Key takeaways
- Section 79 protects intermediaries from liability for third-party content, but whether a generative AI provider’s own outputs count as third-party content is unsettled.
- The February 2026 IT Rules kept the intermediary model and added due diligence for synthetic content, instead of creating a new AI category.
- We found no confirmed decision to create a separate AI intermediary category; the consultation paper is the likely place for it.
- Assume safe harbour may cover hosting but not generation, and build guardrails, logs and a grievance process accordingly.
For a social media platform, Section 79 of the IT Act is the shield that keeps it from being held liable for what users post. For an AI product, the question is not settled. If your chatbot produces a defamatory answer, or your image tool generates a deepfake, are you an intermediary hosting someone else’s content, or are you the author of what the system says? Indian law has no clear answer yet, and the answer determines whether safe harbour is available.
Lawyers, industry groups and policy writers are debating whether AI platforms need a legal category of their own, separate from India’s social media intermediary rules. This guide explains how safe harbour works, why generative AI doesn’t fit it neatly, what the 2026 IT Rules and recent regulatory episodes suggest, what is still undecided, and what an AI founder should assume in the meantime.
How safe harbour works under Section 79
Section 79 of the Information Technology Act, 2000 protects an “intermediary” from liability for third-party information, data or communication links made available or hosted by it. The protection is conditional. The intermediary’s function must be limited to providing access to a communication system, or it must not initiate the transmission, select the receiver or select or modify the information transmitted, and it must observe due diligence and the rules the Central Government prescribes. Safe harbour is lost if the intermediary conspires in or abets an unlawful act, or if it fails to remove unlawful content after receiving actual knowledge.
In Shreya Singhal v. Union of India in 2015, the Supreme Court read “actual knowledge” to mean knowledge from a court order or a government notification, not just a private complaint. The IT Rules, 2021 then set out detailed due diligence duties for intermediaries, with extra duties for significant social media intermediaries, meaning platforms with more than five million registered users in India. Losing safe harbour does not mean automatic liability, but it means the platform can be treated like any other publisher in a claim.
The key phrase for AI is “third-party information”. Safe harbour is built around the idea that the platform passes along what someone else wrote, uploaded or sent. The further a service moves from passing things along towards creating or shaping content, the weaker the fit.
Why generative AI doesn’t fit the intermediary mould
A generative AI system takes a user’s prompt and produces new content. Is that content the user’s, the system’s, or the developer’s? Commentators who argue that AI outputs are first-party content say that the provider selects the training data, designs the model, and controls what it will say, so the output is the provider’s own and safe harbour doesn’t apply. If a platform is classified as a content publisher rather than an intermediary, it loses Section 79 and becomes directly liable for all outputs (Bhatt & Joshi Associates; Law School Policy Review).
| View | Argument | Consequence for the provider |
|---|---|---|
| Outputs are the provider’s own content | The provider designs the model, selects its data and controls what it says | Section 79 is unlikely to apply and the provider can be directly liable |
| Outputs respond to third-party prompts | Users supply the input and the provider does not select or modify what they send | The provider may claim intermediary status, but the point is untested |
| Mixed products | Hosting of user-shared AI content plus provider-generated answers | Safe harbour may cover the hosting layer and not the generation layer |
The other view is that AI platforms host a service used by third parties, so user prompts are third-party inputs, and a platform that does not select or modify what a user sends should not be treated as the author of the result. Some analysts note that Indian law has treated intermediary status as a matter of the entity rather than the function, which makes it hard to say that a company is an intermediary for one product and not another (Bhatt & Joshi Associates). A May 2026 article reports that the government regards the existing framework as sufficient for AI-enabled activity (Law School Policy Review).
Practical reality is mixed. An AI product often has several parts. A platform that lets users share AI-generated images with each other hosts third-party content in the ordinary way. A chatbot whose answers are generated by the provider’s model is much closer to the provider’s own speech. And a tool that lets users generate content for their own private use has features of both. For a founder, the sensible assumption is that safe harbour may protect the hosting layer and may not protect the generation layer.
What the 2026 IT Rules and recent episodes suggest
The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified on 10 February 2026, bring synthetically generated information within the intermediary framework. One law-firm analysis says the amendment preserves Section 79 as it currently stands but adds a stricter standard for safe harbour through the due diligence requirements for synthetic content and deepfakes (Mondaq). Another reads the rules as saying that compliant technological moderation measures do not by themselves breach Section 79(2)(a) or (b) (Mondaq).
So the government’s approach so far is to keep the intermediary model and attach AI-specific due diligence to it, not to carve out a new category. That suggests regulators see an AI platform that hosts or enables user-generated synthetic content as an intermediary with extra duties. It does not answer whether the provider’s own model outputs are third-party content.
