EU AI Act Nudification Ban + Watermarking: December 2, 2026 Compliance Checklist

EU AI Act Nudification Ban + Watermarking: December 2, 2026 Compliance Checklist

Two new obligations apply from December 2, 2026 under the EU AI Act Omnibus agreement reached May 7, 2026:

Formal adoption of the Omnibus regulation is expected before August 2, 2026. Both obligations take effect December 2, 2026 regardless of your organisation's size.

What the nudification ban covers

The Omnibus agreement bans AI systems whose primary purpose is generating:

• Sexually explicit images, video, or audio of identifiable real people without their consent
• Child sexual abuse material (CSAM)

The ban extends to placing these systems on the EU market — not just operating within the EU. A provider based outside the EU that makes such a system available to EU users is in scope.

Primary-purpose test: A general-purpose image generator that can produce explicit content as a secondary capability is not automatically banned. The regulator looks at what the system is primarily designed and marketed to do. Systems explicitly built to undress or sexualise real people — regardless of where the server sits — are banned.

Exception: The agreement includes a carve-out for systems implementing effective safety measures that prevent the prohibited outputs. A model with robust refusal mechanisms and content filters may fall outside the ban even if explicit generation is technically possible.

What you need to check

• Do you operate or distribute an AI system whose primary use case is generating sexual imagery of real people?
• Does your system include deepfake or "undressing" functionality targeted at real individuals?
• Are CSAM safeguards in place at the model and API layer?

Two or more "yes" without effective safety measures = ban applies. Exit the EU market or rebuild the system before December 2, 2026.

What AI watermarking requires

From December 2, 2026, providers of AI systems that generate synthetic content must attach machine-readable marks to:

• Audio
• Images
• Video
• Text (new addition in the Omnibus vs. the original Act)

These marks must allow automated detection of whether content was AI-generated or AI-manipulated. Visible labels such as "AI-generated" text overlays are not sufficient — the watermark must be detectable by machine without human inspection.

Technical standards

The Commission published draft transparency guidelines on May 8, 2026, with stakeholder consultation open until June 3, 2026. Final technical specifications will be published before August 2, 2026. Monitor:

• EU Commission transparency guidelines consultation
• Code of Practice on marking and labelling of AI-generated content

Provider checklist

• Identify all AI systems you place on the EU market that generate audio, image, video, or text
• Audit whether current outputs carry machine-readable watermarks (C2PA or equivalent)
• Document your watermarking method and its robustness to basic processing (resize, re-encode, convert)
• Build watermark detection into your content moderation pipeline
• Track Commission technical guidance updates — final specs expected before Aug 2, 2026

Deployer checklist

• Identify third-party AI-generated content you expose to end users
• Implement disclosure to users that content was AI-generated (at or before point of exposure)
• For deep fakes: add explicit disclosure regardless of source
• For AI-generated publications on matters of public interest: add disclosure
• For emotion recognition or biometric categorisation: add disclosure at point of use

Timeline

Who enforces this

Nudification and watermarking obligations fall under the GPAI enforcement framework (Article 50 and related provisions). Enforcement powers activate August 2, 2026. The national market surveillance authority in the member state where the provider is established — or, for non-EU providers, the authority where the system is primarily distributed — has jurisdiction.

Penalties:

• Up to €15 million or 3% of worldwide annual turnover, whichever is higher
• Market surveillance authorities can require removal from the EU market
• Repeat violations carry escalating fines

Practical next steps for small teams

1. Audit your product list — identify any system that generates images, video, audio, or text for EU users
2. Run the primary-purpose test on image/video generators — would a regulator describe it as primarily for generating explicit content?
3. Assess your watermarking stack — are you already using C2PA or a similar standard? If not, start now; implementation takes time
4. Monitor the Commission's June 3 consultation output — technical specifications will define what "machine-readable" means in practice
5. Set a hard internal deadline of October 1, 2026 for watermark implementation — two months before the December 2 deadline gives time to fix failures

Related reading

• EU AI Act deadline extended to December 2027 — full Omnibus timeline
• GPAI enforcement August 2026 — enforcement powers that activate in August
• EU AI Act compliance guide for small teams — full obligation map

References

1. European Parliament — AI Act: deal on simplification measures, ban on "nudifier" apps
2. EU Commission — Commission opens consultation on draft guidelines for AI transparency obligations
3. Medianama — EU bans AI nudification apps, delays high-risk AI enforcement
4. TechPolicy.Press — What the EU AI Omnibus Deal Changes for the AI Act