On 2 October 2026, a Commission spokesperson replied to a letter from more than 100 MEPs. The reply said the EU's ban on AI "nudifier" systems will apply from 2 December 2026 and be enforced from day one, with no transition period. Formal adoption is complete. The Council's final text of the Digital Omnibus on AI is dated 8 July 2026. It records the Parliament's position of 16 June 2026 and the Council's decision of 29 June 2026. The ban is a technology rule we can support because it is narrow. Whether it works depends on who can enforce it.
The strongest case for a hard ban
Skeptics of any ban on a category of software have a point: general-purpose image tools can be misused, and tool bans can sweep too wide. The case for acting anyway is strong. Nudifier apps have no plausible lawful mass-market use, and the harm falls on identifiable people. Euronews, citing the European Parliamentary Research Service, reports about 8 million deepfakes online in 2025. It also reports that women and girls make up 99 percent of deepfake victims. Co-rapporteur Michael McNamara described "a lacuna in the law" that existing rules did not cover. Platform notice-and-takedown alone leaves victims chasing copies after the harm is done. Prohibiting the tool upstream is a defensible answer.
What the law actually bans
The 7 May 2026 provisional deal was announced in a Parliament press release. It bans AI systems that create child sexual abuse material or depict the intimate parts of an identifiable person, or that person in sexually explicit activity, without consent. It reaches three things:
- Placing such systems on the EU market "with the purpose of creating such content".
- Placing them on the market "without reasonable safety measures to prevent such creation".
- Deployers who use them for that purpose.
This is a purpose-and-safeguards test, not a ban on image generation. Tech Policy Press reports that "identifiable" follows the GDPR definition. Fictional characters and certain artistic, cartoon and medical uses are excluded. Synthetic intimate material is allowed when every person depicted has consented. A Luxembourg data-protection official quoted there put it plainly: "This is not a strict prohibition." It targets intended purpose and use, "not the technology itself".
That design is why this ban compares well with broader AI rules. It names a specific harm, keeps legitimate creative and medical tools outside scope, and puts duties on those who build or market the abusive product.
Where proportionality could slip
One risk is the second limb, "without reasonable safety measures". Euronews describes developers of large-scale models as "directly responsible" if their systems are used to produce such images. It says they must assess "foreseeable misuse" and block bypasses through "clever prompts or minor image alterations". Reasonable safeguards are proportionate. An open-ended duty to prevent every bypass would not be, because no filter is perfect. It would push open-weight and smaller developers out of the EU while large incumbents absorb the compliance cost. The Commission's guidance should define "reasonable" as a documented, testable standard such as refusal training, output filtering and notice-and-action. It should not be judged by whether a determined attacker ever succeeded.
Shadow rapporteur Markéta Gregorová argued compliance costs will be "minimal" because most providers already block such images. If that holds, the burden falls where it should: on the few services built for abuse.
Enforcement is the weak link
The larger problem is capacity. Tech Policy Press reported in June that only eight member states had designated a market surveillance authority. It also reported that those bodies have limited powers until national legislation exists. Sadia Berdaï of Luxembourg's data-protection authority was blunt: "Until national laws are voted, we are not competent to enforce the AI Act." Italy and Denmark are named as having approved national laws that allow enforcement. Breaches of an AI Act prohibition can bring fines of up to €35 million or 7 percent of worldwide turnover, whichever is higher. That is a credible deterrent only if someone can impose it.
This is why the MEP letter matters. EU Today reports that 119 MEPs asked the Commission to enforce the ban as soon as it takes effect. It also reports that 147 European politicians, 138 of them women, were identified on websites hosting sexualised AI deepfakes. A "day one" promise is welcome. But a law enforced on paper by the Commission, with patchy national follow-through, would produce headlines and leave offshore sites untouched.
What good implementation looks like
- Name enforcers before 2 December. Every member state should designate its authority and give it real powers. The Commission should publish a short list of who handles complaints where.
- Publish the safeguards standard. Developers need a clear definition of "reasonable safety measures" so compliance is a checklist, not a guess.
- Target the supply chain. Enforcement should go first after dedicated nudifier apps, their app-store listings and payment channels, not general-purpose tools with working safeguards.
- Keep the consent test workable. Consent is defined as freely given, specific, informed, unambiguous and explicit. Legitimate adult-content and creative uses need a clear path.
The same package pushes high-risk AI obligations back to 2 December 2027 for stand-alone systems and 2 August 2028 for products. Delay on the compliance-heavy rules and speed on a targeted prohibition is the right pairing. It reserves strict enforcement for conduct that is plainly harmful, and it gives legitimate innovators time to prepare.
The EU has written a precise rule. The test through 2 December and beyond is whether regulators can use it.