EU AI Act's new deepfake and CSAM prohibitions set to bind from 2 December 2026
Providers of generative AI systems placed on the market before August 2026 must add machine-readable marking of synthetic content, while new bans on AI-generated non-consensual intimate images and CSAM become enforceable.
Summary
A guide published by futureagi.com sets out the revised EU AI Act timeline following the Digital Omnibus on AI, formally Regulation (EU) 2026/1744. According to the guide, the regulation was signed on 8 July 2026, published on 24 July and in force since 27 July 2026. It moved the high-risk rules and added a new step on 2 December 2026. The post states that it reflects the consolidated Act as of 1 November 2026 and is not legal advice.
The changes it describes are as follows. Obligations for Annex III high-risk systems now apply from 2 December 2027, and those covering Annex I products containing AI from 2 August 2028. Dates kept unchanged include February 2025 for prohibitions and AI literacy, August 2025 for general-purpose AI duties, and 2 August 2026 for general application together with Article 50. The guide cites a recital saying standards and national authorities arrived late, which put the original start at risk. It adds that national sandboxes are now due by 2 August 2027.
On 2 December 2026, two things happen. Generative systems already on the market before 2 August 2026 must mark their output under Article 50(2). Two new Article 5 bans also start: one on systems producing realistic sexual imagery of an identifiable person without explicit consent, and one on child sexual abuse material. Providers are caught where such output is the purpose or a foreseeable result lacking adequate safeguards, while deployers are caught only if they use the system for that purpose.
The guide also summarizes fines, with Article 5 breaches reaching up to EUR 35 million or 7 percent of worldwide turnover, and advises agent teams to classify systems and begin automatic logging well before December 2027.