EU AI Act Bans Sexual-Deepfake and CSAM Generators from 2 December
The EU's AI Omnibus adds new AI Act prohibitions on AI systems that generate non-consensual sexually explicit content and child sexual abuse material. The Commission confirmed they apply from 2 December 2026, 28 days from today. Today's Focus: AI Governance · Wednesday, 4 November 2026
Why It Matters
These are prohibitions, not transparency duties. Prohibited AI practices sit in the AI Act's most severe enforcement tier, so confirm penalty exposure with counsel. Any provider or deployer whose product can generate sexual imagery of real people, or that could be misused to do so, needs to confirm it is not caught before the date. The same Omnibus postponed the high-risk system rules to 2 December 2027 (2 August 2028 for AI in regulated products), so this is the near-term obligation in the package.
The Commission's 31 July release is the primary source; the Omnibus text and any guidance on scope are what to watch next.
Also Today
California EO N-9-26: the Government Operations Agency, with CalOES, must deliver recommendations to the Governor by 16 November (12 days) on independent verification of frontier developers, a frontier-model "kill switch" and wider loss-of-control incident reporting. The order creates no new duty by itself, but it signals where state law may go. Frontier developers: map your safety-framework and incident-reporting practices against those four topics.
Colorado ADMT rules: the AG held its rulemaking hearing on 26 October and the coag.gov page shows nothing adopted yet. Rules are due before 1 January 2027 (58 days), when the ADMT Act and Chatbot Safety Act take effect. Check coag.gov/ai for adopted text.
New York RAISE Act: NY DFS said on 21 September that large frontier developers will be directed to register "starting in November"; compliance and disclosure filings begin 1 January 2027. No registration day has been published. Confirm whether you meet the coverage threshold.
Action Items
Screen generative products — Before 2 December, test whether any image, video or text-to-image feature can produce non-consensual sexual content or CSAM, and document the safeguards.
Brief your EU counsel — Ask whether your system falls under the new prohibition and what the Omnibus text says on scope.
Calendar the next dates — 16 November (California recommendations), 2 December (EU prohibitions), 1 January 2027 (Colorado and New York).
Get the full analysis. Pro subscribers receive the complete deep dive, all 5 action items, source documents, and jurisdiction-specific compliance checklists.
Subscribe to Pro to read the rest.
Become a paying subscriber of Pro to get access to this post and other subscriber-only content.
UpgradeA subscription gets you:
- Deep dives of each updated regulation
- Source verification documents
- Extended jurisdiction-specific analysis
- Compliance deadline tracker
- Regulation crosswalk