms, their safe harbour protection under Section 79 of the IT Act is now hanging by a thread. The 3-hour window effectively mandates the use of automated filtering tools—which are notoriously inaccurate—leading to inevitable over-censorship. This flies directly in the face of the Supreme Court's jurisprudence in Shreya Singhal v. Union of India, which mandated actual knowledge and court/government orders for takedowns to prevent a "chilling effect" on free speech under Article 19(1)(a).

Expect a flurry of writ petitions challenging the proportionality of this amendment, testing it against the strict scrutiny standards laid down in Puttaswamy.

DPDP Act: The New AI Data Trap

Coupled with the IT Rules amendment, the Centre has finally notified the administrative rules for the DPDP Act. This moves the privacy law from textbook theory to operational reality. What most founders fail to realize—and what you must urgently communicate to your clients—is that the DPDP Act is now India's de facto AI Act.

As highlighted in recent SCC Online analyses, consent under the DPDP Act is the "most misread obligation." Section 6 demands that consent be free, specific, informed, unconditional, and unambiguous. Furthermore, the burden of proving lawful consent rests entirely on the Data Fiduciary.

Consider the implications for generative AI developers scraping Indian personal data to train Large Language Models (LLMs). How does a platform obtain "unambiguous" and "specific" consent to train an AI on a user's dataset? The short answer is: they can't. Withdrawal of consent now legally requires the erasure of that data. If a user withdraws consent, AI companies cannot simply "un-train" their models. This creates a massive liability loop. As a tech lawyer, your immediate mandate is to overhaul your clients' privacy notices, replacing blanket "data scraping" clauses with granular, purpose-limited consent mechanisms that attempt to satisfy Section 6.

The Copyright Conundrum: Wishful Thinking by the State

The government's claim that our existing Intellectual Property framework natively covers a "fair amount" of AI-related issues is, frankly, optimistic bordering on naive.

We are still litigating the basics. Does scraping copyrighted data for AI training constitute "fair dealing" under Section 52(1)(a) of the Copyright Act, 1957? Relying on the traditional fair dealing defense for commercial AI training is a high-risk gamble. Furthermore, under Section 2(d) of the Copyright Act, an "author" is fundamentally presumed to be human. By relying on existing IP law instead of amending it to address synthetically generated content, the government has left a gaping hole in output ownership.

Telling your clients "just follow the Copyright Act" is no longer actionable advice. You must proactively draft licensing agreements that explicitly account for AI ingestion and mandate strict indemnity clauses for AI-generated outputs.

The Bottom Line for Practitioners

India’s 2026 approach to tech regulation is a textbook example of jugaad jurisprudence—retrofitting old laws to govern new tech. While we may have avoided the compliance bulk of a massive new "AI Act," the patchwork of the 2026 IT Rules amendments and the newly operationalized DPDP Act creates a highly volatile regulatory environment.

Your action items are clear:

1. Audit Takedown Mechanisms: Revise client intermediary policies to ensure technical capability for 3-hour takedowns of SGI/deepfakes.
2. Overhaul DPDP Compliance: Ensure AI developers can prove informed, specific consent for training data, and build protocols for data erasure upon consent withdrawal.
3. Prepare for Litigation: Anticipate safe harbour disputes under Section 79 as intermediaries inevitably fail to meet the new, ultra-compressed timelines.

The tech sector wanted clarity. Instead, it got the 3-hour guillotine. Act accordingly.