Crime and Policing Act 2026 (AI-related provisions: CSA image-generators, purported intimate image generators, power to amend Online Safety Act 2023 for AI)

Record GB-09 · 2026 c. 20 (ss. 72-74, 99, 111-112, 248-249)

Issued by: UK Parliament
Jurisdiction: United Kingdom
Level · region: National · Europe
Published / adopted: 2026-04-29
In force: 2026-04-29
Language: English
Official identifier: 2026 c. 20 (ss. 72-74, 99, 111-112, 248-249)

Summary

Creates offences of making or adapting a thing for creating child sexual abuse images and of possessing or supplying such a 'CSA image-generator', where a thing includes a program or service such as an AI model optimised to produce such images (ss.72-74, up to 5 years), and lets the Secretary of State provide a defence for authorised technology testing (s.111). It makes it an offence to make, adapt or supply a generator of purported intimate images (s.99, up to 3 years) and gives the Secretary of State power to amend the Online Safety Act 2023 to place illegal-content duties on providers of AI services and extend Ofcom's functions to them (s.248).

Safety topics

child safetydeepfakes & synthetic mediaaccountability & liabilityevaluation & testing

Scope

Borderline scope Not an AI-specific law: a broad criminal justice Act. Included for its AI provisions, the offences on CSA image-generators and purported intimate image generators and the power to extend the Online Safety Act 2023 to AI services; only those parts are recorded.

Status notes

Royal Assent on 29 April 2026. Sections 248 and 249, in Part 17, came into force on Royal Assent; s.248 inserts s.216A into the Online Safety Act 2023, which takes effect only through regulations, and s.249 requires the Secretary of State to report to Parliament by 31 December 2026 on progress towards them unless a draft of the regulations is laid first. Sections 111 and 112 came into force on 29 June 2026, at the end of the two months beginning with Royal Assent. Section 99 came into force on 29 June 2026 under the Crime and Policing Act 2026 (Commencement No.1 and Saving Provision) Regulations 2026 (SI 2026/689, made 25 June 2026). Sections 72 to 74 were not in force at Royal Assent and are still prospective: s.72 needs regulations of the Secretary of State, s.73 so far as it extends to Northern Ireland an order of the Department of Justice there, and s.74 so far as it extends to Scotland regulations of the Scottish Ministers. Section 75 extends the offence of possessing a 'paedophile manual' (s.69 Serious Crime Act 2015) to advice or guidance about creating CSA images, which the Home Office ties to AI-generated imagery. Only the AI-related parts of this large criminal justice Act are recorded here.

Sources

Open the official source https://www.legislation.gov.uk/ukpga/2026/20/contents

Secondary source: https://www.gov.uk/government/publications/crime-and-policing-act-2026-factsheets/crime-and-policing-act-2026-child-sexual-abuse-material-factsheet

Local copy

Archived. A linked PDF could not be downloaded (https://www.legislation.gov.uk/ukpga/2026/20/contents/data.pdf: The site's robots.txt does not allow automated downloads of this page). Last attempt 2026-10-17 20:42:18 UTC

Official source (third-party copy, not published) archive/GB-09/2026-10-17/official.html

Retrieved 2026-10-17 19:19:54 UTC

SHA-256 8744782153e590f6b1a1ea29cd4a1b7c202daf28e569586350d774d56774610c

Linked document (PDF) (third-party copy, not published) archive/GB-09/2026-10-11/document-2.pdf

Retrieved 2026-10-11 14:03:38 UTC

SHA-256 b246e1adef59161c740a395696404623c9836213a8f159ade5fdfa74b4bc7b75

Secondary source (third-party copy, not published) archive/GB-09/2026-10-11/secondary.html

Retrieved 2026-10-11 14:03:38 UTC

SHA-256 fde719330ad7b1f2c38046e824fcb250827d717f7bcccd1bbc5610936b6d1d47

Verification

The instrument's own official text, or an official register, was stored and confirms the title, date and status. checked 2026-10-17 · official-url-fetched

