In short
- Article 5(1a), inserted by Regulation (EU) 2026/1744, prohibits a general image or video generator only where it lacks reasonable and adequate safeguards to reliably prevent prohibited output and to correct observed or reported misuse.
- Recital 12 of Regulation (EU) 2026/1744 treats safeguards as adequate when they align with the state of the art and demonstrably prevent or sufficiently reduce that output. The word that matters for a compliance file is demonstrably.
- Through Article 74(1), an authority holds the Article 14(4) powers of Regulation (EU) 2019/1020, including buying access under a cover identity and reverse-engineering the product, which Article 74(5) allows remotely.
- Article 99(3) caps the fine at EUR 35 million or 7% of worldwide annual turnover. Article 99(6) gives SMEs the lower figure, but the small mid-cap rule in Article 99(6a) does not reach Article 5.
- Overstating filter performance to an authority is a separate breach: Article 99(5) covers incorrect or misleading information at up to EUR 7.5 million or 1%.
Proving that an image filter works is now a legal question, not only an engineering one. From 2 December 2026, the answer decides whether a general image or video generator falls inside a prohibition carrying the highest fine tier of the EU AI Act.
What the prohibition covers is set out in our briefing on the December 2026 prohibition. This one is about the file a trust and safety lead should be able to hand over when a market surveillance authority asks how the safeguard was shown to work.
01Why is the evidence file part of the test itself?
Because Article 5(1a) of the AI Act, inserted by Regulation (EU) 2026/1744, writes the safeguard into the definition of the prohibited practice.
For a provider, placing a system on the market is prohibited under points (ba) and (bb) in 2 cases. Either producing the material is the intended purpose, or the design, training, architecture, capabilities or user-facing functionalities make it a reasonably foreseeable and reproducible outcome without significant technical modification, and the system lacks reasonable and adequate technical safety measures to reliably prevent it and to correct observed or reported misuse.
A general purpose generator lives in the second case. Whether it is prohibited turns on the safeguards, so the record showing they work is not supporting paperwork. It is the provider’s position.
Article 5(1b) narrows point (ba) for editing tools: manipulation that does not increase the exposure of depicted intimate parts, or alter the nature of depicted sexual activity, does not count. A product with inpainting or retouching features should record where its filters draw that line, because an inspector testing an editor will test exactly that boundary.
Deployers are treated differently. Under Article 5(1a)(b), use is prohibited only where the deployer uses the system for the purpose of generating such material. A company building a product on a third-party model is a deployer for that model and often a provider of its own system, which is why the line between deployer and provider matters here.
02What can a market surveillance authority actually do?
More than send a questionnaire. Article 74(1) of the AI Act applies Regulation (EU) 2019/1020 to AI systems, and Article 14(4) of that market surveillance regulation lists the minimum powers every authority holds.
| Power | Provision | What it means for an image generator |
|---|---|---|
| Require documents, technical specifications and data in any form | 2019/1020, Art. 14(4)(a) | The test records and rationale must exist and be retrievable |
| Acquire samples under a cover identity and reverse-engineer them | 2019/1020, Art. 14(4)(j) | An inspector can open an account and run prompts like any user |
| Exercise points (d) and (j) remotely | AI Act, Art. 74(5) | Testing through the public interface needs no site visit |
| Start investigations on own initiative | 2019/1020, Art. 14(4)(f) | No complaint or incident is needed to trigger a check |
| Prohibit, restrict, withdraw or recall | 2019/1020, Art. 14(4)(h) | A failed check can end availability in that Member State |
The cover identity power changes what the file must prove. An authority does not need to accept the provider’s own test results; it can produce its own. The file therefore has to show that the provider tested at least as hard as an inspector would, and knew what the inspector would find.
The more intrusive access rules in Article 74(12) and (13), covering training data and source code, are written for high-risk systems. A general image generator is usually not high risk, so an Article 5 check will lean on documents and on the product’s behaviour.
03What belongs in the file?
One artefact per element of the Article 5(1a)(a)(ii) test. Recital 12 of Regulation (EU) 2026/1744 names the measures it has in mind: data cleaning, refusal training, safe prompt design and output controls, runtime prompt guardrails, content classification and filtering, usage restrictions, abuse detection and notice and action. It calls them adequate when they align with the state of the art and demonstrably prevent or sufficiently reduce the output.
| Element of the test | Artefact to have on file | Refresh when |
|---|---|---|
| Reasonably foreseeable and reproducible outcome | Dated red-team log of attempts against points (ba) and (bb), with outcomes | Model or filter version changes |
| Without significant technical modification | Statement of what users can change: prompts, image uploads, fine-tuning, weights | New feature or release channel |
| Aligned with the state of the art | Written comparison of the measures used against those named in recital 12 | At least once a year |
| Reliably prevent, taking foreseeable misuse into account | Block and pass-through rates per attack category, including known circumvention methods | Each retest |
| Correct observed or reported misuse | Report channel, escalation owner and a log of fixes shipped after reports | Continuously |
The row most files miss is the last one. Article 5(1a) asks for safeguards that correct misuse, not only prevent it, so a filter with no route from a user report to a shipped fix fails half of the test however good its block rate. This is the gap between policy and dated artefact that recurs in every audit.
