Europe bans ai-generated nudes and gives tech giants 16-month breather
The European Parliament pulled the emergency brake on runaway ai systems Thursday, criminalizing fake nude images while quietly handing Silicon Valley a 16-month compliance holiday that pushes real enforcement past the next EU electoral cycle.
The vote in Brussels outlaws so-called deepfake pornography—synthetic nudity that grafts a real face onto an explicit body—unless the platform can prove it has deployed "effective safeguards" to stop users from generating it. Platforms that fail face fines calibrated to global turnover, yet the first penalties will not bite until December 2027, a full three years after the text was agreed.
Big tech gets a glide path
That delay is the unspoken story. Lawmakers wrapped the deferral in language about "legal certainty", but the calendar reveals the lobbying footprint: November 2026 for watermarking obligations, August 2028 for sector-specific safety rules, and a blanket grace period for products already regulated under EU safety directives. The staggered timeline mirrors the wish-list circulated by DigitalEurope, the trade body that counts Amazon, Google and Microsoft as board-level members.
Biometric identification systems in public spaces, ai used to grade exams or vet résumés, and algorithms monitoring critical infrastructure must still meet baseline transparency requirements from mid-2026. Yet even here the Parliament inserted an escape clause: companies may harvest personal data to hunt for algorithmic bias, provided the intrusion is "strictly necessary"—a phrase the text does not define.
Start-ups, not state surveillance, carry the load
In a concession to the Continent’s fragmented venture-capital ecosystem, MEPs extended compliance subsidies to mid-cap firms, not just garage start-ups. The threshold: 250 employees or €50 million turnover. Above that, the full rulebook applies overnight. The measure is designed to prevent the ai Act from becoming a moat for US incumbents, but it also fragments the single market: a 300-person Polish firm faces stricter obligations than a 249-person competitor across the Oder.
Meanwhile, Europol gets no new powers. National police forces can still deploy real-time facial recognition in public, provided they secure judicial sign-off. Civil-rights groups wanted an outright ban; they left with a footnote requiring a "fundamental-rights impact assessment".
The Parliament’s gambit is clear: legislate first, litigate later. By 2028 the bloc will have processed at least two electoral cycles—plenty of time for lobbyists to soften edges before any courtroom ever tests them. The message to every photo-sharing app with a face-swap filter: write the watermark now, or write the cheque later. The clock starts in 922 days.