The regulatory position
Most of this is already law.
The industry conversation is about a December deadline. Three of the four regimes below came into force earlier this year. If you are waiting for December, you have misread which obligation applies to you.
| Regime | Since | Maximum exposure |
|---|---|---|
| UK · s.66I Sexual Offences Act 2003 | In force 29 Jun 2026 | Criminal · 3 years on indictment |
| EU · AI Act Article 50 transparency | In force 2 Aug 2026 | €15m or 3% of worldwide turnover |
| EU · AI Act Article 5(1)(ba)–(bb) prohibitions | Applies 2 Dec 2026 | €35m or 7% of worldwide turnover |
| California · AB 853 | 1 Jan 2027 · devices 1 Jan 2028 | Statutory · platform duties |
The one to read first: the Article 5 prohibition
Regulation (EU) 2026/1744 — the Digital Omnibus on AI — was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It inserts points (ba) and (bb) into Article 5(1) of the AI Act, prohibiting AI systems that generate or manipulate intimate imagery of an identifiable person without that person's explicit consent, and the equivalent for child sexual abuse material. Those prohibitions apply from 2 December 2026, in the €35m or 7% band.
Two features of the drafting decide who is exposed, and they are the reason this page leads with Article 5 rather than Article 50:
It catches foreseeable outputs, not stated purposes
The prohibition reaches a provider whose system produces this material as a reasonably foreseeable outcome — not only a provider who built the system for that purpose. A general-purpose image model is not outside the prohibition because its documentation says it is for something else.
There is a safe harbour, and it is technical
The prohibition does not bite where the system carries effective technical safeguards that reliably prevent such outputs. That is a statement about what you built and can show, not about what your policy says. It is the difference between an exposure and a defence.
Article 50 — already applying, and widely misdated
Article 50's transparency obligations have applied since 2 August 2026. The European Commission adopted guidelines on them on 20 July 2026. Breaches fall in Article 99(4): up to €15 million or 3% of total worldwide annual turnover, whichever is higher — with Article 99(6) capping SMEs and start-ups at the lower of the two.
The December date attached to Article 50 is real but narrow. The Digital Omnibus gave a four-month transition on the Article 50(2) machine-readable marking obligation — and only that obligation, and only for generative systems already placed on the market before 2 August 2026. Systems placed on the market on or after that date had to comply immediately, and the other three Article 50 transparency duties were never deferred at all.
If you have read that “Article 50 starts in December”, that is the transition being mistaken for the rule.
The UK offence — criminal, extraterritorial, and reverse-burden
Section 99 of the Crime and Policing Act 2026 inserts sections 66I to 66L into the Sexual Offences Act 2003. It came into force on 29 June 2026 under SI 2026/689. It makes it an offence to make, adapt, supply or offer to supply a thing for use as a generator of purported intimate images — and “thing” is defined to include a program, information in electronic form and a service.
Three properties make it commercially sharp. All three are in the statutory text:
Intent is not a shield
“A person makes, adapts, supplies, or offers to supply a thing for use as a generator of purported intimate images if a reasonable person (having regard to all the circumstances) would consider that they do so.”
— s.66I(3)
The test is objective. “We never meant it for that” is not an answer to it.
The defence has to be proved by the defendant
“It is a defence for a person charged with an offence under this section to prove that they took all reasonable steps to prevent the thing being used for creating, or facilitating the creation of, purported intimate images of a person without the person's consent.”
— s.66I(4)
This is the commercially important sentence on this page. A defence the defendant must prove is a demand for records — contemporaneous, complete, and showable to someone who has no reason to trust you. A refusal rate is not that. Why a percentage is not evidence →
It reaches outside the UK
s.66I(6) applies s.72(1) of the 2003 Act so that liability extends to acts done outside England and Wales by a UK national, and expressly to a body incorporated under the law of any part of the United Kingdom, or an unincorporated association formed under the law of any part of the United Kingdom.
Section 66L goes further: where a body commits the offence with the consent or connivance of a director, manager or similar officer, that person commits the offence too. The exposure is personal, not only corporate.
Penalties: on summary conviction, imprisonment to the general limit in a magistrates' court and/or a fine; on conviction on indictment, up to 3 years and/or a fine (s.66I(5)). Sections 66J and 66K provide defences for law-enforcement, security bodies and OFCOM, and carve-outs for internet service providers acting as mere conduit, cache or unwitting host.
California AB 853
The California AI Transparency Act phases in over two years.
- 1 January 2027 — large online platforms must detect standards-compliant provenance data in content they distribute, expose its origin and modification history to users, and are prohibited from knowingly stripping provenance data or signatures. GenAI hosting platforms may not make available systems that fail to place the required disclosures.
- 1 January 2028 — capture device manufacturers must offer, and embed by default, latent disclosures identifying the manufacturer, device and capture time.
The platform duties bite on public-facing social media, file-sharing, mass messaging or stand-alone search services distributing third-party content that exceeded 2 million unique monthly users over the preceding 12 months.
Sources
Every claim above traces to one of these. Checked 11 September 2026.
- Crime and Policing Act 2026, s.99 · SI 2026/689, reg. 2
- AI Act Article 50 · Commission FAQ on Article 50
- Commission guidelines on transparency obligations
- California AB 853, bill text
This page describes law. It is not legal advice, and we are not your lawyers.