Article 5(1a)(a)(ii) of Regulation (EU) 2024/1689: map each line of the red-team log to point (ba) or point (bb) of Article 5(1) of the AI Act, and record the model and filter version it ran against. A result that cannot be tied to the version in production is not evidence for that version.
04Why does the penalty tier make the file itself a risk?
Article 99(3) of the AI Act sets the ceiling for breaching Article 5 at EUR 35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs, including start-ups, Article 99(6) makes it whichever is lower.
Regulation (EU) 2026/1744 added Article 99(6a) for small mid-caps, but it applies only to fines under paragraphs 4 and 5. A small mid-cap breaching Article 5 faces the ordinary higher-of cap.
The file also carries its own risk. Article 99(5) fines incorrect, incomplete or misleading information supplied to authorities at up to EUR 7.5 million or 1%. A block rate measured on an easy test set and presented as the general rate is the kind of statement that invites it.
Honest files help in the other direction. Among the factors in Article 99(7) are the technical and organisational measures the operator implemented, point (g), its cooperation with the authority, point (f), and whether it notified the infringement itself, point (h).
05Does Article 50(2) marking or the DSA change what goes in the file?
Marking is not prevention. Article 50(2) of the AI Act requires providers of generators to mark output in a machine-readable format as artificially generated, and Article 111 gives systems placed on the market before 2 August 2026 until 2 December 2026 to comply. That marking duty, covered in our briefing on Article 50 labelling, labels an image. Article 5(1)(ba) and (bb) are about images that must not be produced.
The overlap is practical. For very large online platforms, Article 34(1) of the Digital Services Act requires a risk assessment before deploying functionalities likely to have a critical impact on systemic risks, Article 34(3) requires the supporting documents to be kept for at least 3 years, and Article 35(1)(k) names prominent marking of generated images of real persons as a mitigation. The red-team log built for Article 5 can serve as supporting evidence for that assessment, provided it is dated and versioned the same way.
06Frequently asked questions
Is an image generator prohibited just because it can produce intimate deepfakes?
No. Under Article 5(1a)(a) of the AI Act, a system not intended for that purpose is prohibited only where such output is a reasonably foreseeable and reproducible outcome and the system lacks reasonable and adequate safeguards to reliably prevent it and to correct observed or reported misuse.
What counts as an adequate safeguard under the AI Act nudification ban?
Recital 12 of Regulation (EU) 2026/1744 says measures are adequate if they align with the state of the art and demonstrably prevent or sufficiently reduce the likelihood of generating the material. It lists data cleaning, refusal training, output controls, runtime guardrails, classifiers, usage restrictions, abuse detection and notice and action.
Can a regulator test our filter without telling us?
Yes. Article 74(1) of the AI Act applies Regulation (EU) 2019/1020, whose Article 14(4)(j) lets an authority acquire samples under a cover identity and reverse-engineer them, and Article 74(5) of the AI Act allows that power to be exercised remotely.
Does the reduced SME fine apply to the Article 5 prohibitions?
Yes for SMEs, no for small mid-caps. Article 99(6) makes the cap the lower of EUR 35 million or 7% for SMEs, while Article 99(6a) extends the lower-of rule to small mid-caps only for the fines in paragraphs 4 and 5.
Does watermarking under Article 50(2) satisfy the Article 5 prohibition?
No. Article 50(2) requires synthetic output to be marked as artificially generated, while Article 5(1)(ba) and (bb) concern output that must not be produced at all. A correctly marked prohibited image is still prohibited output.
07References and method
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026. Read for point (7) inserting Article 5(1)(ba), (bb), (1a) and (1b) into Regulation (EU) 2024/1689, and for recital 12 on what makes safeguards reasonable and adequate.
- Article 5 of Regulation (EU) 2024/1689 and Article 113 in the consolidated presentation, current text parsed from the page source on 25 September 2026, for the wording of paragraphs 1a and 1b and the application date of 2 December 2026.
- Article 99 of Regulation (EU) 2024/1689 as amended, parsed on 25 September 2026, for the fine ceilings in paragraphs 3 and 5, the SME rule in paragraph 6, the small mid-cap rule in paragraph 6a and the factors in paragraph 7.
- Article 74 of Regulation (EU) 2024/1689, parsed on 25 September 2026, for the application of Regulation (EU) 2019/1020, remote exercise of powers in paragraph 5 and the high-risk-only access rules in paragraphs 12 and 13.
- Regulation (EU) 2019/1020 on market surveillance, Article 14(4), for the minimum powers of market surveillance authorities, read in the Official Journal text on 25 September 2026.
- Article 50(2) and Article 111 of Regulation (EU) 2024/1689, for the marking duty and the 2 December 2026 date for generators placed on the market before 2 August 2026.
- Regulation (EU) 2022/2065 (Digital Services Act), Article 34(1) and (3) and Article 35(1)(k), for the risk assessment, the three year retention of supporting documents and the marking of generated images on very large online platforms.