LexLint

Know the law your code answers to.

Law / European Union

AI Act, Article 5(1)(ba) and (bb) (AI-generated non-consensual intimate imagery and child sexual abuse material)

Regulation (EU) 2024/1689, Article 5(1), first subparagraph, points (ba) and (bb)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

An AI prohibited practices rule binding public and private bodies.

As of 23 September 2026.

What it requires

  • Do not place on the market, put into service, or use an AI system that generates or manipulates realistic images, video, audio, or similar material depicting an identifiable person's intimate parts, or an identifiable person engaged in sexually explicit activity, without that person's freely given, specific, informed, unambiguous and explicit consent to that generation or manipulation.
  • Do not place on the market, put into service, or use an AI system that generates or manipulates child sexual abuse material within the meaning of Directive 2011/93/EU, Article 2, points (c) and (e), unless a 'without right' defence applies under national law.
  • Placing such a system on the market or putting it into service is only prohibited where the generation or manipulation is the system's intended purpose, or where its design, training, architecture, capabilities, or user-facing functionality make that outcome a reasonably foreseeable and reproducible result the system lacks adequate safeguards against.
  • Using such a system is only prohibited where you, as deployer, use it for the purpose of generating or manipulating that material.
  • Manipulating already-existing material without increasing the exposure of intimate parts already depicted, or without altering the nature of sexually explicit activity already depicted, is not 'manipulation' for the intimate-imagery prohibition.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

The Regulation's own remedy for these two prohibitions is the Article 99(3) administrative fine. Directive 2011/93/EU separately criminalises the production and possession of child sexual abuse material under national law; that criminal exposure belongs to that Directive, not to this Regulation.

Penalty structure

Article 99(3) fines non-compliance with the Article 5 prohibitions, including points (ba) and (bb), up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two for an SME.

Rule
Lower of for SME
As of
23 September 2026
Currency
EUR
Fixed cap
35,000,000
Turnover percentage cap
7

Who enforces it

Enforcement body

National market surveillance authorities, at least one designated by each Member State under Article 70(1).

What it reaches

How the hook was established

express

What makes it apply

Market targeting, Operator establishment, Place of effect

Obligation class

Prohibition

What it makes you log

Logging duty

Neither point (ba) nor point (bb), nor paragraphs 1a and 1b, state a duty to create, keep, or produce a log or record.

Kind
None
As of
23 September 2026

Who checks it

Audit expectation

none

Also on the record

EEA status

Status
Pending
Source link
https://www.efta.int/eea-lex/32024r1689

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) inserts two further prohibited practices into Article 5(1)'s first subparagraph.

Point (ba) bans placing on the market, putting into service, or using an AI system that generates or manipulates realistic intimate imagery, video, audio, or similar material of an identifiable person, or of an identifiable person engaged in sexually explicit activity, without that person's freely given, specific, informed, unambiguous and explicit consent to the generation or manipulation.

Point (bb) bans the same conduct for AI-generated or AI-manipulated child sexual abuse material within the meaning of Directive 2011/93/EU, Article 2, points (c) and (e), unless a 'without right' defence applies under national law.

New paragraph 1a narrows both bans to cases where the prohibited generation or manipulation is the system's intended purpose, or a reasonably foreseeable and reproducible outcome of its design that the system lacks adequate safeguards against, and confines the use-side ban to a deployer who uses the system for that purpose.

New paragraph 1b clarifies that manipulating already-existing material without increasing the exposure of depicted intimate parts, or without altering the nature of depicted sexually explicit activity, is not 'manipulation' for point (ba). Article 113, third paragraph, point (a), as amended, applies these two prohibitions from 2 December 2026, later than the rest of Article 5.

Article 99(3) fines non-compliance up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, the same tier as the rest of Article 5.

When LexLint raises it

  • generates_content
  • publishes_adult_content

Read the law

official consolidated Official Journal text of Regulation (EU) 2026/1744, EUR-Lex

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app