• Read the EU press release here.

The European Parliament and Council of the European Union (EU) have agreed to ban artificial intelligence (AI) systems that generate non-consensual sexually explicit content and child sexual abuse material (CSAM), including nudification apps, as part of a deal to simplify the AI Act, while pushing high-risk enforcement back by over a year. India has no equivalent ban.

Why this matters: The EU ban makes it illegal to build or sell a nudification tool. India’s IT Amendment Rules 2026 place proactive obligations only on platforms and intermediaries. A standalone nudification app that does not operate as a social media intermediary faces no obligation under Indian law at all. India’s existing frameworks compound this gap:

• IT Amendment Rules 2026: Notified February 10, 2026, in force from February 20. Require platforms to prevent creation and sharing of unlawful synthetically generated information (SGI), including CSAM and non-consensual intimate imagery (NCII), with a three-hour takedown window. Carry no ban on nudification tools themselves. MediaNama has filed RTIs with MeitY on compliance and platform outreach. No platform has also publicly confirmed compliance.
• MeitY NCII standard operating procedure (SOP): Issued November 2025, it mandates 24-hour takedown but covers only women and girls. The Madras HC order that prompted it told MeitY to outline what “a victim girl must do”, anchoring the framework to female victims from day one. A Rajasthan HC order was required to remove a minor boy’s obscene images from Instagram, with the court noting it “would be fallacious to assume that such consequences are confined to one gender alone”.
• Digital Personal Data Protection (DPDP) Act, 2023: The DPDP Rules notified in November 2025. Substantive obligations enforceable only from May 2027. No content regulation framework. Nudification tools fall entirely outside its scope.

The nudification ban: The ban was not in the European Commission’s original proposal. Parliament pushed it through. Companies have until December 2, 2026, to comply. The prohibition exempts systems with effective safety measures already preventing misuse.

Michael McNamara, an Irish MEP and co-rapporteur for the civil liberties committee, said: “Non-consensual intimate imagery is a systemic harm being industrialised by AI and in which the overwhelming majority of victims are women and girls.”

Co-rapporteur Arba Kokalari, a Swedish MEP from the European People’s Party (EPP) and rapporteur for the Internal Market committee, said: “We wanted to have clarity on what we think about nudification apps in Europe and that we are not accepting of it.”

What triggered it: Lawmakers pushed for the ban after the late-2025 Grok scandal, in which users generated sexual deepfakes of women and children on X using Elon Musk’s AI chatbot Grok, making it a red line in the trilogue. In India, MeitY issued a notice to X in January 2026 over the same content, finding X’s response inadequate. This directly preceded India’s IT Amendment Rules 2026, India’s first framework explicitly covering AI-generated content.

Delayed timelines for high-risk AI: High-risk obligations covering biometrics, education, employment, law enforcement, justice, and border management now apply from December 2, 2027. AI in regulated products such as lifts and toys takes effect August 2, 2028. Both were previously set for August 2, 2026, giving companies roughly 16 extra months. Brussels says the delay reflects unfinished standards work, with harmonised standards from the European Committee for Standardisation (CEN) and the European Committee for Electrotechnical Standardisation (CENELEC) stated as preconditions.

Other changes:

• Small and medium-sized enterprise (SME) exemptions extended to small mid-caps: Companies of up to 500 employees now qualify for simplified compliance rules, including lighter technical documentation requirements, previously available only to smaller firms.
• AI system registration reinstated: Providers must now register in the EU database even when they self-assess their system as not high-risk. The Commission had proposed scrapping this, which would have allowed companies to avoid scrutiny through self-declaration alone.
• Strict necessity standard for bias detection reinstated: Companies that process sensitive personal data such as race, health, and sexual orientation to detect and correct bias in AI systems must now justify it as strictly necessary, not merely useful. The Commission had sought to lower this bar.
• Watermarking deadline moved to December 2, 2026: AI systems that generate audio, images, video, or text must now make that content machine-detectable as AI-generated. Companies get three months less than the Commission had proposed.
• National regulatory sandboxes by August 2, 2027: European Union (EU) member states must now set up controlled testing environments where companies can trial AI systems under regulatory supervision before full market deployment.
• Machinery Regulation exempted from AI Act: Industrial AI in products such as lifts, machinery, and vehicles will now follow sector-specific safety law rather than the AI Act directly, removing the risk of companies facing dual compliance obligations.
• General-purpose AI (GPAI) model rules untouched: Rules governing large foundation models such as GPT or Gemini, which came into force in August 2025, remain unchanged by this deal.

Criticism: The Center for Democracy and Technology (CDT) Europe joined 32 other civil society organisations in an open letter flagging weakened protections around biometric identification, AI in schools, and medical AI. More than 40 organisations signed a separate letter to Parliament in mid-April, making the same case. The Jacques Delors Centre, a Berlin-based think tank, argued that deregulation would not primarily benefit European businesses given Big Tech’s dominance. Legal analysts note the deal does not reduce complexity but redistributes it, calling “simplification” a political label.

What comes next? Formal endorsement by Parliament’s plenary and Council ministers is expected before the summer recess. The target is adoption before August 2, 2026, when current high-risk rules would otherwise apply.

Also read:

• MeitY notifies IT Amendment Rules 2026 on synthetic media and deepfakes
• Are platforms following India’s deepfake and AI content rules?
• Rajasthan HC directs Meta to remove minor boy’s obscene images from Instagram, exposes gender gap in MeitY’s NCII framework