THE BOTTOM LINE
- New Criminal Liability: As of 6th February 2026, it is a specific criminal offence in the UK to create, or even request the creation of, an AI-generated or “deepfake” intimate image of an adult without their consent.
- Heightened Platform Risk: Technology companies, particularly those developing AI image generators or hosting user-generated content, face significant new legal and reputational risks. Robust content moderation and user policies are now business-critical.
- Expanded Employee Misconduct: This legislation creates a new category of serious misconduct. Businesses must ensure their IT and HR policies are updated to address the potential use of company resources for creating or sharing such illegal content.
THE DETAILS
New regulations have brought a critical section of the Data (Use and Access) Act 2025 into force, directly addressing the rise of AI-generated explicit material. Effective from 6th February 2026, the law now specifically criminalises the creation of “purported intimate images” of adults. This closes a legal loophole and targets deepfake pornography by amending the Sexual Offences Act 2003. The core of the offence is the lack of consent from the individual depicted. This legislative move signals that law enforcement and the courts are now equipped to tackle this harmful form of digital abuse head-on.
The new law establishes two distinct offences. The first makes it illegal to create a fake intimate image of an adult. The second, crucially, also criminalises requesting that such an image be created. This dual approach aims to disrupt the entire supply chain, from the end-user generating the content to those commissioning it. To underscore the seriousness of these offences, the legislation also extends the time limit for prosecutions, allowing cases to be brought up to three years after the offence was committed, giving victims more time to come forward.
For business leaders and corporate counsel, the implications extend beyond the technology sector. While AI developers and social media platforms are on the front line, any company could be affected. The legislation empowers courts to issue “deprivation orders”, allowing for the confiscation of devices like laptops and phones used to commit the offence. This raises the stakes for any business whose equipment is used by an employee for such an activity. It is imperative for all organisations to review their acceptable use policies and employee codes of conduct to mitigate the significant legal, financial, and reputational damage that could arise from being linked to this new criminal activity.
SOURCE
The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026
