European UnionAI Act, Article 5(1)(ba) and (bb) (AI-generated non-consensual intimate imagery and child sexual abuse material)
Regulation (EU) 2024/1689, Article 5(1), first subparagraph, points (ba) and (bb)
An AI prohibited practices rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment, Place of effect
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- This duty takes effect on : Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744, applies Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) from that date, later than the rest of Chapters I and II, which apply from .
- Do not place on the market, put into service, or use an AI system that generates or manipulates realistic images, video, audio, or similar material depicting an identifiable person's intimate parts, or an identifiable person engaged in sexually explicit activity, without that person's freely given, specific, informed, unambiguous and explicit consent to that generation or manipulation.
- Do not place on the market, put into service, or use an AI system that generates or manipulates child sexual abuse material within the meaning of Directive 2011/93/EU, Article 2, points (c) and (e), unless a 'without right' defence applies under national law.
- Placing such a system on the market or putting it into service is only prohibited where the generation or manipulation is the system's intended purpose, or where its design, training, architecture, capabilities, or user-facing functionality make that outcome a reasonably foreseeable and reproducible result, without requiring significant technical modification, and the system lacks reasonable and adequate technical safety measures and other safeguards against it.
- Using such a system is only prohibited where you, as deployer, use it for the purpose of generating or manipulating that material.
- Manipulating already-existing material in a way that neither increases the exposure of any intimate parts already depicted nor alters the nature of any sexually explicit activity already depicted is not 'manipulation' for the intimate-imagery prohibition.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Regulation's own remedy for these two prohibitions is the Article 99(3) administrative fine. Article 99(1) has each Member State lay down the rules on penalties and other enforcement measures for infringements, and recital (15) of Regulation (EU) 2026/1744 says that penalties laid down under it may be of a criminal nature, in which case Member States must respect the ne bis in idem principle; that is a channel under national law, not a criminal offence the Regulation itself creates. Directive 2011/93/EU separately criminalises the production and possession of child sexual abuse material under national law; that criminal exposure belongs to that Directive, not to this Regulation.
Penalty structure
Article 99(3) fines non-compliance with the Article 5 prohibitions, including points (ba) and (bb), up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two for an SME.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 35,000,000
- Turnover percentage cap
- 7
Who enforces it
Enforcement body
National market surveillance authorities, at least one designated by each Member State under Article 70(1); the AI Office for an AI system within its exclusive competence under Article 75(1); the European Data Protection Supervisor for Union institutions, bodies, offices and agencies within the Regulation's scope, except the Court of Justice acting in its judicial capacity (Article 74(9)).
Settledness
- As of
- Open questions
- When is generation of the material in points (ba) and (bb) 'a reasonably foreseeable and reproducible outcome, without requiring significant technical modification' of a general-purpose image or video system under Article 5(1a), point (a)(ii), and which safeguards count as 'reasonable and adequate technical safety measures' that reliably prevent it?
- Which national law supplies the 'without right' defence that point (bb) preserves, and does a deployer's use of an AI system for material within Article 2, points (c) and (e), of Directive 2011/93/EU fall outside the prohibition wherever that defence applies?
What it makes you log
Logging duty
Neither point (ba) nor point (bb), nor paragraphs 1a and 1b, state a duty to create, keep, or produce a log or record.
- Kind
- None
- As of
Also on the record
Setting the rule reaches
General
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) inserts two further prohibited practices into Article 5(1)'s first subparagraph.
Point (ba) bans placing on the market, putting into service, or using an AI system that generates or manipulates realistic intimate imagery, video, audio, or similar material of an identifiable person, or of an identifiable person engaged in sexually explicit activity, without that person's freely given, specific, informed, unambiguous and explicit consent to the generation or manipulation.
Point (bb) bans the same conduct for AI-generated or AI-manipulated child sexual abuse material within the meaning of Directive 2011/93/EU, Article 2, points (c) and (e), unless a 'without right' defence applies under national law.
New paragraph 1a narrows both bans: placing on the market or putting into service is prohibited only where the prohibited generation or manipulation is the system's intended purpose, or where the system's design, training, architecture, capabilities or user-facing functionalities make it a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system lacks reasonable and adequate technical safety measures and other safeguards against it; use is prohibited only where the deployer uses the system for the purpose of generating or manipulating that material.
New paragraph 1b clarifies that manipulating already-existing material in a way that neither increases the exposure of any depicted intimate parts nor alters the nature of any depicted sexually explicit activity is not 'manipulation' for point (ba). Article 113, third paragraph, point (a), as amended, applies these two prohibitions from , later than the rest of Article 5.
Article 99(3) fines non-compliance up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, the same tier as the rest of Article 5.
When LexLint raises it
When your app profile says your app generates audio with AI, generates images with AI or generates video with AI.
Back to the example · Lint your app
Page updated .