UK guidance on intimate-image generators: the legal risks for developers and suppliers operating across borders

New guidance explains an existing offence

The Home Office published police guidance on purported intimate-image generators on 15 October 2026. The offence was introduced through the Crime and Policing Act 2026 and commenced on 29 June. The October publication explains enforcement of an existing provision; it is not the date on which the prohibited conduct first became criminal.

The guidance concerns tools presented or designed for generating purported intimate images of people. For software businesses, including developers based in Georgia with UK connections, the relevant questions extend beyond where a programmer works. The product, the conduct of each participant and the statutory territorial rules all matter.

Function and circumstances matter more than a convenient label

Section 99 of the 2026 Act inserted sections 66I to 66L into the Sexual Offences Act 2003. The official guidance explains conduct including making, adapting, supplying and offering to supply a relevant thing. The provision can concern software, a service or electronic information, rather than only a physical device.

The statutory assessment considers what a reasonable person would conclude in the circumstances. A company should therefore examine actual functionality, presentation and distribution. Calling a product a general image editor does not, by itself, resolve how the law applies to a feature marketed for intimate depictions of identifiable people.

Safeguards require evidence

Section 66I includes a defence requiring proof that all reasonable steps were taken to prevent creation of purported intimate images without the person’s consent. Whether that defence applies is a legal and evidential question. A terms-of-service statement should not be treated as a guaranteed answer without examining the product and the measures actually taken.

Practical governance can include documenting intended uses, assessing foreseeable misuse, restricting harmful functionality and recording how reports are handled. These are issues for a tailored legal and technical assessment, not a declaration that any particular control package creates immunity. Retaining the reasoning behind design decisions can be as important as retaining the policy document.

The offence has boundaries

The guidance distinguishes this supplier-focused offence from other offences involving creation or distribution of intimate images. It also explains that mere possession is not criminalised by this particular provision. That narrow distinction must not be expanded into a claim that all conduct involving such material is lawful; separate offences can apply.

The maximum sentence on indictment described in the guidance is three years’ imprisonment, an unlimited fine, or both. That is a statutory maximum, not the sentence in every case. Charging decisions, proof, defences and sentencing remain individual questions. The presumption of innocence applies to an accused person.

A foreign business needs a jurisdiction analysis

The provisions operate within the England and Wales legal framework, with specified extraterritorial rules. A Georgian company should identify any UK incorporation, relevant nationality or other statutory connection rather than assume either universal UK jurisdiction or complete protection from operating abroad. Platform obligations and criminal liability also require separate analysis.

A business reviewing a product should map who develops it, who supplies access, who controls marketing and who receives misuse reports. Contracts can allocate tasks between companies, but the criminal-law analysis still examines the actual conduct and the applicable offence.

• Review the current statutory text alongside the October guidance.
• Document the product’s capabilities, intended users and distribution model.
• Assess safeguards and the evidence supporting any available defence.
• Obtain jurisdiction-specific advice before launching features with intimate-image risks.

People reporting abuse should preserve relevant messages and links while limiting unnecessary circulation of the material. The new guidance is most useful when it helps distinguish the supplier offence, other image-abuse offences and the procedures for protecting the affected person. It should not be read as a universal rule for every AI image service.

Legal check date

Sources and law checked on 21 October 2026. Later developments are not reflected automatically. Application of the rules depends on the individual facts.