Skip to content
LegalTech Lab LawTechnologyBusiness

Blog

Two new AI Act prohibitions apply from 2 December 2026

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026 and published in the Official Journal on 24 July 2026. It amends the Artificial Intelligence Act, Regulation (EU) 2024/1689. Most commentary has concerned the extra time granted to providers of high-risk AI systems. The provision that binds soonest runs in the opposite direction: two new entries in the list of prohibited practices in Article 5, applying from 2 December 2026.

What the two prohibitions cover

New Article 5(1), point (ba), prohibits placing on the market, putting into service or using an AI system that generates or manipulates realistic images, videos, audio or similar material showing an identifiable natural person’s intimate parts, or that person engaged in sexually explicit activities, without that person’s freely given, specific, informed, unambiguous and explicit consent. Recital 11 identifies the applications concerned as the tools commonly described as nudification applications.

New point (bb) prohibits systems that generate or manipulate material or performances within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU on combating the sexual abuse and sexual exploitation of children, except where a defence of acting without right applies under national law. Recital 13 preserves generation by authorities for the purpose of criminal proceedings, and red-teaming, meaning adversarial testing carried out to check whether a system complies with the prohibition.

Under Article 99(3), breach of a prohibited practice carries administrative fines of up to 35 million euro or 7 per cent of total worldwide annual turnover for the preceding financial year, whichever is higher.

When a system falls inside the prohibition

Article 5(1a) limits the reach of both new points. Placing on the market or putting into service is prohibited only where that generation or manipulation is the intended purpose of the system, or where the system’s design, training, architecture, capabilities or user-facing functionalities make the output a reasonably foreseeable and reproducible result without significant technical modification, and the system lacks reasonable and adequate technical safety measures to prevent it reliably and to correct observed or reported misuse. Use is prohibited only where the deployer uses the system for that purpose.

A general image or video tool is therefore not caught automatically. A provider whose system can produce such output without significant modification must show both preventive safeguards and a working route for acting on reports of misuse. Article 5(1b) adds that editing which does not increase the exposure of depicted intimate parts, or alter the nature of depicted sexually explicit activities, is not manipulation for point (ba); recital 12 names changing a background or adjusting contrast.

The timetable that moved the other way

The same amendment replaced point (c) of the third paragraph of Article 113. Sections 1, 2 and 3 of Chapter III, which carry the substantive obligations for high-risk AI systems, now apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for systems classified under Article 6(1) and Annex I. The stated reasons are the delayed availability of harmonised standards and guidance, and the delayed establishment of national competent authorities.

Brando Benifei, one of the Parliament’s lead negotiators on the AI Act, told the EU AI Act Conversations podcast that a prohibition was chosen because “the gradual implementation of GPAI risk management until now has proven sometimes too slow.” The point to watch is whether the Commission publishes guidance on the scope of Article 5(1a) before 2 December 2026. Without it, the question of which mainstream generative tools carry adequate safeguards falls to national market surveillance authorities, one provider at a time.

Sources: Regulation (EU) 2026/1744 (Digital Omnibus on AI); Regulation (EU) 2024/1689 (AI Act), consolidated text as at 27 July 2026; The EU AI Act Newsletter and Podcast, interview with Brando Benifei.