EU to ban AI nudify apps: new obligations for platforms and developers

A photo from a company LinkedIn profile or a private holiday snapshot is all it takes for a real person to become the victim of a so-called nudify app — a tool that generates a sexualised image within seconds without any consent. For the person depicted, this means long months of enforcing their rights against anonymous users, dubious servers and algorithms that spread content faster than courts can decide. For operators of platforms that provide any infrastructure for such content, it now means direct regulatory liability. On 12 May 2026, the European Parliament and the Council of the EU reached a political agreement on banning AI applications that allow sexualised images and videos of real people to be created without their consent. The new regime was set to take effect on 2 December 2026. For companies doing business in AI, social media and online platforms, a very concrete EU AI Act compliance countdown is beginning.

The political agreement and its scope

The subject of the agreement, concluded by negotiators of the European Parliament and the Member States on the night before Tuesday 12 May 2026, is an amendment to the artificial intelligence legislative package presented by the European Commission in November 2025. A key part is an express ban on placing on the EU market AI systems whose purpose is to create sexualised images and videos of specific people without their consent. Likewise, it is to be prohibited to place on the market systems that do not have this as their primary purpose but lack adequate safeguards to prevent precisely such misuse.

The agreement explicitly mentions two categories of target content: material depicting child sexual abuse, and material depicting the intimate parts of an identifiable adult or showing them engaged in sexually explicit activities without their consent. The definition is deliberately broad — it covers not only specialised nudify apps but also more general AI tools that offer this functionality as one of many options.

The ban was pushed into the proposal by Czech MEP Markéta Gregorová as shadow rapporteur in the Committee on Civil Liberties. The European Parliament supported the matter at its March 2026 plenary session, when MEPs gave the green light to trilogue negotiations with the Member States. The political agreement of 12 May 2026 is its outcome; before taking effect, it must still be formally confirmed by both institutions. According to the EP press release, this is to happen before 2 August 2026, when some provisions of the AI Act were originally due to start applying.

What platform and AI tool operators must check

For AI tool developers, social network operators, marketplaces and other online platforms, the new regime means an immediate compliance task. The key questions that need answering before 2 December 2026 can be divided into three areas.

The functionality of your own AI tool. If a company itself develops or distributes an AI system capable of generating image content from photographs of real people, it must check whether sexualised images can be produced among the outputs without user control. If so, technical measures must be deployed — from input filters (recognising the faces of real people) to output filters (detecting nudity and sexual content) or a combination of both. The aim of the regulation is not to ban AI image generation as such, but to penalise the absence of adequate safeguards.

Distribution of third-party AI tools. Operators of app stores, marketplaces, hosting services and similar platforms must look at which applications they offer their users to download or use. Applications explicitly marketed as "deepnude", "nudify" or similar tools are undoubtedly banned; the bigger challenge is tools that have legitimate functions but also allow abusive use. Standard compliance practice will require updating internal app approval rules, keyword screening and manual review of suspicious cases.

User-generated content on platforms. For operators of social networks and hosting services, AI regulation supplements existing obligations under the Digital Services Act (DSA). The practical consequence: notice-and-action mechanisms must be ready to handle reports of sexualised deepfake content as a priority and effectively. A platform that passively tolerates such content despite notice exposes itself not only to risk under the DSA but, from December 2026, also under the new AI regime.

The direct impact is the need to review the AI use-case catalogue, contractual documentation with suppliers of AI functionality (allocation of responsibility for technical measures) and terms of service for end users. Companies that use third-party AI tools in their services (typically via API integration) should obtain written confirmation of the safeguards the supplier has in place and who is responsible for updating them.

Stronger defence for victims — personality rights and the GDPR

The new regime is not primarily a procedural tool in the hands of victims but a market-regulation ban aimed at operators. Even so, its effects significantly strengthen the existing range of defences, which in the Czech legal system rests mainly on three pillars.

The first is protection of personality under Section 81 et seq. of the Czech Civil Code. Creating and disseminating a sexualised deepfake image of a real person is a typical interference with likeness (Section 84 of the Civil Code), dignity and privacy (Section 81(2) of the Civil Code). A court may order the interference to stop, the content to be removed from specific platforms and, in serious cases, award reasonable monetary satisfaction under Section 2956 of the Civil Code. The procedural problem so far has mainly been identifying the defendant and the speed at which content spreads, which had to be removed from dozens of servers in parallel.

