The law has always struggled to keep pace with technology. The internet existed for years before legislation caught up with the questions it raised about privacy, defamation, intellectual property, and liability. AI is moving faster still, which means the legal landscape in 2026 is genuinely in transition — some things are clearly illegal, some things are clearly legal, and a significant space in between is contested, uncertain, or in the process of being resolved.
This article covers the most important legal questions that directly affect ordinary people and families: deepfakes, copyright, AI-generated content, and the rights you have as a consumer of AI services.
Deepfakes and the law
A deepfake is an AI-generated image, video, or audio clip that places a real person in a situation they were never actually in — saying something they never said, doing something they never did. The technology has become dramatically more accessible and convincing in the past two years.
The UK's legal response has been meaningful. The Online Safety Act 2023 made it illegal to share non-consensual intimate deepfakes — AI-generated sexual images of real people without their consent — punishable by up to three years in prison. In February 2026, the Data (Use and Access) Act brought further provisions into force that specifically address the creation of intimate images of adults without consent or reasonable belief in consent.
This law is significant. It closes a gap that existed because previous legislation required proof of intent to cause harm — intent that was sometimes difficult to establish. The new provisions focus on consent: if you create or share a realistic intimate image of a real person without their consent, the criminal liability attaches regardless of whether you intended to harm them.
For parents: in early 2026, there were several documented UK cases of AI-generated intimate images of school-age children being shared in peer groups. Schools are increasingly aware of this. Under UK law, creating or sharing any sexual image of anyone under 18 is illegal, regardless of whether the image is AI-generated or real.
Deepfakes used for political or financial deception — impersonating politicians, creating fake executive statements, generating fraudulent investment content — are covered by existing fraud and defamation law, though prosecution is complicated by the difficulty of identifying creators in many cases.
Copyright and AI-generated content
If you use AI to write a story, generate an image, compose music, or create any other creative work, who owns it?
In the UK, copyright currently requires a human author. The Copyright, Designs and Patents Act 1988 provides protection for "computer-generated works" — content produced by a computer where there is no human author — but the interpretation of what this covers in the context of modern AI tools is actively being tested.
Practically: if you use AI as a tool — providing the prompts, making creative decisions, selecting and editing the output — there is an argument that the resulting work is yours. If you ask AI to generate something with minimal input and publish the output unchanged, the legal position is less clear, and some organisations have explicitly stated they will not register copyright for AI-only works.
The more complicated question is what AI companies own. The major AI image generators were trained on images scraped from the internet, many of which were under copyright. Multiple legal cases are in progress in the UK and internationally, with artists, photographers, and record labels arguing that using their work for training without consent or payment constitutes infringement. These cases have not yet produced definitive UK judgments, though settlements and licensing deals are beginning to emerge.
For practical purposes: if you are creating content for commercial use with AI assistance, check whether your intended platform or client has policies about AI-generated material, and be transparent about your process.
Your rights as a consumer of AI services
The EU AI Act, which reached full compliance deadline on 2 August 2026, establishes specific rights for people who interact with AI systems in consequential contexts. UK domestic AI legislation is developing in parallel.
Most relevantly for ordinary people:
The right to know you are talking to an AI. The EU AI Act requires that AI systems designed to interact with humans must make clear they are not human, unless it is obvious from context. This applies to chatbots, customer service agents, and other systems that might otherwise be mistaken for people.
The right to human review of significant automated decisions. Where AI makes a decision that significantly affects you — a loan rejection, an employment decision, an insurance assessment — you generally have the right to request human review. In the UK, this is rooted in the Data (Use and Access) Act 2025, which updated the automated decision-making provisions of UK GDPR.
Data rights. Your personal data used by AI companies remains subject to UK GDPR, including your rights of access, objection, and erasure, as covered in the Your Digital Footprint series.
The practical takeaway for families
The legal landscape is moving, which means three things are worth keeping in mind.
First: the law does not yet cover everything. There are uses of AI that are harmful, exploitative, or deceptive that are not currently illegal in the UK. Do not assume that because something is technically legal, it is safe, ethical, or something you want to be involved in.
Second: the most important protections are about consent and transparency. Creating realistic content involving real people without their knowledge or agreement is legally and ethically problematic regardless of the technology used. Impersonating real people, including through AI, for deceptive purposes is already illegal in most relevant contexts.
Third: when something goes wrong — a deepfake of you or your child circulating, AI-generated fraud content using your likeness — the law now provides more recourse than it did two years ago. Report to the platform, report to the police, and seek support from organisations like the Revenge Porn Helpline (0345 6000 459) which covers non-consensual intimate image sharing including AI-generated material.
What does this mean for me?
Sharing intimate AI-generated images of real people is now a criminal offence in the UK. This applies to images of adults and to any images of anyone under 18.
Copyright on AI-generated commercial content is unclear — be transparent with clients and platforms about AI's role in your creative work.
You have the right to human review of significant decisions made about you by automated systems.
Report and seek support if you are affected by a deepfake or AI-generated impersonation — the law now provides more routes than it previously did.
🧠 The Human Factor
| Technology involved | AI image, video, and audio generation tools; large language models used for content creation; automated decision-making systems in finance, employment, and insurance |
| Root cause | AI capabilities have developed faster than the legal frameworks designed to govern them — creating a transitional period in which harm can occur in spaces the law has not yet clearly addressed |
| What was at risk | Reputation, personal safety, creative rights, and the ability to make informed decisions about consequential AI-driven outcomes |
| Prevention | Understanding what is now illegal (non-consensual intimate deepfakes); being transparent about AI use in commercial creative work; exercising rights to human review of automated decisions |
References and sources
- Online Safety Act 2023 — legislation.gov.uk
- Data (Use and Access) Act 2025, Part 5 provisions in force from 5 February 2026 — gov.uk
- EU AI Act compliance deadline 2 August 2026 — artificialintelligenceact.eu
- Revenge Porn Helpline (non-consensual intimate image support) — 0345 6000 459