Mandatory Watermarking and Absolute Ban on Sexual Deep Fakes: The New EU Directives on Artificial Intelligence

The European Union intends to tighten regulations on content generated by artificial intelligence. The provisional agreement between the European Parliament, EU Council, and Commission updates the so-called "AI Omnibus," which is the regulatory package intended to redefine the timelines and obligations introduced by the AI Act.

The most significant change involves the introduction of a new explicit ban: AI systems will not be allowed to be placed on the market, distributed, or used to create sexual deep fakes and non-consensual intimate content, including images, videos, and audio, as well as material involving child sexual abuse. This represents an important extension compared to the original text of the AI Act, which did not include a specific halt on this category of content.

In particular, platforms and applications known as nudifier, software capable of manipulating real photographs to generate fake nudes or artificial pornographic content, are now under scrutiny. The ban affects not only the developers who design these systems but also the providers who distribute them without adequate technical protection measures and users who deliberately exploit them to produce this type of material.

Companies will have until December 2, 2026 to implement filters, blocks, and security systems that prevent the generation of such content. The same date will also mark the start of the watermarking obligation for all content produced by AI, including texts, images, audio, and video, through watermarks or equivalent systems that certify their artificial origin.

The AI Omnibus also intervenes on the application timeline for regulations related to high-risk systems, one of the more technical and complex sections of the AI Act. Provisions related to systems operating in areas such as biometrics, critical infrastructures, education, employment, essential services, justice, and border management have been postponed from 2026 to December 2, 2027. This deferral arises from the lack of comprehensive guidelines, deemed necessary by providers and companies to adapt infrastructures, compliance processes, and technical documentation.

For another category, namely AI systems integrated as security components in products regulated by European sectoral legislation, such as elevators, toys, or other devices under market surveillance, the new deadline is set for August 2, 2028.

The basic structure of the AI Act remains unchanged, classifying systems according to four increasing levels of risk: minimal, limited, high, and unacceptable. Systems deemed to have unacceptable risk are banned, high-risk systems must comply with stricter obligations, while limited-risk platforms must at least ensure transparency.

Another technical aspect concerns the so-called "regulatory sandboxes," which are regulated and protected environments that each Member State must activate by August 2, 2027. These structures will allow companies and startups to test new models, services, and AI applications in a context supervised by authorities, aiming to foster innovation and regulatory compliance.

The agreement must now receive formal final approval by August 2, 2026. Otherwise, the original deadlines outlined in the AI Act will become valid again. With this update, Brussels aims to strengthen protection against one of the most contentious uses of artificial intelligence, especially concerning the protection of women, minors, and victims of digital abuse.