The EU AI Act’s list of prohibited AI practices — the eight absolute bans under Article 5 — was supposed to be exhaustive. As of March 2026, it isn’t. Lawmakers, responding to an explosion of “nudifier” apps and AI-generated non-consensual intimate imagery (NCII), have added a ninth prohibition: AI systems designed to generate sexually explicit imagery of real identifiable persons without their consent. This is what you need to know.
- The prohibition on AI-generated non-consensual explicit imagery was adopted as part of the Digital Omnibus package’s emergency amendment provisions — these specific provisions entered into force immediately upon the committee vote on 18 March 2026, pending formal plenary ratification.
- This applies to AI systems that generate such content — not to platforms that host it (which is covered by other legislation including the DSA and CSAM Directive).
- Our free risk assessment tool has been updated to reflect this ninth prohibition.
1. What the New Prohibition Says
The amendment adds a ninth category to Article 5’s list of prohibited AI practices. In its adopted committee text, it reads:
Breaking this down into its operative elements:
2. Why Now? The Scale of the Problem
The amendment was driven by a rapid acceleration in the availability and use of “nudifier” applications — AI tools that take photographs of clothed individuals and generate sexually explicit synthetic images depicting those persons undressed. The technology, which was computationally expensive and required specialist knowledge as recently as 2023, became accessible as a consumer smartphone app and web service through 2024 and 2025.
The European Parliament’s own research service published findings in late 2025 estimating that non-consensual intimate imagery created using AI affected millions of EU citizens annually — with women and girls disproportionately targeted. High-profile cases involving public figures in several member states generated significant political pressure for legislative action ahead of the election cycle.
The original Article 5 prohibition list (adopted in 2024) had not explicitly addressed this use case. While some member states argued that existing criminal law on intimate image abuse already covered AI-generated NCII, the committee concluded that an explicit EU AI Act prohibition was necessary to: (1) catch providers who are not themselves the end-users; (2) create a uniform standard across all 27 member states; and (3) impose penalties at the commercial scale appropriate for AI system providers, not just individual perpetrators.
3. What Falls Within Scope — and What Does Not
4. How This Interacts with Existing Law
The new EU AI Act prohibition sits alongside — and should be read with — several pre-existing legal frameworks that already address aspects of this problem:
| Legal Framework | What It Covers | Gap Filled by New AI Act Prohibition |
|---|---|---|
| Violence Against Women Directive (2024) | Criminalises non-consensual sharing of intimate images — applies to those who distribute NCII | Does not cover AI system providers who create tools specifically for NCII generation |
| Digital Services Act | Requires platforms to remove illegal content including NCII promptly once notified | Does not address AI systems that generate NCII before it reaches platforms |
| GDPR (Article 9) | Processing biometric data (including facial images) to generate synthetic content requires explicit consent | Applies to data processing but is not specifically targeted at AI generation systems |
| National criminal laws | Many member states criminalise NCII creation and distribution at individual level | Criminal laws target users, not commercial AI system providers. No uniform EU standard existed before this prohibition. |
