The new Article 5 prohibitions and the technical safeguards they name
Regulation (EU) 2026/1744 inserted two prohibited practices into Art. 5(1) of Regulation (EU) 2024/1689, points (ba) and (bb), with the qualifying paragraphs Art. 5(1a) and (1b). The inserted points apply on a later date than the rest of Chapter II, given on the regulation page Deferred. For a provider of an image, video or audio generator the operative words are "reasonably foreseeable and reproducible outcome" and "reasonable and adequate technical safety measures and other safeguards". This post reads each clause and names the record it asks for.
What the source says
Point (ba) prohibits the placing on the market, putting into service or use of an AI system "that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person's intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person's freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation". Point (bb) prohibits the same acts for a system "that generates or manipulates material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU, except where a 'without right' defence applies under national law". Amended Art. 113(a) applies these points, with Art. 5(1a) and (1b), on the deferred date shown above; the other points of Art. 5(1) keep the Chapter II application date. The consolidated text is the primary source; the Gibson Dunn and Covington briefings listed on the regulation page state the same scope and the same date.
Art. 5(1a)(a) narrows the provider-side prohibition to two cases. Case (i): the generation or manipulation "is the intended purpose of the AI system". Case (ii): "the system's design, training, architecture, capabilities or user-facing functionalities make that generation or manipulation a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system does not have reasonable and adequate technical safety measures and other safeguards to reliably prevent that generation or manipulation, taking into account reasonably foreseeable misuse". Case (ii) holds four conditions: the outcome originates in the system as shipped; it is foreseeable and reproducible; producing it needs no significant technical modification; and no reasonable and adequate safeguard reliably prevents it under foreseeable misuse.
Art. 5(1a)(b) narrows the deployer-side prohibition to use "for the purpose of generating or manipulating such material or performance". The Covington briefing reads this as excluding accidental generation and as covering a deployer who circumvents the provider's safety measures. Art. 5(1b) adds a boundary for point (ba): manipulation "that does not increase the exposure of any depicted intimate parts or alter the nature of any depicted sexually explicit activities shall not constitute manipulation".
| Provision | Addressee | Condition in the text | Record that addresses it |
|---|---|---|---|
| Art. 5(1)(ba) | Provider and deployer | Realistic intimate or sexually explicit material of an identifiable natural person without explicit consent | Output-class determination for the system's modalities |
| Art. 5(1)(bb) | Provider and deployer | Material or performance within Article 2, points (c) and (e), of Directive 2011/93/EU | Output-class determination for the system's modalities |
| Art. 5(1a)(a)(i) | Provider | Generation or manipulation is the intended purpose | Intended purpose as stated in the instructions for use, Art. 3(12) |
| Art. 5(1a)(a)(ii) | Provider | Foreseeable and reproducible outcome, no significant modification, no reasonable and adequate safeguard that reliably prevents it | Misuse prompt set, run counts, outcome counts, safeguard description and safeguard re-run |
| Art. 5(1a)(b) | Deployer | Use for the purpose of generating or manipulating such material | Use-purpose record and staff instruction |
| Art. 5(1b) | Provider and deployer | Manipulation that neither increases exposure nor alters the nature of the activity is not manipulation | Function-level description of what each editing function changes |
The text names no technique, no metric and no rate. It does not define "reasonable and adequate" and it does not refer to Art. 50. Neither briefing connects the new prohibitions to the marking duty; both present Art. 5 and Art. 50 as separate obligations. This post follows the sources and treats them as separate.
What changes for a provider or deployer
The provider of a system that can produce realistic images, video or audio of persons holds one documentation question and one test question. The documentation question is Art. 5(1a)(a)(i): the intended purpose, as stated in the instructions for use and promotional material under the definition in Art. 3(12). The test question is Art. 5(1a)(a)(ii). "Reproducible" makes it a test: a repeated run of the same prompt set against the same system version gives a result. The Act sets no run count and no rate at which an outcome counts as reproducible; the provider records the count of runs, the count of runs that produced the material, and the reading of "reproducible" it applies, with the justification. The prompt set derives from "reasonably foreseeable misuse", so the record also states how the set was built.
The safeguard clause asks for evidence that the technical safety measures and other safeguards "reliably prevent" the outcome. That evidence is a description of each measure and a re-run of the same prompt set with the measures active, including attempts to circumvent them. The result belongs in a test report with its protocol run record: system version hash, prompt set identifier, run counts, outcome counts per measure, and the deviations. No published protocol on this site covers the Art. 5(1a) safeguard test. The nearest published method is the jailbreak-resistance campaign, the prompt-attack subset of PR-15-ROB v1.0, whose threat model and attack outcome matrix give an Art. 5(1a) run its structure. Art. 99(3) places Art. 5 in the highest penalty tier, and the action that follows is the output-class determination and the safeguard test report, kept with the technical documentation.
The same class of system, one that generates synthetic image, audio or video content, carries the marking duty under Art. 50(2), with a grace period for systems already on the market Deferred. The Art. 50 obligation page lists the testable marking elements, and PR-50-MARK v1.0 on its protocol page tests marking presence, survivability across transformations and third-party detectability. AIAssuranceLabs runs that protocol under the Article 50 transparency and marking/watermark testing service, within the limits stated on what we cannot do. A marking result shows that an output carries a mark and nothing about whether the system produced it, so the Art. 50(2) file and the Art. 5(1a) file stay apart.
What to do now
- Determine whether the system generates or manipulates realistic images, video or audio of identifiable natural persons and record the output classes per modality (Art. 5(1)(ba) and (bb)).
- Record the intended purpose as stated in the instructions for use and check that the promotional material states the same purpose (Art. 5(1a)(a)(i), Art. 3(12)).
- Build a prompt set from reasonably foreseeable misuse, run it against the system version as shipped and record run counts and outcome counts (Art. 5(1a)(a)(ii)).
- Describe each technical safety measure and other safeguard, re-run the prompt set with circumvention attempts and file the result as a test report with its run record (Art. 5(1a)(a)(ii)).
- Keep the Art. 50(2) marking evidence in its own file, built per the Article 50 transparency guide.
- As a deployer, record the purposes for which staff use the system and the instruction that excludes the prohibited purpose (Art. 5(1a)(b)).
Related pages
The pages below carry the Art. 50 obligation record, the marking protocol, the transparency guide, the service and the hub for generative AI providers.
- Obligations
- Protocols
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.