The "No New AI Law" Mirage: How the DPDP Rules and the 3-Hour IT Rules Takedown Just Rewrote Indian Tech Practice

If your technology and media clients are holding their breath for a comprehensive, standalone Artificial Intelligence statute in India, it is time to advise them to exhale—and panic just a little.

Earlier this week, the Ministry of Electronics and IT (MeitY) made its regulatory posture abundantly clear. According to IT Secretary S. Krishnan, the Indian government will avoid drafting AI-specific legislation unless "absolutely necessary." Instead, the state intends to shoehorn AI governance into the existing—and rapidly expanding—matrix of the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and traditional Intellectual Property laws.

Make no mistake: the absence of a dedicated "AI Act" does not mean a regulatory vacuum. In fact, for practicing tech lawyers, the reality is far more perilous. We are witnessing the birth of a fragmented, draconian compliance regime built through administrative notifications and delegated legislation. If you are counseling AI startups, data fiduciaries, or intermediary platforms, the legal landscape just shifted under your feet. Here is why the events of early 2026 change everything about your daily practice.

The DPDP Rules: Consent is No Longer a Checkbox

The Centre has finally notified the administrative rules for the DPDP Act, transitioning the law from a theoretical threat to an operational reality. For the last two years, corporate lawyers have been treating DPDP compliance as a mere exercise in updating privacy policies. That stops now.

As recent commentary correctly highlights, the DPDP Rules, 2025 reframe "consent" under Section 6 of the Act. The standard is unapologetically high: consent must be free, specific, informed, unconditional, and unambiguous.

"For lawyers advising AI firms, this 'unconditional' requirement is a timebomb. How do you obtain specific, informed consent for scraping personal data to train a Large Language Model (LLM) when the output is inherently unpredictable?"

The answer is that you likely cannot. If your client relies on scraping the Indian web for algorithmic training data, you can no longer hide behind broad, bundled Terms of Service. The moment a Data Principal withdraws consent, Section 6(4) mandates the cessation of processing. For an AI developer, "unlearning" a specific user's data from a neural network is technically nearly impossible.

Practice Note: You must immediately advise clients to architect "data clean rooms" and implement rigorous data lifecycle controls. If your client cannot prove lawful notice (Section 5) and granular consent (Section 6) to the Data Protection Board, they are looking at penalties of up to ₹250 crores under the Schedule to the Act.

The IT Rules 2026 Amendment: The 3-Hour Takedown Trap

While the DPDP Act strangles the input (training data), the government is using the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 to police the output.

In a stealthy but massive expansion of state power, the February 10, 2026 amendment to the IT Rules specifically targets Synthetically Generated Information (SGI)—the bureaucratic moniker for AI-generated content and deepfakes. The amendment collapses the intermediary response time for taking down harmful SGI from 72 hours down to an impossible 3 hours upon actual knowledge.

This is legally untenable and practically disastrous. By drastically lowering the threshold for takedowns, the government has placed an intolerable burden on the safe harbour protection under Section 79 of the IT Act.

Consider the constitutional implications: Article 19(1)(a) guarantees free speech, subject only to the reasonable restrictions in Article 19(2). By forcing intermediaries to judge the synthetic nature and potential harm of a video within 180 minutes, platforms will inevitably default to over-censorship to preserve their safe harbour status. From a litigation standpoint, this amendment is ripe for a writ challenge before the High Courts for being manifestly arbitrary and ultra vires the parent Act.

Practice Note: If you are in-house counsel or external advisory for a social media platform, content aggregator, or AI-generation tool, you must urgently overhaul your client's grievance redressal mechanism. A 3-hour turnaround requires automated triaging systems. Failure to comply strips your client of Section 79 immunity, opening the board of directors to criminal liability under the Bharatiya Nyaya Sanhita (BNS).

IP Law: The "Fair Dealing" Fiction

Finally, by deferring to existing IP laws to govern AI, the government has left a gaping hole in copyright jurisprudence. MeitY assumes the Copyright Act, 1957 is equipped to handle generative AI. It is not.

When an AI model hallucinates a copyrighted image, who is the author under Section 2(d)(vi) (the person who causes the computer-generated work to be created)? Is it the prompter, or the developer? More importantly, is ingesting copyrighted works for machine learning protected under the "fair dealing" exception of Section 52(1)(a)?

Without a specific AI statute, these questions will be answered through grueling, expensive litigation in the Delhi High Court. Until a division bench lays down the law, practitioners must draft hyper-specific indemnification clauses in SaaS agreements for generative AI tools, shifting the risk of IP infringement onto the vendor.

The Bottom Line

The government's claim that it is relying on "existing frameworks" is a euphemism for regulatory retrofitting. By weaponizing the DPDP Act and the IT Rules against emerging tech, India has created a de facto AI governance regime that is aggressive, compliance-heavy, and unforgiving.

As legal professionals, our job is no longer to wait for the fabled Digital India Bill. The law is already here. It is time to start advising on the reality of 3-hour takedowns and unconditional consent, before your clients become the first test cases in the tribunals.