Regulatory episodes show the stakes. MeitY demanded a corrective-action report from X after concerns about images generated by Grok and warned that non-compliance could cost the platform its Section 79 protection, and commentators described the position of AI platforms as a grey area (Supreme Court Observer). A warning is not a legal finding, but it shows that the government is prepared to use the safe harbour condition as leverage over AI features of intermediary platforms.
The debate about a separate AI category
Several arguments are circulating. Industry voices say that a generative AI system does not fit the 2021 intermediary rules, which were written for social media and messaging, and that AI developers need clear rules on what they are responsible for. Policy writers argue that safe harbour should not simply be extended to AI, because the developer controls the model, and that a dedicated framework should allocate responsibility between developers, deployers and users. Others warn that a new category could be used to impose heavier obligations without a clear legal basis.
We found no confirmed decision to create an “AI intermediary” category. Reporting from July 2026 says MeitY is examining a standalone statute instead of putting all new provisions under the existing IT Act framework, and on 8 October 2026 the IT Minister said a consultation paper on AI regulation would be released within a month. The consultation is therefore the place where the intermediary question is most likely to be addressed. We could not confirm the specific lobbying positions of individual companies or firms, so treat claims about who has argued what with caution.
Two outcomes are plausible. One is a framework that keeps AI platforms inside the intermediary rules with added duties for synthetic content. The other is a new category that gives AI developers a defined, perhaps narrower, protection tied to risk controls such as testing, labelling and incident reporting. Either way, a safe harbour is likely to depend on demonstrable compliance, which is a reason to build the evidence now.
What AI founders should assume, remedies and quick answers
Plan on the cautious reading. Assume that outputs your model generates may be treated as your own and that safe harbour may not shield you from a claim based on them, and set up controls accordingly: guardrails and filters, testing for harmful outputs, clear terms of use, prompts and output logging within DPDP limits, a quick route for users and authorities to report problems, and a documented process for removing unlawful content. Separate the layers. Where your product also hosts user-shared content, run a conventional intermediary compliance process with a grievance officer, takedown workflow and records. Review your insurance. If you receive a notice, respond promptly, preserve records and take advice, because the way you respond can affect your safe harbour position. If you are sued, the argument that you are an intermediary is available but unproven for generative outputs, so it should not be your only defence. Keep an eye on the consultation, and consider contributing an evidence-based view of how your product works.
Related reading: India’s standalone AI law and what startups should prepare, the draft IT Rules change on binding MeitY advisories, MeitY’s October 2026 AI labelling advisory, labelling AI-generated content under the IT Rules 2026, who is liable when an AI agent causes harm, the Sahyog portal and content takedowns and deepfakes and personality rights in India; also ads inside AI answers and Indian advertising law and Grok, deepfakes and platform liability for US companies in India; also keyword advertising and trade marks in India; also the Ofcom ruling and Indian apps with UK users.
Quick answers
Is a generative AI platform an intermediary under Indian law?
That is unsettled. A platform that hosts user-shared content is an intermediary, but whether the provider’s own model outputs are third-party content is debated and has not been decided by a court.
Does safe harbour cover AI-generated outputs?
It cannot be assumed. Commentators argue that outputs are the provider’s own content, which would fall outside Section 79, so founders should build compliance as though safe harbour might not apply.
Has India created a separate legal category for AI platforms?
Not as far as our research shows. The 2026 IT Rules kept the intermediary model and added due diligence for synthetic content, and a consultation paper on AI regulation was announced for around November 2026.
What did Shreya Singhal decide about safe harbour?
In 2015 the Supreme Court read ’actual knowledge’ in Section 79 to mean knowledge from a court order or a government notification, not a private complaint. It remains the base on which later intermediary rules sit.
What should a chatbot provider put in its terms?
Clear terms on acceptable use, a statement of what outputs are and are not, a grievance route for users and authorities, and a documented takedown process. Terms help, but they do not create safe harbour that the law does not give.
Final word
Halverton & Co. is an Indian law firm advising founders, startups, technology companies and investors on Indian law, including intermediary liability, AI governance and compliance for AI platforms and technology startups. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and act as fractional legal counsel for technology-driven businesses. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.
This article reflects developments reported up to late October 2026. It is for general information only, is not legal advice, and does not create an advocate-client relationship. Halverton & Co. is an Indian law firm.
Sources
Related practice area
Technology & AI Law
Contracts, data protection and AI policies for products that handle other people’s data.
View the practice areaComments
No account needed. Comments are reviewed before they appear, so yours will show here once approved. Please do not share confidential details or describe your own legal matter: replies are general discussion, not legal advice, and do not create an advocate-client relationship. For your own situation, write to office@halvertonandco.com.
