AI-generated child sexual abuse material is no longer a future safeguarding risk. It is already here, it is growing rapidly, and children are being harmed by it.
Artificial intelligence has made it possible to create highly realistic sexual images of children using tools that are increasingly accessible. What once required advanced technical knowledge can now be done using readily available technology.
Traditional detection systems can identify known child sexual abuse material by comparing images against existing digital fingerprints, or hashes. But newly generated material may not match an existing hash because the image itself is new. Hash-matching therefore cannot address this problem on its own.
For more than a decade, much of my work in online safeguarding has involved talking about how children's images are used, shared and misused online. The risks are not new. What has changed is the technology, and the speed, scale and ease with which harm can now be created.
Deepfakes, nudify tools and generative AI have changed what is possible. An ordinary photograph of a child can now be manipulated into sexual imagery. Entirely new abuse material can be generated in seconds. Children can be targeted with images depicting things that never happened, but which can still be used to humiliate, threaten, exploit or blackmail them. We cannot wait for the technology to develop further, or for more children to be harmed, before we respond.
Behind the technology, terminology, statistics and legislation is something we must not lose sight of: children. The technology may be new. Our safeguarding responsibility is not.
What is AI-generated child sexual abuse material?
AI-generated child sexual abuse material is sexual abuse imagery of children created or altered using artificial intelligence. It can include fully synthetic images and videos, photographs of real children altered using so-called "nudify" tools and newly generated material created from images of existing victims.
Depending on the material and the jurisdiction, it can constitute child sexual abuse material or child sexual exploitation material, and its creation, possession or distribution may be a criminal offence. That distinction matters because words such as "fake", "synthetic" or "virtual" can unintentionally make the harm sound less serious. It isn't.
Why the language matters
Words shape how seriously we understand harm. The Terminology Guidelines for the Protection of Children from Sexual Exploitation and Sexual Abuse, developed by an interagency working group led by ECPAT International and updated in a second edition in 2025, say that the term "child pornography" should be avoided wherever possible outside legal texts.
The preferred terms are child sexual abuse material or child sexual exploitation material. Children cannot consent to their own abuse, and our language should never suggest that they can.
The Guidelines also warn against describing synthetic material as "virtual", because there is nothing unreal about the sexualisation of children. This is particularly important with AI.
When people hear that an image is "AI-generated", an understandable question can follow: If no real child was physically abused to create this particular image, who is the victim?
But that is not the only safeguarding question we should be asking. We also need to ask: How can this material be used to abuse, exploit or endanger children?
Why AI-generated abuse material is not victimless
Some AI-generated material uses the face or likeness of a real child. Some takes an ordinary photograph of a child, perhaps taken from social media, a school account or somewhere else online, and transforms it into a sexual image without the child's knowledge or consent. Some material can re-victimise survivors by using existing abuse images to generate new content.
The Terminology Guidelines identify several further harms. AI-generated abuse material can:
- victimise or re-victimise real children whose likeness is used, including survivors whose existing abuse images are used to train or seed models;
- be used to groom children for exploitation;
- fuel demand and help sustain a market for abuse material;
- normalise the sexualisation of children and contribute to a culture of tolerance around it; and
- increase the likelihood that an offender will attempt to contact a child.
There are two further harms that deserve particular attention. The first is sextortion. The National Center for Missing & Exploited Children (NCMEC) has described cases in which a child refuses to send a sexual image and an offender creates a fake one instead, then uses that image to blackmail or threaten the child.
Think about what that means from the child's perspective. They did not create the image. They did not consent to it. It may depict something that never happened. But the humiliation, fear, threats and loss of control can be very real.
The second harm is to investigations themselves. Large volumes of synthetic material can make it harder for investigators to determine which images depict real children who may currently be experiencing abuse and need to be identified and protected.
Synthetic does not mean harmless. Fake does not mean victimless.
How big is the problem?
The best-documented figures come from hotlines that assess reports every day, and they show how quickly the landscape is changing.
The Internet Watch Foundation (IWF) found 3,443 AI-generated child sexual abuse videos in 2025, more than 260 times as many as in 2024. Sixty-five per cent were in Category A, the most severe category under UK law, compared with 43% of videos involving real children. Girls were depicted in 97% of the AI-generated images.
Across images and videos, the IWF's 2026 report on AI abuse material says it assessed 8,029 items in 2025 as showing realistic child sexual abuse.
