Generative AI made it trivially easy to create a realistic image, video, or voice clip. That’s the headline everyone already knows.

What gets less attention is how fast this moved from “difficult and expensive” to “something an ordinary person can stumble into on a Tuesday afternoon.” I spend most of my time on this site testing AI tools and pricing pages. This piece isn’t a product review. It’s a practical assessment of where the law, the platforms, and the fraud numbers actually stand right now — because most of what’s ranking for this topic is either outdated, recycled from a single Telegraph article, or missing the fraud side of the story entirely.

I pulled this together from primary legislation on legislation.gov.uk, Ofcom’s own press releases, and independently audited fraud datasets — not secondary blog posts repeating each other. Where a number is an estimate rather than a hard count, I’ve said so. That distinction matters more than it usually gets credit for.

The Numbers Are Starting to Tell a Different Story

Twenty police forces across England and Wales searched their crime records using terms including “AI-generated,” “deepfake,” and “nudify.” In 2023, that search returned 10 recorded crimes. By July 2026, it returned 163.

Here’s the part most write-ups skip: 163 is not the national total. It’s what came back from the forces that responded to the search, using the specific keywords in that search. Different forces record incidents differently, and plenty of victims never report at all.

Treat 163 as a signal that the problem is growing, not as a prevalence estimate. That distinction is the difference between responsible reporting and a misleading headline, and I’d rather be boring and accurate than dramatic and wrong.

What Is AI “Nudification,” Exactly?

“Nudification” tools take an ordinary photo of a real person and generate a fabricated image that makes them appear nude or sexually explicit. UK legislation calls this a “purported intimate image” — an important legal phrase, because it means the offence exists whether or not the image is what it appears to be.

The person in the image may never have taken such a photo. The AI system generated something convincing enough to be mistaken for real, and that’s where the harm starts — not in whether the image is technically “real,” but in what happens to the person once other people believe it is.

A photo posted publicly on a normal, unremarkable social media account can become raw material for this. The person did nothing reckless. They just existed online, the same way almost everyone does now.

The UK Has Started Criminalising the Creation and Requesting of Fake Intimate Images

Section 138 of the Data (Use and Access) Act 2025 came into force on 6 February 2026, via S.I. 2026/31. It inserted new sections 66E through 66H into the Sexual Offences Act 2003, creating two distinct offences: creating a purported intimate image of an adult without consent, and requesting the creation of one — even if the image is never actually made.

That second part is the interesting one. Most legislation waits until harm is produced or distributed. This one criminalises the request itself, which means the law tries to intervene before the image exists at all, not after it’s already circulating. The UK’s Crown Prosecution Service confirms this covers sexually explicit AI-generated deepfakes specifically, not just traditional photo editing.

The timing wasn’t an accident, either. Technology Secretary Liz Kendall accelerated commencement in January 2026 partly in response to the Grok AI image-generation controversy, where Ofcom opened an investigation into X and xAI over sexualised imagery generated on the platform.

The Law Is Also Moving Against the Tools Themselves

The Crime and Policing Act 2026 received Royal Assent on 29 April 2026 and went a step further. New section 66I of the Sexual Offences Act 2003 makes it an either-way criminal offence to make, adapt, supply, or offer to supply a “purported intimate image generator” — the legal term for a nudification tool.

This is regulators going after the supply chain, not just the end user. In my view, this is the more consequential of the two laws. Criminalising individual requests is necessary but slow — it depends on catching one person at a time. Criminalising the tool supplier is a lever that can shut down access at scale, the same way payment-processor pressure choked off earlier waves of scam sites.

Platforms Are Being Given Stronger Responsibilities

On 9 September 2026, Ofcom opened a formal enforcement programme requiring platforms to have automated “hash-matching” technology in place by 30 September 2026, or to prove that an equally effective alternative is running. Hash matching converts an image into a digital fingerprint and compares it against known abusive material without anyone having to re-view the original image — the same principle behind StopNCII.org, which Ofcom has now signed a memorandum of understanding with.

