India has ordered platforms to label and trace AI content and delete illegal deepfakes within three hours, exposing major compliance gaps in open source tools that lack built-in provenance.
India has introduced sweeping AI content rules that immediately place pressure on social platforms and open source AI ecosystems to label, trace and rapidly remove synthetic media at scale.
Under amendments to the Information Technology Rules, platforms must clearly label AI-generated or edited content, attach permanent metadata or provenance markers, add audible disclosures to AI audio, and deploy “reasonable and appropriate technical measures” to prevent unlawful uploads. Illegal or harmful deepfakes must be removed within three hours of detection or reporting, sharply reduced from the earlier 36-hour window. The rules take effect on 20 February 2026, leaving companies only days to comply.
The mandate carries global weight. With nearly one billion internet users and more than 500 million social media users, India is a critical market for Google, Meta and X, and could set moderation benchmarks worldwide.
Current detection relies heavily on C2PA provenance metadata, yet gaps remain: metadata can be stripped, interoperability is weak, labels are subtle, and many AI tools — especially open-source models — lack built-in provenance. This creates compliance risks for community projects, self-hosted systems and smaller platforms, likely pushing developers towards watermarking, signed provenance chains and open standards.
Civil liberties advocates, including Internet Freedom Foundation, warned the three-hour deadline may trigger “rapid-fire” removals and excessive automation. Officials added provenance systems need only be implemented where “technically feasible.”
India now becomes the largest real-world test of whether open and proprietary AI systems can deliver tamper-proof transparency at national scale.
