The UK Crime and Policing Act 2026: criminalising AI tools that generate abuse imagery

The United Kingdom has spent two years insisting it does not need a horizontal AI statute — that existing regulators and existing law can carry the load (see the UK approach to AI). The Crime and Policing Act 2026 is that philosophy made concrete in the hardest possible area: rather than regulate the AI market, it reaches a specific, dangerous use of AI through the criminal law. And in doing so it created what the government describes as a world-first offence.

The Act and its date

The Crime and Policing Act 2026 (chapter 20) received Royal Assent on 29 April 2026. It is a large criminal-justice statute, but three of its provisions bear directly on artificial intelligence — all of them aimed at the generation of harmful synthetic imagery rather than at AI development as such.

The central offence: AI image-generators

Section 72 inserts a new section 46A into the Sexual Offences Act 2003 (with parallel provisions for Northern Ireland and Scotland in sections 73 and 74). It is an offence to make or adapt a thing for use in creating, or facilitating the creation of, child sexual abuse images, and to possess, supply or offer to supply a "CSA image-generator". The Act defines that generator broadly: a thing "made or adapted for use for creating, or facilitating the creation of, CSA images", where "thing" expressly includes a program, information in electronic form, or a service. The underlying images are defined by reference to existing law — indecent photographs and pseudo-photographs under the Protection of Children Act 1978 and prohibited images under the Coroners and Justice Act 2009.

The target is precise. This is not a ban on AI development, nor on general-purpose models: the Home Office is explicit that the offence is aimed at offenders who optimise a model specifically to enhance its ability to produce child sexual abuse material — fine-tuned models that generate hyper-realistic imagery, often carrying the likeness of real children. The maximum penalty is five years' imprisonment (on indictment) and/or a fine.

Because a legitimate safety researcher or platform would otherwise commit the offence merely by holding such a model to study it, section 46B builds in defences: acting for the prevention, detection or investigation of crime; acting as the Security Service, SIS or GCHQ in their statutory functions; and acting for Ofcom's online-safety functions. The Home Office calls this the Technology Testing Defence and pairs it with a delegated power for the Secretary of State to approve organisations to hold generators for an appropriate purpose — testing what a model can do in order to prevent future crime.

Two further AI provisions

The Act also extends the existing "paedophile manual" offence (sections 75-76) so that possession of advice or guidance about creating such images covers material instructing how to use AI to generate them.

Separately, section 99 creates an offence around "purported intimate image generators" — the nudification tools that strip clothing from a photograph of a real person. It is an offence to make, adapt, supply or offer to supply a tool or service that generates, or facilitates the generation of, purported intimate images. This sits alongside the UK's existing intimate-image-abuse regime and runs parallel to measures elsewhere, such as the United States' Take It Down Act.

Finally — and most forward-looking — section 248 gives the Technology Secretary a regulation-making power to amend the Online Safety Act 2023 to bring otherwise unregulated AI chatbots into its scope, subjecting them to duties to minimise the risk of illegal AI-generated content and the facilitation of priority offences.

Enacted, but not yet all in force

A point of precision that matters for compliance. The first commencement regulations (SI 2026/689) brought a large set of the Act's provisions into force on 29 June 2026 — but the CSA image-generator offences in sections 72-74 are not among them. They are enacted law, yet await a further commencement order before they bite, in part because the Technology Testing Defence framework has to be stood up first. The offence exists on the statute book; the date it takes effect is still to be fixed.

Why it matters beyond Britain

The significance is not the UK's volume of AI rules — it has few — but the model. Where the EU AI Act and comparable regimes regulate AI as a product placed on the market, the UK has reached one acute harm through the ordinary criminal law, criminalising the tool and the act rather than the provider's conformity. For a jurisdiction that has chosen a pro-innovation, sandbox-led path for mainstream AI governance, the Crime and Policing Act shows where that choice still draws a bright, punitive line — and it gives other common-law jurisdictions a drafting template for doing the same.