On 2 December the AI Act bans nudification tools. If your product makes images, the test covers you too

The amendments to the AI Act adopted in July did more than push back the high-risk deadlines. Regulation (EU) 2026/1744 also adds a new item to the list of banned AI practices, and that ban applies from 2 December 2026, four weeks from now.

The ban covers two kinds of AI system. The first creates or alters realistic images, video, audio or similar material showing an identifiable person's intimate parts, or that person in sexually explicit activity, without their freely given, specific, informed, unambiguous and explicit consent. The second creates child sexual abuse material. Selling, putting into service and using such a system are all prohibited.

Why a normal company should read this

Nobody expects a marketing agency or a software house to build a nudification app on purpose. The regulation's provider test goes further than intent, though. A provider breaks the ban in two cases: when generating such material is the system's intended purpose, or when the design, training or features make it a reasonably foreseeable and reproducible result without significant technical changes, and the system lacks reasonable and adequate safeguards to reliably prevent it and to correct misuse that is observed or reported.

So the question for any product that generates or edits images, video or voice is simple: if a user tries to make a sexual image of a real person, what stops them? The regulation's recitals list the kinds of safeguards it has in mind: data cleaning, refusal training, prompt guardrails, output filtering and classification, usage restrictions, abuse detection and a way for people to report misuse. They count as adequate if they match the state of the art and demonstrably cut the risk.

For companies that only use such tools, the bar is narrower. A deployer breaks the ban only when it uses a system for the purpose of creating this material. Edits that do not increase the exposure of intimate parts or change the nature of what is shown do not count as manipulation under the ban.

Breaking any of the banned practices carries the AI Act's highest fines: up to 35 million euros or 7% of worldwide annual turnover, whichever is higher. For small and medium-sized companies the cap is whichever of the two is lower.

A second deadline on the same day

2 December also ends a grace period. Providers of systems that generate synthetic audio, images, video or text and that were on the market before 2 August 2026 must meet the AI Act's machine-readable marking requirement by that date. If your company built a chatbot, an image tool or a voice feature before August and offers it under its own name, check whether its output is marked.

What changed for AI literacy

The same regulation rewrote the AI literacy duty in Article 4. The old text required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff. The new one, in force since 27 July, requires them to take measures to support their staff's AI literacy, and says outright that no specific level has to be guaranteed for any individual. The duty did not disappear. Every company that uses AI still has to show what it did for the people who use it, matched to their role and to the people the system affects.

What to do on Monday

• ✳List every product or feature you offer that generates or edits images, video or voice, including those built on another company's model
• ✳For each one, try the obvious misuse: ask it for an explicit image of a real, named person. Write down what happened
• ✳If it worked, add or switch on refusal rules and output filtering before 2 December, and give users a way to report misuse
• ✳Check that anything you launched before August marks its output in a machine-readable way by 2 December
• ✳Add a line to your internal AI rules that staff must not use any tool to create sexual or intimate images of real people
• ✳Write down what you already do for staff AI literacy: training, guidance, who received it. That record is what the new Article 4 asks you to be able to show

Companies that only use AI tools will mostly find nothing to fix. The ones that build creative or marketing tools should test this week, while there is still time to ship a fix.