From the journal

United Kingdom Criminalises Supply of AI Intimate Image Generators from 29 June 2026

Section 99 of the Crime and Policing Act 2026 inserted new sections 66I to 66L into the Sexual Offences Act 2003, creating an offence of making, adapting, supplying or offering to supply a thing designed for use as a generator of purported intimate images. The provision came into force on 29 June 2026 under the Crime and Policing Act 2026 (Commencement No. 1 and Saving Provision) Regulations 2026. Conviction on indictment carries up to three years imprisonment and an unlimited fine.

2 min read

The Crime and Policing Act 2026 received Royal Assent on 29 April 2026 as chapter 20. Section 99 of that Act, headed Purported intimate image generators, creates a criminal offence aimed at the tools that produce synthetic sexual imagery rather than at the images alone. Section 99 was commenced on 29 June 2026 by the Crime and Policing Act 2026 (Commencement No. 1 and Saving Provision) Regulations 2026, so the offence is live law.

Section 99 inserts sections 66I to 66L into the Sexual Offences Act 2003. New section 66I makes it an offence to make, adapt, supply or offer to supply a thing designed for use as a generator of purported intimate images. New section 66J sets out further defences covering crime prevention, law enforcement, the security services and regulatory functions. New sections 66K and 66L deal with internet service provider liability and corporate responsibility. Conviction on indictment carries up to three years imprisonment, an unlimited fine, or both, and a sentence of twelve months or more brings the offender within the notification requirements in Part 2 of the Sexual Offences Act 2003.

Developers and distributors of nudification applications are the direct target. App stores, model hosts and payment providers that supply or offer to supply those tools fall within the same statutory wording, because the offence attaches to supply rather than to use. Open weight model distributors and fine tuning services that market a product for that purpose sit inside the same description.

A person who took reasonable steps to prevent the thing being used to create images without consent has a defence. Home Office guidance on the Act is published as Circular 004/2026. The reach of the offence over general purpose image models that are capable of producing that output but are not designed for it turns on the design wording in section 66I, which has not yet been tested in a reported prosecution.

Licentium advises technology developers, platforms and online services on criminal and regulatory exposure arising from generative systems. Work we undertake includes product classification opinions, offence exposure reviews, law enforcement and takedown correspondence, and design stage advice on statutory defences.

Source: Crime and Policing Act 2026, section 99 (legislation.gov.uk)

More from the journal

See all

Software escrow for South African AI supplied to an Irish bank

A Cape Town AI supplier offers source-code escrow to an Irish bank that depends on its fraud-alert service. The bank needs a way to continue operating after supplier failure, but the software also depends on licensed model technology and cloud services. A workable arrangement requires a recoverable deployment, permission to operate it and an alternative when a necessary dependency cannot survive the supplier.

AI debt collection from India and the UK authorisation boundary

A Pune company supplies an AI debt collection system to a UK consumer-credit lender authorised by the Financial Conduct Authority (FCA). The system drafts reminders, schedules contacts and proposes repayment options, while the lender approves customer communications and decides forbearance. The supplier wants a later version to contact borrowers and negotiate within lender-set limits. The recommended first release keeps collection activity with the lender; the supplier-operated version needs a different permission and operating structure.

Crypto Travel Rule failures between a Brazilian provider and an Irish CASP

A Brazilian virtual-asset provider wants to transfer business customers' crypto-assets to an Irish crypto-asset service provider, or CASP. The assets reach the receiving address with incomplete originator information and a legal-entity name that does not match the recipient account. The sender demands immediate release because the blockchain transfer is final. The Irish receiver should hold customer availability while it resolves the identities and missing data, then make a documented release or return decision.