Stored and read in this run: the legislation.gov.uk table of contents (new snapshot of 17 Oct 2026, in which only the 'up to date' line changed since 11 Oct), the King's Printer PDF of the Act as enacted (Royal Assent on 29 April 2026, the enacting formula, ss.72-75, 99, 111-112, 248-249 and the commencement rules in s.255) and the Home Office factsheet on child sexual abuse material (stored as the secondary source; updated 30 September 2026); and, stored 17 Oct 2026, the revised pages of ss.72, 73, 74, 99, 111 and 248 with their commencement annotations, and SI 2026/689 (made 25 June 2026; a correction slip of 14 October 2026 is listed). Sections 112 and 249 have no stored page of their own; their commencement follows from s.255(3)(c) and s.255(2)(k), as the pages of ss.111 and 248 show for those sections.

Second check: Independent check by Claude Code (claude-sonnet-5-5), 2026-10-17: 7 field(s) supported.

History

2026-10-17scope_note: – → Not an AI-specific law: a broad criminal justice Act. Included for its AI provis — added: the Act is a broad criminal justice Act whose AI provisions are recorded (compare US-FL-07)2026-10-17-recheck-europe-2 · Claude Code (claude-opus-5-5)
2026-10-17notes: Royal Assent 29 Apr 2026. Section 248 (new s.216A Online Safety Act 2023) was in → Royal Assent on 29 April 2026. Sections 248 and 249, in Part 17, came into force — commencement now from the stored section pages and SI 2026/689: ss.248-249 at Royal Assent, ss.111-112 and s.99 on 29 June 2026, ss.72-74 still prospective (as version 1 had it); s.249's 31 December 2026 report duty added; the paedophile-manual sentence reworded to the Act and the factsheet2026-10-17-recheck-europe-2 · Claude Code (claude-opus-5-5)
2026-10-17summary: Creates offences of making, adapting, possessing or supplying a 'CSA image-gener → Creates offences of making or adapting a thing for creating child sexual abuse i — the testing defence attributed to s.111 (a power to provide defences by regulations), the s.248 power described as the Act words it2026-10-17-recheck-europe-2 · Claude Code (claude-opus-5-5)
2026-10-17official_identifier: 2026 c. 20 (ss. 72-74, 99, 248) → 2026 c. 20 (ss. 72-74, 99, 111-112, 248-249) — ss.111-112 (technology testing defence, which the summary covers) and s.249 (progress report on the s.248 regulations) added to the sections recorded2026-10-17-recheck-europe-2 · Claude Code (claude-opus-5-5)
2026-10-17date_last_updated: 2026-06-29 → – — 2026-06-29 was a commencement date, not an amendment; partial commencements go in the notes (AGENTS.md section 5.6), and no amendment of the Act is shown2026-10-17-recheck-europe-2 · Claude Code (claude-opus-5-5)
2026-10-17issuing_body: UK Parliament (Home Office bill) → UK Parliament — the enacting formula names Parliament; the sponsoring department is not shown in the stored Act, and GB-08 uses 'UK Parliament'2026-10-17-recheck-europe-2 · Claude Code (claude-opus-5-5)

UK AI Security Institute United Kingdom · Published (non-binding, current)

Citation

UK Parliament. Crime and Policing Act 2026 (AI-related provisions: CSA image-generators, purported intimate image generators, power to amend Online Safety Act 2023 for AI) [2026 c. 20 (ss. 72-74, 99, 111-112, 248-249)]. 2026-04-29. https://www.legislation.gov.uk/ukpga/2026/20/contents. Status: Partially in force; verified 2026-10-17 (level A). Local copy archive/GB-09/2026-10-17/official.html retrieved 2026-10-17 19:19:54 UTC, SHA-256 8744782153e590f6b1a1ea29cd4a1b7c202daf28e569586350d774d56774610c. Every AI Policy Ever, version 1.18 (snapshot 2026-10-18), record GB-09.

Improve this record

Know of an amendment, a status change or an error? Report news or an error on GitHub; the form opens with this record filled in.