On 5 October 2026, the Berlin think tank Agora Digitale Transformation published research finding that 50 members of the European Parliament had been targeted by sexualised deepfakes made with AI "nudifier" apps. Of those 50, 46 were women, according to EUobserver's report. Days earlier, 119 MEPs from the S&D, Renew Europe, The Left and the Greens backed a Greens-initiated open letter. It asks the Commission and member states to make sure the AI Act's new ban on nudifier apps works in practice from 2 December 2026.
The ban is already law. The question the letter raises is whether anyone will be ready to enforce it. That is where this debate should focus.
The strongest case for the MEPs
The argument for urgency is serious. Non-consensual sexual imagery is a form of abuse that works by silencing its targets. A separate Agora study from September, reported by EUobserver, found that one in 14 female politicians had been targeted, against one in 500 male politicians. When harassment is this gender-skewed, it narrows who can afford to enter public life. Defending speech includes defending the ability of women to take part in it without being digitally stripped in public.
Voluntary platform policies have also not been enough. In January 2026, IAPP reported that lawmakers were pressing the Commission on whether nudifier apps were illegal at all. A Commission official said the question "may fall under the AI Act's provisions", and one AI Act negotiator said an outright ban "was never envisioned in the law." Legal uncertainty, in other words, was the status quo until this year.
What the law now says
Parliament's March 2026 position proposed a new ban on systems that create sexually explicit or intimate images resembling an identifiable real person without consent. It was adopted by 569 votes to 45, with 23 abstentions. It would not apply to systems with effective safety measures.
The co-legislators then struck a provisional deal on 7 May 2026. Parliament's press release says the ban covers AI systems that create child sexual abuse material or depict the intimate parts of an identifiable person without consent. It applies to three groups:
- providers placing on the EU market systems whose purpose is to create such content
- providers placing on the market systems without reasonable safety measures to prevent it
- deployers using such systems for that purpose
Companies, the release says, have until 2 December 2026 to comply. The text was published in the Official Journal on 24 July 2026 as part of the Digital Omnibus on AI. Paul Weiss's client memo notes that the prohibition reaches beyond purpose-built nudifier apps to general-purpose generative AI whose providers lack reasonable safeguards.
That design is sensible. It targets a harm and a missing safeguard rather than a technology category. A model that can edit photos is not banned. A model sold to undress people, or shipped without reasonable protection against it, is.
Where the real risk lies
The MEPs want the Commission to guide national authorities and every member state to have a designated, resourced enforcement body ready by 2 December. Reports say a Commission spokesperson answered that it would be ready to enforce "from day one." That is reassuring but vague. None of the public sources reviewed for this piece describes the national enforcement set-up, and the Parliament's deal announcement names no penalties or authorities.
There are three practical problems.
Fragmentation. The AI Act relies on national market surveillance authorities. If some states designate a body and others do not, nudifier operators will simply serve users from the weakest jurisdiction. Many of these apps are hosted outside the EU anyway, so enforcement leans on app stores, payment processors and hosting providers.
Ambiguity at the margin. "Reasonable safety measures" is a standard, not a bright line. Without Commission guidance, a developer of a legitimate image-editing tool cannot know what compliance looks like. Regulators cannot know either. Vague standards produce two failures at once: cautious firms over-block lawful editing and art, while bad actors exploit the grey area.
Capacity. Authorities that must police a new prohibition, with no added staff, tend to pick easy cases. They go after identifiable EU firms and leave anonymous offshore operators alone.
A proportionate path
A pro-innovation reading of this episode does not argue against the ban. It argues for making the ban precise and enforceable, rather than adding new mandates on top of it. Concretely:
- Publish guidance before 2 December. The Commission should define what "reasonable and adequate" safeguards mean for general-purpose models, including examples of compliant design, so that legitimate developers can comply with confidence.
- Name the authorities. Each member state should publicly designate its enforcement body and publish a contact point for victims, so there is a place to report abuse from day one.
- Go after the choke points. Enforcement should focus on commercial distributors, app-store listings and payment flows. It should not drift into broad monitoring of private communications or scanning of user content, which would raise its own speech and privacy costs.
- Measure results. Publish enforcement data, such as the number of apps removed and complaints resolved, so the ban can be judged by outcomes rather than announcements.
The Agora findings show the harm is concrete and already happening to the people who write EU law. The ban is a narrow, defensible tool. Whether it works depends less on further legislation than on boring administrative readiness in the next few weeks.