The safeguards that keep a model out of the AI Act's top penalty tier are described only in a recital.
Two prohibitions on generating intimate imagery and child sexual abuse material land on 2 December, and one of them reaches a provider who never intended the output. A breach of Article 5 costs 35 million euro or seven per cent of worldwide turnover, whichever is higher.
On 2 December the AI Act's list of prohibited practices gains two entries. Article 1(7) of the Digital Omnibus on AI, Regulation (EU) 2026/1744, inserted them; Article 1(40) of the same instrument rewrote the third paragraph of Article 113 so that they, and the two paragraphs qualifying them, "shall apply from 2 December 2026". The Omnibus was adopted on 8 July and has been in force since 27 July. Thirty days from this morning.
The first, Article 5(1), first subparagraph, point (ba), prohibits:
the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person's intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person's freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation
Point (bb) does the same for "material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU" — child sexual abuse material, reached by cross-reference rather than described — "except where a 'without right' defence applies under national law".
Read the verbs. Placing on the market, putting into service, or use: provider, importer, distributor, deployer, anyone in the chain. On its face point (ba) is the widest sentence in Article 5, and the only one a general-purpose model could breach without anybody building it for the purpose. It is narrower than that, because of what the Omnibus inserted underneath it.
The prohibition arrives with its limits inside it
Article 5(1a) splits the two points by who is doing what. For a provider, placing on the market or putting into service is "only prohibited where" either generation or manipulation "is the intended purpose of the AI system", or:
the system's design, training, architecture, capabilities or user-facing functionalities make that generation or manipulation a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system does not have reasonable and adequate technical safety measures and other safeguards to reliably prevent that generation or manipulation, taking into account reasonably foreseeable misuse, and to correct observed or reported misuse
Everything a general-purpose model provider will argue about for the next five years is in those four lines.
Article 5(1a) is not an exemption, and the text does not call it a defence: it says the practice "is only prohibited where", which makes its conditions elements of the prohibition rather than pleas against it. The one thing in these two points the instrument does call a defence is the "without right" limb in (bb), and that one is handed to national law to supply.
So a provider who intended none of it is caught where the output is "reasonably foreseeable and reproducible" and the safeguards are not "reasonable and adequate". Each of those phrases appears exactly once in the AI Act, here. Neither is defined in Article 3. The article does not say what a safeguard is, how many are enough, what reproducible means, or how much modification is significant.
Where "adequate" is actually defined
Recital 12 says all of it. It is the longest recital in the instrument and the most useful page in it: the measures it has in mind are "data cleaning, refusal training, safe prompt design and output controls, runtime prompt guardrails, content classification and filtering mechanisms, usage restrictions, abuse detection mechanisms, and notice and action mechanisms", judged against the specific system "including its release and distribution strategy (such as open-source releases)". It also lists, anatomically, what the article means by intimate parts.
Then it supplies the standard the article withholds. Preventive measures, it says, "are considered adequate if they align with the state-of-the-art measures and demonstrably prevent or sufficiently reduce in each specific case the likelihood of generating or manipulating such material".
Set the two side by side. The article requires safeguards that "reliably prevent". The recital treats measures as adequate where they prevent or sufficiently reduce the likelihood. A provider whose filters catch most attempts has met the recital and has not obviously met the article.
Recitals are not binding. They are evidence of intent and courts read them as such, which makes a recital more generous than its article an argument you can run rather than a position you can rely on. A prohibition at the heaviest tier in the Act takes the scope of its central noun, and the whole content of its safeguards test, from a page that binds nobody.
What it costs, and the machinery is already running
Article 99(3) of the AI Act puts non-compliance with Article 5 at the top tier: administrative fines of up to "EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher". The Omnibus amends Article 99 in three places and leaves paragraph 3 alone.New Article 99(6a) gives small mid-caps the lower of the percentage and the amount for each fine "referred to in paragraphs 4 and 5". Paragraph 3 is not in that list. Article 99(6), untouched, gives SMEs the lower of the two across paragraphs 3, 4 and 5. So an Article 5 breach is whichever-is-higher for a small mid-cap and whichever-is-lower for a smaller company.
Chapter XII, which contains Article 99, has applied since 2 August 2025. Nothing has to be stood up on 2 December. The fine already exists; what arrives is the conduct it attaches to.
Article 5 prohibitionsThe original list
PenaltiesChapter XII, with Article 99(3)
Marking of outputSystems on the market before August
Points (ba) and (bb)With Article 5(1a) and (1b)
High-risk, Annex IIIChapter III, Sections 1 to 3
A deployer is caught only on purpose
Most people reading this are deployers, and for them the provision is narrow in a way worth saying before anybody budgets against it. Article 5(1a)(b): use is "only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance". Purpose. Not capability, not outcome, not negligence.
Recital 12 is explicit about the consequence: the prohibition on use "does not cover the use of an AI system for lawful purposes" even where the system lacks the safeguards the provider should have put in place, and does not cover accidental generation. An organisation whose staff member misuses a licensed image model has a disciplinary problem, probably a data protection problem and possibly a criminal one. It does not, on this text, have an Article 5 problem of its own.
Article 5(1b) narrows the subject matter again, and it is easy to miss because it is a definition rather than a prohibition: manipulation that does not "increase the exposure of any depicted intimate parts or alter the nature of any depicted sexually explicit activities" is not manipulation at all.
The date this desk would not print
On 28 October Nadia Berger wrote on this site about the Article 50(4) exemption and left a date out of it. Secondary accounts had a four-month concession pushing the Article 50(2) machine-readable marking duty to 2 December 2026 for systems already on the market. She looked in the Article 50 text she had, could not find it, and printed the reasoning instead: a date a piece cannot find in a text is a date it should not put in a reader's calendar.
