UK's Crime and Policing Act 2026: New Powers Against AI CSAM

The United Kingdom has significantly bolstered its legal framework against digital crime with the Crime and Policing Act 2026, which officially became law on April 29, 2026, following Royal Assent. This landmark legislation, introduced via the King's Speech announcement on July 17, 2024, and progressing through Parliament as Bill 187, represents a critical response to the evolving threat of AI-generated child sexual abuse material (CSAM). With key provisions, including new border inspection powers and the AI testing framework, taking effect on June 29, 2026, under Commencement No.1 (SI 2026/689), the obligations outlined in the Act are live now, impacting a broad spectrum of individuals and organisations across the United Kingdom.

What's changing

The Crime and Policing Act 2026 introduces several profound changes designed to enhance law enforcement's capabilities and address the unique challenges posed by artificial intelligence. At its core, the Act targets the creation and distribution of AI-generated CSAM, often referred to as "pseudo-photographs," which are images that appear to depict a child but are entirely synthetic.

Perhaps the most significant shift is the explicit criminalisation of the technology itself. The Act makes it illegal to create, possess, or distribute AI models or software specifically "optimized" to generate indecent images of children. These are now formally known as "CSA Image Generators." This means that the tools and algorithms designed for such illicit purposes are now unlawful, not just the resulting images. This proactive approach aims to tackle the problem at its source, preventing the proliferation of such harmful content before it is even generated.

Furthermore, the definition of CSAM has been expanded to unequivocally include these "pseudo-photographs." Previously, legal definitions often focused on images of real children, creating a potential loophole for AI-generated content. The new law closes this gap, ensuring that AI-generated images that appear to be of a child are treated with the same severity as those depicting real individuals.

The Act also imposes new responsibilities and penalties on platform operators. Website moderators and administrators who knowingly facilitate the sharing of CSAM or provide grooming advice on their platforms now face specific criminal offenses. This provision aims to hold online service providers accountable for the content they host and the communities they foster, pushing for more proactive moderation and reporting of illegal activity.

A practical and potentially surprising change for many is the introduction of new powers for UK Border Force officers. Under the Act, officers can now compel individuals to unlock their digital devices – such as phones, laptops, and tablets – for inspection if there is reasonable suspicion of CSAM possession. Refusing to cooperate with such a scan is a criminal offense, carrying its own penalties. This power, which came into effect on June 29, 2026, represents a significant expansion of state authority at the border, impacting anyone travelling into or out of the UK with digital devices.

Recognising the need for legitimate research and development in AI safety, the Act also includes a "Technology Testing Defence." This provision allows AI developers to apply for authorisation from the Secretary of State to legally stress-test their models for vulnerabilities, including their potential to generate illicit content, without fear of prosecution. This framework acknowledges the importance of ethical AI development while maintaining strict controls over potentially harmful activities.

Penalties under the Act are severe. Possessing an illegal AI generator can lead to a prison sentence of up to five years. Platform operators found to be facilitating abuse face even harsher penalties, with potential prison terms of up to ten years. Companies found in breach of the Act can also incur substantial fines, reflecting the seriousness with which the UK government views these offenses.

Who is affected

The Crime and Policing Act 2026, being a national Act of Parliament for the United Kingdom, applies uniformly across England, Wales, Scotland, and Northern Ireland. Its reach is broad, impacting several distinct groups:

AI Developers and Researchers: Anyone involved in the creation, training, or distribution of AI models, particularly those with generative capabilities, must be acutely aware of the new criminalisation of "CSA Image Generators." The "Technology Testing Defence" is crucial for those conducting legitimate safety research.
Online Platform Operators: This includes social media companies, forum administrators, chat service providers, and any other entity hosting user-generated content. Moderators and administrators now face direct legal liability if they knowingly facilitate the sharing of CSAM or grooming advice.
Individuals Crossing UK Borders: Any person entering or leaving the UK with digital devices (phones, laptops, tablets, etc.) is subject to the new Border Force powers. The obligation to unlock devices upon request under reasonable suspicion is a significant change for travellers.
Anyone Involved in CSAM: Naturally, individuals involved in the creation, possession, or distribution of child sexual abuse material, including the newly defined "pseudo-photographs," face severe criminal penalties.

In essence, the Act affects not just the direct perpetrators of child abuse but also those who develop the tools that could facilitate it, and the platforms that host it. It also impacts the general public through the expanded powers of border officials.

Three things to do this week

Given that the Crime and Policing Act 2026 is now in force, it is crucial for relevant parties to take immediate action to ensure compliance:

Review AI Development Practices: If you are an AI developer or part of an organisation working with generative AI, immediately audit your models and development pipelines. Ensure that no AI models or software are being created, possessed, or distributed that could be deemed "optimized for generating child abuse imagery." Implement robust safeguards and ethical guidelines to prevent such misuse.
Strengthen Platform Moderation Policies: For online platform operators, administrators, and moderators, it is imperative to review and update your content moderation policies and enforcement mechanisms. Ensure that you have clear, effective procedures for identifying, removing, and reporting child abuse material and grooming activity. Provide adequate training to staff to ensure they do not knowingly facilitate such content or advice.
Apply for Testing Authorisation: If your work involves intentionally generating child abuse material for legitimate safety testing, such as stress-testing AI models for vulnerabilities, you must apply for authorisation from the Secretary of State. Do not proceed with such testing without explicit legal authorisation to benefit from the "Technology Testing Defence."

Related context

The UK's Crime and Policing Act 2026 is part of a growing global effort to combat the proliferation of AI-generated child sexual abuse material and enhance digital safety. Similar legislative initiatives are emerging in other jurisdictions, reflecting a shared international concern:

California AB 1831 - AI-Generated Child Sexual Abuse Material (/regulations/RAI-US-CA-CA1ACXX-2024): This Californian bill also addresses the issue of AI-generated CSAM, demonstrating a parallel legislative trend in the United States to criminalise synthetic images of child abuse.
Child Sexual Abuse Material Amendments (Utah) (/regulations/RAI-US-UT-HB28900-2026): Utah's amendments similarly aim to update existing laws to encompass new forms of CSAM, including those created through artificial intelligence, highlighting a multi-state approach to this evolving threat.
Concerning sexually explicit depictions of minors (Washington) (/regulations/RAI-US-WA-SB51050-2026): Washington State's legislation also seeks to broaden the scope of laws concerning child sexual exploitation to include digital and AI-generated content, aligning with the UK's proactive stance.

These interconnected legislative efforts underscore the global challenge posed by AI-generated illicit content and the necessity for comprehensive legal responses across jurisdictions.

Note: this article was drafted by AI - Google Gemini