NCMEC received 4,700 CyberTipline reports involving generative AI in 2023, 67,000 in 2024 and more than 400,000 in 2025. It says more than 275 direct victims of AI-generated CSAM were identified in 2024 and 2025 alone.
And this sits within a much larger problem. Childlight Global Child Safety Institute estimates that more than 300 million children a year are victims of technology-facilitated sexual exploitation and abuse.
These figures tell us something important. AI-generated child sexual abuse material is no longer an edge case in online child protection. Generative AI is changing both the scale of abuse material and the ways in which it can be created and used.
What the law now says
The law is catching up, but unevenly. The position below is as of September 2026.
One of the misconceptions we need to challenge is the assumption that if an image was generated by AI rather than created through photographing physical abuse, it cannot be illegal. That is not a safe assumption.
United Kingdom: Generated CSAM is already illegal. The Protection of Children Act 1978 covers "pseudo-photographs", while non-photographic images are covered by the Coroners and Justice Act 2009.
The Crime and Policing Act 2026, which received Royal Assent on 29 April 2026, adds an offence of making, adapting, possessing or supplying a "CSA image-generator", an AI model optimised to create CSAM, with a maximum penalty of five years in prison. It also extends the offence of possessing "paedophile manuals" to guidance on creating such images. As of 25 September 2026, legislation.gov.uk showed those sections as not yet in force. A separate offence covering the making or supplying of tools that generate fake intimate images of a person, including nudify apps, came into force on 29 June 2026.
European Union: The existing Directive already covers realistic images of a child. On 22 June 2026, the European Parliament and Council reached political agreement on a recast Directive criminalising AI-generated abuse material, AI systems designed or adapted to produce it and instruction manuals for offenders. As of the Parliament's latest update on 1 August 2026, it was awaiting formal adoption. Separately, the EU AI Act prohibits AI systems that generate CSAM or non-consensual intimate content, including nudification apps, from December 2026.
United States: The FBI states that CSAM created with generative AI is illegal. Federal law on obscene visual representations expressly covers computer-generated images and does not require that the child depicted actually exists. The TAKE IT DOWN Act, signed on 19 May 2025, makes it a crime to knowingly publish intimate images or digital forgeries of an identifiable minor. Since 19 May 2026, covered platforms must remove reported images within 48 hours, with enforcement by the Federal Trade Commission.
Australia: An industry standard under the Online Safety Act, registered in June 2024, applies to "high impact generative AI" services. These services must have systems in place to deter and disrupt users attempting to generate child sexual exploitation material.
Laws matter. But legislation alone cannot solve a problem that is partly created by the way technology is designed.
What tech companies must do
Technology companies have a crucial responsibility. In 2024, AI developers including Amazon, Anthropic, Google, Meta, Microsoft, Mistral AI, OpenAI and Stability AI signed up to Safety by Design principles for generative AI led by Thorn and All Tech Is Human. Those principles, alongside the areas I have consistently called for in safe and ethical technology, come down to this:
Ethical guardrails from the start: Training data should be sourced responsibly and screened for abuse material. Models should be stress-tested before release to determine whether they can generate sexualised images of children. Content provenance mechanisms can also help identify generated material. Safety by design is far better than trying to retrofit safeguarding after harm has occurred. Our safety-by-design checklist sets out what to check.
AI and human moderation: Technology needs to detect and block synthetic abuse content. Hash-matching against resources such as the IWF Hash List, which contains more than 3.2 million fingerprints of confirmed abuse images, remains important for identifying known material. But newly generated material may have no existing hash match. That means classifiers, other detection mechanisms and appropriately trained human reviewers are also needed.
Partnerships: Technology companies need to work with child-safety organisations, hotlines, law enforcement and one another to share appropriate intelligence, data and strategies. Platforms and app stores also need to address services and models designed to facilitate abusive image generation.
None of this can be left to reactive moderation after abusive material has already been generated or shared. Safeguarding needs to sit within the governance and design of the product from the beginning.
When this reaches the classroom
This is not only a technology-industry problem. It is increasingly a safeguarding issue for schools, families and organisations working with children. One example is the use of "nudify" tools or generative AI by children to create fake nude or sexualised images of classmates.
It may be tempting to see this primarily as inappropriate use of technology, a behaviour-management problem or a breach of a school's AI policy. It is more serious than that.
The IWF and NCA CEOP guidance for professionals says AI-generated child sexual abuse material "should be treated the same way as any other CSAM safeguarding concern". In England, Keeping children safe in education 2026 now expects school policies to cover nudes and semi-nudes, including those generated using AI.