That was the right call, and the date is real. It is Article 111(4), added by Article 1(39)(b) of the Omnibus:
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026.
That it was not findable is structural rather than anybody's oversight. The provision is not in Article 50. It is in Article 111, which otherwise deals with large-scale IT systems, legacy high-risk systems and general-purpose models on the market before 2 August 2025. A page about Article 50 that marks every amendment to Article 50 accurately and completely will still not show this one, because it is not an amendment to Article 50. Recital 38 announces that something exists — "a transitional period of four months for providers who have already placed their systems on the market" — and does not hand you a provision to cite.
EUR-Lex does carry it, in the consolidated AI Act dated 27 July 2026. The lesson is dull: when the question is whether a date moved, look where transitional provisions live rather than where the duty does. The two are almost never in the same article.
Nothing between here and December defines "adequate"
Article 96(1)(b) already obliges the Commission to develop guidelines on "the prohibited practices referred to in Article 5". It carries no date, and the Omnibus did not give it one — it put 1 August 2027 on the new point (g) and left point (b) as drafted. Guidelines bind nobody, which does not make them decorative: amended Article 99(1) requires Member States to lay down their penalties "taking into account the guidelines issued by the Commission pursuant to Article 96". The document that will decide the fine is the one with no deadline on it.
So on 2 December a prohibition carrying 35 million euro or seven per cent takes effect, and whether a given model's refusal training and output filters amount to safeguards that reliably prevent will first be decided by whoever at a national market surveillance authority opens the file. In front of them will be an article that does not say, and a recital that says a great deal and binds no one.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), CELEX 32026R1744The EUR-Lex front end was not used. The CELEX number was resolved to a cellar work URI through the Publications Office SPARQL endpoint and the English XHTML manifestation fetched directly, which returns the whole instrument rather than the half page the web front end's WAF challenge serves. Source and quoted verbatim for Article 1(39)(b), adding Article 111(4) to the AI Act. Also read: Article 1(20), replacing Article 50(7); Article 1(38), amending Article 99, including the new paragraph 6a; recital 38 on the four-month transitional period; and recital 41, quoted here for codes of practice having limited legal effect and in particular not granting a presumption of conformity. Article 1(39)(a) was read to confirm that the only other change to Article 111 concerns high-risk systems and does not bear on this duty.
- Regulation (EU) 2024/1689 (AI Act), consolidated text at 27 July 2026, CELEX 02024R1689-20260727Same route, same reason. Source and quoted verbatim for Article 50(2) in all three of its sentences, including the four adjectives, the three considerations attached to technical feasibility and the editing carve-out; for Article 111(4) as it now stands in the Act, carrying its M1 amendment marker; for Article 99(4), including point (g) on the transparency obligations of providers and deployers under Article 50, with its figures; for Article 99(6) and (6a) on smaller companies; and for Article 99(7)(g) and (i). Also read: Article 3, points (3), (4), (9), (10) and (11) for the definitions this procedure turns on; Article 2(1)(a) to (c) on scope; Article 25(1), which converts a deployer into a provider only in respect of high-risk systems and so does not reach this duty; Article 40(1) and (2) for the scope of the presumption of conformity; Article 50 in full for the four duties and the parties each is addressed to; Article 96(1), including point (d); and the second and third paragraphs of Article 113 for the application dates.
- Regulation (EU) 2024/1689 (AI Act), as originally published, CELEX 32024R1689Read only to establish what Article 50(7) said before the Omnibus replaced it, so that the comparison in the final section rests on both texts rather than on one. The original paragraph contained two implementing-act empowerments: one to approve codes of practice, one to specify common rules where a code is inadequate. The replacement removes the first and reproduces the second.
- Human review removes the AI Act's duty to label machine-written text, 28 October 2026Read for the Article 50(4) deployer duty, which is the duty a reader of this procedure may have mistaken for this one. Cited in the body for that purpose only.
- Where the burden of establishing the elements of Article 5(1a) fallsNot established. Article 5(1a) is drafted as a limit on the scope of the prohibition rather than as an exemption or a defence, which is observable from the words 'is only prohibited where'. What follows from that for who must prove what in front of a national market surveillance authority is a question of national procedural law, and no national procedure was examined for this piece. The body says the provision is not called a defence; it does not say where the burden lands, and nothing here should be read as an answer to that.
- Whether the Commission has issued or updated guidelines on Article 5 covering the two new pointsNot established. Article 96(1)(b) of the AI Act requires the Commission to develop guidelines on the prohibited practices referred to in Article 5 and attaches no date to that requirement; the Omnibus left point (b) untouched. Whether anything has been published, consulted on or scheduled that would give content to 'reasonable and adequate technical safety measures and other safeguards' before 2 December was not established and is not asserted either way. The same goes for any national supervisory position: none was looked for and none is cited.
- Four corrections to this desk's own working noteThe note commissioning this piece summarised the new provisions from an earlier fetch of the instrument, and four things in it do not survive a reading of the text. First, the safeguards limb is not 'adequate safeguards' but 'reasonable and adequate technical safety measures and other safeguards to reliably prevent', and it carries a further condition the note omitted: 'without requiring significant technical modification'. Second, the note did not record Article 5(1b), which excludes from 'manipulation' any change that does not increase exposure of intimate parts or alter the nature of depicted sexually explicit activities — a carve-out that matters. Third, the note's description of recital 41, that Article 50(7) no longer empowers the Commission to adopt implementing acts, overstates both the recital and the article: the recital speaks of removing the empowerments, and the replacement paragraph retains one of the two. Fourth, the note lettered the Article 113 changes as the Omnibus letters its own sub-points rather than as Article 113 letters its points; the dates were right, the locations were not. Where the brief and the instrument disagreed, the instrument was followed.