Separately, the Crime and Policing Act 2026 requires platforms to remove reported non-consensual intimate images within 48 hours, with Ofcom planning a consultation by the end of 2026 to fold that duty into its Illegal Harms Codes of Practice.

The penalty is what actually changes the calculus for a large platform: up to 10% of global annual revenue. For a company the size of a major social network, that isn’t a rounding-error fine — it’s a board-level risk, which is exactly the kind of leverage that content-moderation-as-afterthought has never had to reckon with before.

Beyond Intimate Images: The Wider Deepfake Fraud Economy

Intimate-image abuse is the most viscerally upsetting deepfake harm, but it’s not the only one reshaping trust online. A separate, much larger-dollar problem is unfolding in fraud and identity verification, and it’s worth understanding both, because they share the same root cause: synthetic media that’s cheap to produce and hard to detect.

Surfshark’s 2026 research, drawing on the AI Incident Database, Resemble AI, and the OECD, puts documented global deepfake-fraud losses at a minimum of $3.7 billion, with about 89% of that recorded since 2025. Sumsub’s Identity Fraud Report found deepfake attacks up roughly 2,100% since 2022, and the FBI’s Internet Crime Complaint Center broke out AI-enabled fraud as its own category for the first time in 2025, logging $893.3 million in audited losses.

A 2026 iProov survey of 2,000 people across the UK and US, which the firm calls the “Great Trust Recession,” found 75% think it’s likely a company could unknowingly hire someone using a fake identity or deepfake, and more than half now say banks should be liable for losses caused by deepfake-enabled fraud. That’s a meaningful shift in public expectation, and it’s one financial institutions haven’t fully caught up with yet.

But Passing Laws Is Only the Beginning

A law can exist on paper while enforcement stays genuinely difficult in practice. Police forces need to recognise these cases as they come in, record them consistently, and gather digital evidence that can involve anonymous accounts, foreign-registered companies, and servers sitting outside UK jurisdiction entirely.

Victims also need to feel confident enough to come forward, which is genuinely hard with intimate-image abuse specifically — embarrassment and fear that reporting will make things worse are real barriers, not excuses.

And there’s a structural problem no single country’s law can solve alone: a victim in one country, a perpetrator in another, an AI service hosted in a third, and a platform storing the material somewhere else entirely. Digital technology doesn’t respect borders. Legal systems still mostly do.

This Is Already Affecting Schools and Young People

Australia’s eSafety Commissioner reported roughly twice as many under-18 reports about digitally altered intimate images compared with the year before, and logged more than 100 reports between January and March 2026 involving anonymous accounts specifically targeting schools and school staff — most using photos harvested from school social-media pages.

A joint WIRED and Indicator investigation separately identified nearly 90 schools and more than 600 students affected by AI-generated deepfake imagery since 2023, across at least 28 countries. This has moved from a hypothetical AI-safety talking point into an active school-administration problem.

It’s worth being precise here, because the datasets genuinely measure different things. Police-recorded crime counts, platform moderation statistics, and the Internet Watch Foundation’s own assessments of AI-generated child sexual-abuse material are not interchangeable. The law is also unambiguous on this point: the new adult “purported intimate image” offences do not replace or weaken existing law covering indecent images of children — that framework operates entirely separately and remains fully in force.

What To Do If You’re Targeted

If you or someone you know is targeted with a non-consensual intimate image, this is the practical order of operations:

1. Preserve evidence first. Save URLs, usernames, dates, timestamps, and screenshots before content can disappear or be edited. Don’t redistribute the image itself just to document it.
2. Report to the platform using its NCII/hash-matching tool. Most major platforms now route through StopNCII.org or an equivalent system that removes the image without you needing to send it anywhere.
3. Report to the police. In the UK, both creation and requesting of the image are now specific criminal offences — this is no longer a grey area to describe informally.
4. Contact a dedicated support service. In the UK, the Revenge Porn Helpline supports adults affected by this specifically, separate from general victim-support lines.
5. If a child is involved, treat it as a child-protection matter immediately and involve the appropriate authorities or a child-protection organisation, not general platform reporting alone.

