MeitY's IT Rules and AI Chatbots: What Businesses Need to Know
MeitY's IT Rules 2021, made under the IT Act 2000, mainly bind intermediaries — but they matter for AI chatbots too. If your chatbot merely answers customers, most intermediary duties may not apply; if it generates media, the 2026 synthetic-content amendments require labelling and metadata. Grievance redressal and due-diligence expectations still shape good practice.
This is an explainer, not legal advice. For obligations specific to your business, consult a qualified advisor and the official regulation.
The Information Technology Act, 2000 (IT Act) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules) together form India's core framework for governing content and platforms online. The Ministry of Electronics and Information Technology (MeitY) notified the IT Rules on 25 February 2021 under section 87 of the IT Act (PIB, 2021). As Banking, Financial Services and Insurance (BFSI) businesses roll out AI chatbots for support, sales and servicing, a common question follows: do these rules apply to us?
The honest answer is it depends on what your chatbot is and does. This explainer separates what the Rules say from what businesses often assume.
What Do the IT Rules 2021 Actually Govern?
The IT Rules are built around the concept of an intermediary — an entity that receives, stores or transmits information on behalf of other people, and in return gets "safe harbour" from liability for that third-party content under section 79 of the IT Act. The Rules prescribe due diligence that intermediaries must follow; if it is not followed, the safe-harbour protection may not apply (PIB, 2021).
Part II of the Rules (administered by MeitY) covers two tiers:
- Intermediaries and social media intermediaries (SMIs) — general due diligence and grievance redressal.
- Significant social media intermediaries (SSMIs) — large platforms above a notified user threshold, with additional obligations.
Why does this distinction matter for a chatbot? Because a typical BFSI chatbot that answers your own customers is usually acting as your business speaking to users — not as a platform hosting third-party content. In that case many intermediary-specific duties may not apply. The picture changes if your product hosts user-generated content or generates synthetic media, as covered below. When the classification is unclear, refer to the official text and take advice.
What Are the Grievance and Due-Diligence Expectations?
Where the Rules do apply, the grievance mechanism is central. Intermediaries must appoint a Grievance Officer, publish their name and contact details, acknowledge a complaint within 24 hours and resolve it within 15 days of receipt (PIB, 2021).
SSMIs carry heavier duties, summarised below.
Obligation | Who it applies to | What it requires |
|---|---|---|
Grievance Officer | All intermediaries | Publish contact details; acknowledge in 24 hours, resolve in 15 days |
Chief Compliance Officer | SSMIs | A resident-in-India officer accountable for compliance |
Nodal Contact Person | SSMIs | Resident in India, for 24x7 coordination with law enforcement |
Resident Grievance Officer | SSMIs | Resident in India, handling the grievance function |
Monthly compliance report | SSMIs | Details of complaints received and action taken |
First-originator traceability | SSMIs (messaging) | Enable identification of the first originator for specified serious offences |
Even where a business is not an intermediary, a published grievance route is prudent — and it overlaps with the grievance-officer expectation under India's data-protection framework, which our guide on regulatory AI in BFSI and what RBI guidelines mean for banks discusses in a lending context.
How Do MeitY's AI and Deepfake Advisories Fit In?
MeitY has issued a series of advisories reminding intermediaries to observe their statutory due-diligence obligations. Notably, an advisory dated 15 March 2024 addressed risks from computer resources that permit the synthetic creation or modification of text, audio and audiovisual content, and further advisories followed on non-consensual imagery and unlawful content (PIB, 2026).
Two points matter for businesses:
- Advisories are not new law — they interpret existing IT Act and IT Rules obligations. Treat them as direction on how MeitY expects the Rules to be applied.
- They increasingly target AI-generated content, signalling where enforcement attention is heading.
What Changed with the 2026 Synthetic-Content Amendments?
This is the most significant recent development for AI. MeitY released an explanatory note on 22 October 2025 proposing amendments to the IT Rules for synthetically generated information (SGI) (MeitY, 2025), and the government amended the IT Rules on 10 February 2026 to address harms from SGI including deepfakes and AI-generated content (PIB, 2026).
Per the explanatory note, the amendments:
- Define "synthetically generated information" — information artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that appears reasonably authentic or true.
- Mandate labelling and metadata for synthetic content, with the label made visible or audible in a prominent manner — covering at least 10% of the visual surface area, or the first 10% of audio duration — and prohibit removing or suppressing that label.
