The Rules That Arrive Before 2028
The Digital Omnibus is often described through its delayed high-risk dates, but Regulation (EU) 2026/1744 also adds protections that apply earlier. This chapter focuses on the rules taking effect on 2 December 2026: the prohibition on specified non-consensual intimate and child sexual abuse material, the different tests for providers and deployers, and the amended duties and permissions for AI literacy and bias correction. The practical value is knowing what the delay does not postpone, without turning a carefully scoped rule into a claim that every generative AI system is banned.
Article 5 draws a hard line around specified harmful practices
The amended Article 5 prohibits placing on the market, putting into service, or using an AI system that generates or manipulates realistic images, videos, audio, or similar material showing an identifiable natural person’s intimate parts or that person engaged in sexually explicit activity without freely given, specific, informed, unambiguous, and explicit consent. It also prohibits the relevant placing on the market, putting into service, or use of an AI system that generates or manipulates material or a performance covered by the EU rules on combating child sexual abuse, except where a “without right” defence applies under national law.
The new points apply from 2 December 2026. They respond to a real change in the technology landscape: systems can make intimate or sexual material at speed and scale, while the resulting harm can reach dignity, autonomy, privacy, safety, and fundamental rights. The Commission’s political-agreement announcement described the measure in shorter language as a ban on “nudification” applications and child sexual abuse material. The final regulation is more exact about what is prohibited, who can be responsible, and what falls outside the scope.
The first boundary is realism and identifiability. The intimate-material rule is aimed at realistic depictions of an identifiable natural person. It does not automatically cover cartoonish or physically impossible depictions, a person who cannot be identified, or every form of nudity. The recitals also distinguish material in which intimate parts are not exposed, realistic partial nudity that does not reveal them, and non-realistic artistic nude work. These distinctions do not make the conduct harmless; they define the legal reach of this particular AI Act prohibition.
Consent is another boundary. The rule is directed at material generated or manipulated without the depicted person’s freely given, specific, informed, unambiguous, and explicit consent. The recitals give examples of lawful contexts that are not automatically captured, including try-on applications and certain medical uses, while stressing that other fundamental-rights, data-protection, and medical-law requirements may still apply. Consent is therefore not a general permission slip for any use of a person’s image. It is one element in the statutory scope, and the nature of the system and activity still matters.
The rule also distinguishes a change in appearance from a change in exposure or sexual activity. Manipulating pre-existing intimate material by changing its background, adding a heading, or improving contrast or brightness does not constitute the prohibited manipulation if it does not increase the exposure of intimate parts or alter the nature of sexually explicit activities. By contrast, a manipulation that increases exposure or changes the sexual activity falls within the stated boundary. The point is not to create a technical checklist for every editing function, but to show why the legal question concerns the effect of the manipulation.
The provider and deployer tests then separate responsibility along the AI supply chain.