The second pillar is personal data protection under the GDPR. A real person's likeness and, in some cases, biometric features under Article 9 of the Regulation are special categories of personal data. Processing without consent or another legal basis gives rise to a claim for compensation under Article 82 of the GDPR and empowers the Czech Office for Personal Data Protection to impose a penalty on the platform operator.

The criminal law dimension is supplemented by provisions on defamation, unauthorised handling of personal data, dissemination of pornography and — where the victim is a child — production and dissemination of child pornography. In expert discussion, the idea of adding a specific offence aimed directly at AI-generated sexualised content is gaining traction.

The new EU regime adds a fourth layer to these — administrative and regulatory pressure on operators and developers. The practical consequence for victims is significant: part of the defence shifts from slow court enforcement against anonymous perpetrators to pre-set obligations of players with an identifiable registered office and a strong market incentive to comply with the ban. For the firm's clients who seek help after deepfake content is published, this means a wider range of letters, complaints and lawsuits — against a specific platform, against the operator of the AI tool and, in parallel, under existing legal instruments.

Postponing other parts of the AI Act as part of simplification

Besides the nudify app ban, the political agreement of 12 May 2026 contains a second significant block — postponing the application of a number of AI Act provisions. The reason is pressure to simplify the regulatory framework and give companies more room to prepare for compliance. Specifically:

• The obligation to watermark audiovisual content generated by artificial intelligence was postponed to 2 December 2026.
• Obligations for high-risk AI systems expressly listed in the AI Act were postponed to 2 December 2027.
• Obligations for AI systems covered by EU sectoral legislation on safety and market surveillance were postponed to 2 August 2028.

For companies currently finalising AI compliance projects (dataset audits, risk management documentation, FRIA, decision traceability), this postponement does not mean a respite in the sense of "the obligation will come later, we don't need to deal with it". Rather, it means a deadline shift that serious companies will use for better preparation and less responsible ones for putting off the problem. For management, this creates a specific risk situation — postponing statutory application does not lower the contractual and reputational expectations of customers, investors or business partners.

At the same time, the postponement does not apply to the nudify app ban. That takes effect on 2 December 2026, i.e. within a relatively short horizon. Companies that need to prepare compliance steps in this area have roughly seven months for everything.

Practical steps for companies

If a company develops, distributes or operates any AI tool that allows images of real people to be processed, we recommend starting with the following steps before the summer break:

• Inventory of AI tools. Map all AI components that generate, modify or analyse images of people — in-house development, API integrations, plug-ins, marketplace items.
• Risk assessment for each tool. Assess whether the tool can be misused to create sexualised content without consent. If so, define technical measures (filters, content moderation, age verification, detection of real faces).
• Updating contracts with AI suppliers. Add guarantees of safeguards, allocation of responsibility and a notification duty for changes in functionality that could trigger the ban.
• Notice-and-action processes. Prepare internal rules for a rapid response to reports of sexualised deepfake content — ideally with a defined SLA of up to 24 hours for removal and parallel preservation of evidence for law enforcement authorities.
• Rules for end users. Update terms of service, AUP and community guidelines — expressly prohibit generating sexualised content without the consent of the person depicted.

The ban on AI nudify apps is another step in the European strategy for regulating AI, combining the protection of fundamental rights with a market-regulation tool against developers and distributors. For the law firm's clients, this carries a twofold message: anyone operating AI tools or online platforms that the new regime may affect has a considerable amount of compliance work to do by 2 December 2026. Anyone who has become a victim of AI misuse against their own person gains, in addition to existing personality rights lawsuits and complaints to the data protection authority, another lever — regulatory pressure on operators with identifiable market responsibility.

We are ready to advise clients on both levels — from auditing AI use cases and setting up supplier contracts to coordinated protection of victims across civil, regulatory and criminal proceedings.

Source: Advokátní deník, 12 May 2026 — The EU will ban nudify apps, representatives of the European Parliament and the Member States agreed (in Czech); European Parliament press release.