- Strengthen SSMI obligations, requiring a user declaration on whether uploaded content is synthetic and reasonable technical measures to verify it.
MeitY's summary adds that intermediaries must deploy reasonable technical measures to prevent creation and dissemination of unlawful AI-generated content (obscene, misleading, impersonating, or harmful to children), ensure clear labelling and traceable metadata for permissible AI-generated content, and remove unlawful content within three hours of a court order or reasoned government intimation (PIB, 2026).
What Should a Business Deploying an AI Chatbot Do?
Read carefully, most of the SGI labelling burden falls on the platforms and tools that enable creation of synthetic media, and the verification duties on SSMIs. A text chatbot answering account queries is a different animal from a tool that generates realistic synthetic voices or faces. Still, a prudent BFSI deployment should:
- Classify your chatbot honestly — first-party customer communication, an intermediary hosting user content, or a generator of synthetic media? The answer drives your obligations.
- Label AI-generated media where your chatbot produces synthetic voice, images or video.
- Publish a grievance route and respond within defined timelines.
- Avoid impersonation and misinformation — do not let a bot imitate a real person or make misleading claims.
- Keep records of prompts, outputs and moderation actions to evidence due diligence.
For deeper grounding, see our explainers on what a conversational AI voice bot is and how to ensure AI compliance and ethics in India.
How AI Helps Businesses Stay on the Right Side of the Rules
The same technology that raises these questions can help answer them. YuCI analyses chatbot and voice conversations to flag risky patterns — impersonation attempts, misleading claims, or missing disclosures — before they become complaints. It timestamps interactions, tracks grievance acknowledgement and resolution against the 24-hour and 15-day benchmarks, and keeps an auditable record of what the bot said and how issues were handled. That turns compliance from a paper policy into something you can measure and evidence. See our piece on how AI chatbots reduce hospital call-centre load.
FAQ
Do the IT Rules 2021 automatically apply to my company's AI chatbot? Not automatically. The Rules primarily bind intermediaries — entities that host or transmit third-party content. A chatbot that only communicates on your own behalf with your customers is often not an intermediary. Whether the Rules apply depends on the facts, so classify your service and take advice.
What is a Grievance Officer and do we need one? A Grievance Officer is the published point of contact for user complaints under the IT Rules, required to acknowledge complaints within 24 hours and resolve them within 15 days. Even non-intermediaries often appoint one as good practice and to align with data-protection expectations.
Are MeitY's AI advisories legally binding? Advisories restate and interpret existing obligations under the IT Act and IT Rules rather than creating new standalone law. They signal how MeitY expects entities to apply the Rules — particularly around deepfakes and synthetic content — so take them seriously.
Does my chatbot need to label AI-generated content? If your product generates synthetic media, the 2026 amendments require labelling and traceable metadata, visible over at least 10% of a visual display or audible in the first 10% of audio. A simple text chatbot has lighter obligations, but transparent disclosure that users are talking to a bot is good practice.
What are the timelines for removing unlawful content? Per MeitY, intermediaries must remove unlawful content within three hours of a court order or a reasoned intimation from the appropriate government or its agency. Other categories, such as certain intimate-imagery complaints, carry their own shorter timelines under the Rules.
How do the IT Rules relate to the DPDP Act for chatbots? They govern different things. The IT Rules focus on content, intermediary due diligence and grievance redressal; the DPDP Act governs how personal data is processed. A chatbot handling customer data usually needs to satisfy both at once.
Conclusion
MeitY's IT Rules are not a blanket AI law, and businesses should resist both extremes — assuming the Rules never touch chatbots, or assuming every SSMI duty applies to a simple support bot. The accurate posture: know your classification, watch the synthetic-content amendments, label AI-generated media, and keep a working grievance route. Get those right and your chatbot programme stays defensible as the framework evolves.
Deploy AI chatbots that are built for Indian compliance. Talk to the YuVerse team to see how conversation intelligence keeps your deployment auditable.
References
- PIB — Government notifies IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (25 Feb 2021) — https://www.pib.gov.in/PressReleasePage.aspx?PRID=1700749
- MeitY — Explanatory Note on proposed amendments relating to synthetically generated information (22 Oct 2025) — https://www.meity.gov.in/static/uploads/2025/10/8e40cdd134cd92dd783a37556428c370.pdf
- PIB — Government strengthens regulatory framework on synthetically generated information (25 Mar 2026) — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2245053
