On 2 December 2026, two new prohibitions under the EU Artificial Intelligence Act take effect: AI systems that generate non-consensual intimate imagery and child sexual abuse material will be banned from being placed on the market, put into service or used in the EU. On the same day, the transition period ends for machine-readable content marking for generative AI systems placed on the market before 2 August 2026. Both changes are set out in the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force in July this year. Their scope is limited to the EU.
What exactly is banned from 2 December
The first prohibition covers AI systems that generate or manipulate realistic images, videos, audio or similar material depicting an identifiable natural person's intimate parts or that person engaged in sexually explicit activities, where there is no freely given, specific, informed, unambiguous and explicit consent from that person. The second covers systems that generate or manipulate child sexual abuse material, as defined by reference to Directive 2011/93/EU, subject to a "without right" defence under national law. But the ban is not unconditional: Article 5(1a) provides that, for providers, a system is only prohibited in two cases — where generating such material is the system's intended purpose, or where the system's design, training, architecture or functionalities make such generation a reasonably foreseeable and reproducible outcome, while the system lacks reasonable and adequate technical safety measures to reliably prevent it and to correct observed or reported misuse. For deployers, use is only prohibited where the deployer uses the system for the purpose of generating such material. Merely altering an image without increasing the exposure of intimate parts or changing the nature of any sexually explicit activity does not count as "manipulation" under the provision.
What companies should check before 2 December
Start by inventorying the generative systems you place on the market or use in the EU: do any of them market features for generating intimate imagery or face-swap nudity, can prompt filtering and output detection block such requests, and is there a mechanism to correct misuse once reported? General-purpose models are not covered by the ban as such, but a product that makes "one-click undressing" its flagship feature, or that knowingly lets users mass-produce such material without safeguards, falls into the second case of Article 5(1a). Article 50(2) also expires on the same day: generative systems placed on the market before 2 August 2026 must achieve machine-readable marking by 2 December — see how ChatGPT's text watermark was rolled out for reference. Keep suppliers' answers in writing; verbal assurances do not belong in a compliance file.
Breaching a prohibition sits in the Act's heaviest penalty tier: up to €35 million or 7% of worldwide annual turnover, whichever is higher; transparency breaches under Article 50 sit in a separate tier of up to €15 million or 3%. Nor is 2 December the date the Act fully applies: high-risk obligations remain postponed to 2 December 2027 (Annex III scenarios) and 2 August 2028 (AI embedded in regulated products); only the new prohibitions and the marking transition take effect now. The territorial scope is equally fixed: systems placed on the market outside the EU and not used in the EU are not caught by either provision, and neither the United States nor China currently has an equivalent ban — presenting the EU rules as global would be wrong.