How Businesses Can Reduce Deepfake Fraud Risk

On the fraud side, the defensive playbook is less about “spotting the fake” and more about redesigning the approval process so a convincing fake can’t get through on its own:

1. Require second-channel verification for any payment, wire transfer, or credential-reset request that arrives by voice or video call, even if the voice sounds exactly right.
2. Don’t rely on live video or voice alone for identity verification during onboarding — pair it with document forensics and, where available, liveness detection.
3. Use an AI content detector like IsFake AI as one signal among several, not a single source of truth — detection accuracy still varies a lot by content type.
4. Train finance, HR, and executive-support staff specifically on voice-clone and video-call impersonation scenarios, since generic phishing training doesn’t cover this attack pattern.
5. Document who is authorised to approve urgent exceptions, and require that any “urgent, don’t tell anyone” request be independently verified before action, regardless of who it appears to come from.

My Assessment: Is the UK’s Approach Actually Working?

Having gone through the actual legislation rather than secondhand summaries, I think the UK’s framework is genuinely one of the more thoughtful regulatory responses to a fast-moving AI harm I’ve reviewed. It targets creation, requesting, tool supply, and platform response in one coordinated package instead of picking a single point in the chain and hoping that’s enough.

My honest opinion: legislation this specific is a real achievement, but it’s still a law enforced by people, against activity that can be hosted anywhere in the world in minutes. Ofcom’s 10% revenue threshold is the sharpest tool in the whole package — it’s the one lever that reaches platforms regardless of where the actual perpetrator is sitting. Everything else is still catching up.

FAQ

Is it illegal to create a deepfake of someone in the UK?

Creating a purported intimate image of an adult without consent has been a specific criminal offence since 6 February 2026, under Section 138 of the Data (Use and Access) Act 2025. Requesting one be created is also an offence, even if it’s never made.

What happens if a platform doesn’t remove a deepfake image?

Under the Crime and Policing Act 2026, platforms must remove reported non-consensual intimate images within 48 hours. Ofcom can fine companies up to 10% of their global annual revenue for failing to meet their duties under the Online Safety Act.

How much money is lost to deepfake fraud each year?

Surfshark’s 2026 analysis puts documented global deepfake-fraud losses at a minimum of $3.7 billion between 2020 and mid-2026, with roughly 89% of that recorded in 2025 and 2026 alone. Because researchers only count publicly reported cases, the true figure is likely higher.

Does the “163 crimes” figure represent the total scale of the problem?

No. It’s the number of deepfake- or nudify-related crimes returned by 20 police forces that responded to a specific keyword search of their records, up from 10 in 2023. It’s a strong signal of growth, not a national prevalence count.

What should I do if I find a fake intimate image of myself online?

Preserve evidence, report it through the platform’s non-consensual intimate image reporting tool (many now use StopNCII.org), report it to the police, and contact a dedicated support service such as the Revenge Porn Helpline in the UK.

Are deepfake laws for children handled differently from adult laws?

Yes. UK legislative notes explicitly confirm the new adult “purported intimate image” offences do not replace or affect the existing, separate criminal law covering indecent images of children, which remains fully in force and is treated with greater severity.

Conclusion

AI has handed ordinary people extraordinary creative power, and a meaningful share of that power is being turned against other ordinary people — as intimate-image abuse, as fraud, and as a slow erosion of what “trustworthy” even means online.

The UK’s rapidly evolving legal framework — from Section 138’s creation offence, to the Crime and Policing Act’s tool-supplier offence, to Ofcom’s 10%-of-revenue enforcement threshold — shows regulators are finally treating this as a serious criminal and online-safety issue rather than an edge case. That’s real progress, and I don’t think it gets enough credit.

But technology updates with a software release. Law doesn’t. That gap — between how fast the tools evolve and how fast enforcement can adapt — is going to define how well any of this actually protects people over the next few years. The question isn’t whether AI can produce a convincing fake. It clearly can. The harder question is whether the systems built to catch it can move fast enough to matter.

This is a sensitive topic. If you’re personally affected by anything discussed here, UK-based support is available through the Revenge Porn Helpline, and I’d encourage reaching out rather than handling it alone.