AI Regulation Tracker  /  Regulation adopted

EU AI Act Adds Article 5 Ban on Non-Consensual Intimate Deepfakes, Effective December 2, 2026

The now-final Digital Omnibus amends the AI Act to prohibit AI systems that generate non-consensual intimate imagery or child sexual abuse material. Any firm whose image or chatbot tools reach EU users, including US providers, is in scope.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

The European Union has written a new red line into its flagship AI law. On June 29, 2026, the Council of the EU gave final adoption to a regulation amending the AI Act, Regulation (EU) 2024/1689, known as the Digital Omnibus. The European Parliament had endorsed the text on June 16, 2026. Most coverage has focused on the package delaying high-risk obligations, but the more consequential change for anyone building generative tools is a new prohibition added to Article 5, the section of the AI Act that lists practices banned outright.

What the new prohibition covers

From December 2, 2026, it becomes unlawful to place on the market, put into service, or use an AI system that generates or manipulates realistic depictions of an identifiable natural person's intimate parts, or of an identifiable person engaged in sexually explicit activity, without that person's consent. The consent standard is strict. It must be, in the words tracked by legal analysts of the text, "freely given, specific, informed, unambiguous, and explicit." A parallel ban covers AI systems that generate child sexual abuse material within the meaning of Directive 2011/93/EU, subject to a narrow carve-out where national law recognizes a "without right" defense.

In plain terms, the target is the class of tools often called "nudifier" apps, which take a photo of a real person and strip or alter it to produce a nude or sexual image. The prohibition reaches both the tools built for that purpose and general-purpose systems used to produce such output.

Why it sits in Article 5, and why that matters

Placing this in Article 5 is a deliberate legal choice. Article 5 is the AI Act's list of prohibited practices, the same tier that already bans social scoring and certain manipulative systems. Prohibited practices are not risk-managed or documented into compliance. They are simply off-limits. They also carry the law's heaviest penalties, the top fine tier of up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher, under the AI Act's existing enforcement structure.

Analysts who have read the agreed text note that liability is calibrated by role. A provider is on the hook where generating such content is the intended purpose of its system, or a reasonably foreseeable outcome that adequate safeguards would have prevented. A deployer is generally liable for intentional misuse, with genuinely accidental output treated differently. That distinction rewards firms that build real guardrails and can show them.

What it does not do

The prohibition is specific, and it helps to say what falls outside it. It does not ban image generation, photo editing, or synthetic media in general. It does not reach consensual adult content where the depicted person has given the required explicit consent. It does not create a new content-takedown regime by itself, and it does not replace existing criminal law on image abuse in member states; it adds an EU-wide market prohibition on the AI systems that produce this material. The rest of the Digital Omnibus, including the deferral of high-risk Annex III obligations to December 2, 2027 and embedded-product high-risk duties to August 2, 2028, is a separate matter. The August 2, 2026 obligations for general-purpose AI models still apply on their own schedule.

The cross-border angle for US firms

The AI Act binds by market, not by headquarters. A US company that offers an image generator, a chatbot, or an editing tool to users in the EU is a provider on the EU market and is bound by this prohibition the same as an EU firm. That means any US tool capable of producing intimate images of a real, identifiable person without consent has a hard deadline: by December 2, 2026, it must either prevent that use through effective technical safeguards or stop being placed on or used in the EU market for that purpose. Because the EU is moving first and drawing the line at the prohibited-practice level, this text is also likely to shape how US state legislators and platforms frame their own deepfake-abuse rules.

The regulation's Official Journal number was not assigned as of early July 2026, and publication is expected during the month. The substance, however, is settled. For compliance teams, the work is to inventory which products could cross the new line and to document the safeguard or the market restriction they will rely on before the December date.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.