How the law is catching up with AI 'deepfakes'

Linzi Penman says action is being taken in the UK but questions remain about the effectiveness of enforcement

Imagine discovering that someone has created explicit images of you or your child using AI. With tools capable of generating highly realistic “deepfakes” now widely accessible online, this nightmare is a daily occurrence.

The UK has just equipped law enforcement with a powerful tool to fight back. From 6 February 2026, Section 138 of the Data (Use and Access) Act 2025 criminalises the creation – or request to create – fake intimate images without consent.

The law amends the Sexual Offences Act 2003, ensuring “intimate image” now captures AI-generated or digitally manipulated content. In plain terms: using AI to create fake nude images of someone is a crime.

Significantly, the law recognises that harm begins before an image is shared. Simply requesting the creation of an image is now an offence – even if it’s never produced.

For Scotland, where technology-facilitated abuse has risen sharply, this legislation sends a clear message: the law is catching up with AI. However, questions remain about enforcement in an era of anonymous online activity.

Attention is now turning to the technology platforms that enable the spread and creation of these images – and the four pillars of prevention, detection, enforcement and takedown.

Detection: On 2 March 2026, the UK government announced one of the world’s most ambitious consultations on online safety, and recognises the need for technology companies to proactively detect non-consensual intimate images. The consultation will consider whether AI-generated content must have visible labels to distinguish deepfakes from authentic content – a measure already implemented in other jurisdictions.

Enforcement: Creating or sharing non-consensual intimate images will become a ‘priority offence’, treated with the same seriousness as child abuse or terrorism. Ofcom can fine technology companies up to 10 per cent of their global turnover if they fail to proactively detect these images or to mitigate the risks from harmful algorithms. Senior managers also face criminal liability if they fail to remove illegal content of this nature.

Takedown Requirements: An amendment proposed in February to the Crime and Policing Bill would require technology companies to remove such content within 48 hours of notification. Companies would also be required to prevent re-uploading using digital fingerprinting technology, allowing platforms to automatically block reposting attempts.

Liz Kendall MP, the Secretary of State for Science, Innovation and Technology, said: “No woman should have to chase platform after platform, waiting days for an image to come down. Under this government, you report once and you’re protected everywhere.”

So what are the implications for Scottish businesses looking ahead?

Scottish companies wishing to shape the consultation should note its broad scope. The definition of “platform” encompasses user-to-user services, from social media and messaging apps to video-sharing platforms and online gaming. With Scotland’s gaming industry contributing around GBP340 million annually, it’ll be particularly interesting to see how this sector responds.

As AI technology evolves at breakneck speed, legal frameworks must adapt just as quickly. This legislation is an important first step – but it won't be the last.