The prohibition nobody planned for: NCII and CSAM safeguards due December 2

Amid a reform framed around delay, the Omnibus added a new prohibited practice. AI systems designed to generate non-consensual intimate imagery or child sexual abuse material become prohibited from 2 December 2026.

The short runway is the point. Unlike the high-risk obligations that slipped years, this ban lands in months, and it sits in the Article 5 band that carries the €35 million or 7% penalty exposure.

For providers of generative systems the practical work is refusal behaviour, input and output filtering, and documented safety measures. This is not a labelling duty that can wait for a standard; it is a hard prohibition on a capability, and the burden is to show the system cannot readily be turned to it.