2 December 2026: New AI Act Bans and the Marking Deadline

On 2 December 2026, two sets of EU AI Act rules on AI-generated content take effect. New prohibitions ban AI systems that generate child sexual abuse material or non-consensual intimate deepfakes, and providers of generative AI systems already on the market before 2 August 2026 must mark their outputs in a machine-readable way. Both changes come from the Digital Omnibus on AI (Regulation (EU) 2026/1744), and there are six weeks left to prepare.

Two new prohibitions

The Omnibus adds two points to the list of prohibited AI practices in Article 5 of the AI Act (ActuIA summary):

• Non-consensual intimate content. Systems that generate or manipulate realistic images, video or audio showing an identifiable person’s intimate parts or sexually explicit activity are banned, unless that person has given explicit consent.
• Child sexual abuse material. Systems that produce such material are banned. For providers, this applies where it is the intended purpose or a reasonably foreseeable outcome without adequate safeguards; for deployers, where the system is used for that purpose.

The second point matters for any company that offers image, video or audio generation. A provider cannot rely on its terms of use alone: if harmful output is a foreseeable result of weak safeguards, the system can fall under the ban. Prohibited practices carry the highest fines in the AI Act.

The marking deadline for existing systems

Since 2 August 2026, Article 50(2) has required providers of generative AI systems to mark audio, image, video and text output in a machine-readable format, so that it can be detected as AI-generated. Systems placed on the market before that date received a transition period, which ends on 2 December 2026.

The duty does not apply where a system only performs an assistive function for standard editing or does not substantially alter the input. Separate duties apply to deployers: disclosing deepfakes, labelling AI-generated text published on matters of public interest unless a person has reviewed it and someone holds editorial responsibility, and telling people when they are interacting with AI. We explain each of these in what AI transparency requires.

The Code of Practice shows how

In June 2026 the Commission published a voluntary Code of Practice on marking and labelling AI-generated content. Around 190 organisations had signed it by the end of July (Paul, Weiss). Signing is not conclusive proof of compliance, but it is currently the most direct way to show it.

According to the same analysis, the Code asks providers to use at least two marking techniques for most output, for example signed, tamper-evident metadata combined with an imperceptible watermark, and to offer a detection mechanism that regulators, researchers, media and fact-checkers can use free of charge. Very short texts are exempt from watermarking. For deployers, the Code describes how visible labels should work and introduces three EU icons: for fully AI-generated content, for AI-modified content and a basic icon with a second, interactive layer.

What to check before 2 December

If you provide a generative AI system (including one built on a third-party model and offered under your name):

1. Confirm that every output channel, including APIs and exports, carries machine-readable marking.
2. Test that marking survives your normal processing, such as compression or format changes.
3. Review safeguards against intimate and sexual content involving real people and minors, and document them.
4. Decide whether to sign the Code of Practice or document your own equivalent measures.

If you use generative AI in your work:

1. Ask your vendors to confirm in writing how they meet Article 50(2); our questions to ask an AI vendor include this.
2. Agree internally when content needs a visible label, especially deepfakes and public-interest text.
3. Make sure your AI use policy bans creating intimate or sexual content of real people with AI tools, and that staff know how to report misuse.

The AIEI view

Synthetic media that imitate real people can cause serious and lasting harm, and the most vulnerable, including children, are often the first to be affected. The new prohibitions reflect a broad consensus, and machine-readable marking gives people a fair chance to know what is real. AIEI encourages providers not to treat 2 December as a box to tick but as a minimum, and to design generative systems with abuse prevention from the start.

Sources

• Regulation (EU) 2026/1744 (Digital Omnibus on AI)
• Regulation (EU) 2024/1689 (AI Act) – Articles 5, 50 and 111
• European Commission – Code of Practice on marking and labelling AI-generated content
• Paul, Weiss – EU finalises transparency rules for AI-generated content
• ActuIA – AI Act obligations in force and delays under Omnibus 2026/1744

This article is for general information and is not legal advice.