FUTURECRAFT
On 2 August, the transparency provisions of the European Union’s AI Act take effect. AI systems will have to tell users they are talking to a machine, and generated content will have to carry machine-readable marks so that it can be detected. Brussels is arriving at a position New Delhi took five months ago.
India got there first and went considerably further. The Information Technology Amendment Rules, notified on 10 February and in force from 20 February, created what lawyers have described as the world’s first binding provenance mandate for synthetic media. Synthetic content must carry a visible label and metadata that persists, and flagged unlawful content must come down within three hours or the platform risks its safe harbour protection under Section 79.
The stated purpose is deepfake control. The architecture does something wider. India has built a system that writes a durable record of origin into media at national scale, and it binds the people who use compliant tools while leaving everyone else outside it.
A filter checks content. A register checks authorship.
A detection filter asks whether a video is fake and acts on the answer. A provenance system asks where a file came from and writes that answer into the file, so the record travels with the content.
The 2026 amendment does the second thing. Intermediaries must embed metadata identifying synthetic material and verify what users declare about their uploads, rejecting the upload outright where the declaration is missing or false. That moves platforms from answering complaints to checking at the door.
The Internet Freedom Foundation has noted that the rules name no accepted watermarking standard and no approved detection model. That gap is the design surface. Whoever ends up setting the standard decides what can be published.
It binds the compliant and misses the adversary
In January, a group of AI practitioners told MeitY the framework would not work on its own terms. The objection was technical, not political. Content produced by an open-source model running on someone’s own machine carries no provenance data at all. Content that is re-encoded or screen-recorded loses whatever provenance it started with.
The outcome follows from that. An editor in Srinagar using a licensed tool leaves a trace. An operator running a local model outside Indian jurisdiction leaves none.
This is where the sovereignty framing stops holding. India has argued for years, with reason, that critical digital infrastructure should sit under Indian law. A provenance mandate looks like the same argument applied to content. It is not. Jurisdiction over a data centre gives the state control of an asset. Jurisdiction over content metadata gives it a record of the citizens who complied.
A provenance mandate is only as good as the people who obey it. The operator running a model on a laptop was never inside the system to begin with.
Three hours is where the policy actually lives
Labelling drew the headlines. The clock changes behaviour. An intermediary must act within three hours of actual knowledge, which arrives either by court order or by a reasoned intimation from an authorised government officer, with police intimations restricted to officers of Deputy Inspector General rank and above.
Three hours is not long enough to assess a case. It is long enough to delete. Constitutional lawyers writing after the notification argued that compressed timelines combined with the risk of losing safe harbour push platforms to remove anything ambiguous, since verification costs more than compliance. Satire and political criticism are ambiguous by construction.
The burden falls unevenly, and Jammu and Kashmir carries the most of it. Access Now counted 65 internet shutdowns in India in 2025 across twelve states and union territories. The tracker maintained by SFLC.in puts Jammu and Kashmir at roughly 449 shutdowns since 2012, against 115 in Rajasthan and 62 in Manipur. A region already subject to the heaviest use of connectivity orders now gains a second mechanism that works on individual posts rather than whole networks, and needs no suspension order at all.
What the counter-argument gets right
The harm is not invented. India’s internet population went from around 250 million to more than a billion in under a decade, faster than digital literacy could follow. Digital arrest scams have taken real money from people least equipped to spot them, and the Delhi and Bombay High Courts have worked through a run of personality rights cases involving synthetic impersonation.
MeitY also narrowed the rules between the October 2025 draft and the February notification. The draft reached anything algorithmically created or altered. The final text limits synthetically generated information to audio and visual material likely to be taken as indistinguishable from a real person or a real event. That was a genuine concession, made in response to consultation.
The stronger version of the criticism is not that the rules were written in bad faith. It is that a provenance layer built for fraud becomes available for other purposes the moment it exists, and nothing in the text confines it to the original one.
Bottom Line
Meta moved the other way in 2024, shifting from removing manipulated media to labelling it, on the reasoning that transparency costs less speech than takedown. Europe codifies a version of the same instinct on 2 August. India has taken the same underlying technology and wired it to a three-hour clock and the loss of safe harbour.
The label reads the same in all three places. The instrument does not. In Europe, provenance data tells a reader what they are looking at. In India it also tells the state who made it, on a network where the state already switches connectivity off more often than any other democracy.
That is not a case against labelling synthetic media, which India has good reason to do. It is a case for naming the second system that arrived with it, and for settling who writes the standard before the standard settles itself.
(The author studies Computer Science and Artificial Intelligence at Rutgers University, New Jersey, USA. He is interested in emerging technologies and innovation, and can be reached on LinkedIn at @arssh-kumar14)