This means schools need to be clear:
- This is not simply an AI-policy breach.
- It is not simply inappropriate device use.
- It is not simply a behaviour-management issue.
- It is a safeguarding concern.
Schools should not wait for an incident before deciding how they will respond. Policies, reporting routes and staff responsibilities should be clear before a child walks into a classroom and says an AI-generated sexual image of them is being shared. A clear safeguarding policy framework and trained staff make the difference when it happens.
The child depicted needs protection and support. But safeguarding should also consider every child involved, including the child who created or shared the material. Their behaviour may itself raise questions about exposure to harmful content, coercion, peer pressure, harmful sexual behaviour or other vulnerabilities that need to be understood.
The objective is not to minimise responsibility. It is to make sure our response remains a safeguarding response.
What parents, carers and educators can do
Parents, carers and educators do not need to become AI experts. But they do need to understand enough about these technologies to recognise the risks and have informed conversations with children. That means:
- staying informed about how AI is being used online and developing basic AI and digital literacy;
- teaching children about manipulated content and explaining clearly why creating or sharing a fake nude image of another person is abuse, not a joke; and
- creating safe, trusting relationships so children feel able to report something suspicious, frightening or uncomfortable without expecting blame.
We should also ask children what they are seeing. Children and teenagers may encounter new tools, trends and behaviours before the adults around them even know the names of the apps or technologies involved. Listening to children should therefore be part of how schools, families and organisations understand emerging risks.
That does not mean placing the responsibility for identifying risks on children. Adults remain responsible for safeguarding them. But children have knowledge about their digital lives that adults need to hear.
That last point matters enormously. A child who believes the first response will be anger, punishment or confiscation of their device may be less likely to disclose what has happened.
As with other forms of online harm, how adults respond can determine whether a child tells us the next time something goes wrong. Our guide to talking with children about AI chatbots has questions to start those conversations.
If a child is targeted
If a child tells you that an AI-generated sexual image has been created or shared of them, take it seriously.
Do not share, forward, download or save the image, even for the purpose of reporting it. UK guidance states that even the designated safeguarding lead should never copy, print, share or store it.
Reassure the child and listen. Make clear that they are not to blame, as the National Crime Agency advises.
Keep relevant messages, usernames and links where appropriate as evidence without copying or redistributing the sexual image itself.
Report the incident through the appropriate platform and safeguarding or law-enforcement channels. In a school or organisation, follow your safeguarding procedure and involve the designated safeguarding lead or safeguarding focal point.
Under-18s in the UK can use Report Remove, provided by the IWF and Childline. NCMEC's Take It Down service can help remove images taken of someone while they were under 18 from participating platforms without the image itself leaving the device. NCMEC says the service can be used whether the image is real or AI-generated. Anyone who encounters child sexual abuse material online can also report it through the IWF or NCMEC's CyberTipline, as appropriate.
In the UAE, child protection concerns can be reported to the Ministry of Interior's Child Protection Centre on the toll-free hotline 116111. If a child is in immediate danger or there is an emergency, call Dubai Police on 999.
And remember that an image does not have to depict an event that physically occurred for the emotional consequences to be serious. A child targeted by AI-generated sexual imagery may need the same careful safeguarding and emotional support as a child affected by other forms of sexual abuse or exploitation.
A shared responsibility
AI may change how child sexual abuse material is created, manipulated and distributed. It does not change our safeguarding responsibility.
Whether you develop technology, lead a company, teach in a classroom, work with children or raise a child, the question cannot simply be whether an image is "real". We need to ask:
- Is a child being harmed?
- Is a child at risk?
- Is this material being used to exploit, threaten, humiliate or groom someone?
- And what needs to happen now to protect them?
An image may be synthetic. The fear can be real. The humiliation can be real. The exploitation can be real. And the child affected by it is very real.
Technology will continue to change. Our responsibility to children does not.
Frequently asked questions
Is AI-generated CSAM illegal if no real child was involved?
In many countries, yes. In the UK, generated CSAM can be illegal however it was made, and EU law covers realistic images of a child. In the United States, federal law covers certain obscene computer-generated images even where the child depicted does not exist.
However, the ECPAT Terminology Guidelines note that such material is not illegal everywhere. Laws differ between jurisdictions, which is why local legislation and reporting requirements should always be checked.
What should a school do if pupils create deepfake nudes of classmates?
Treat it as a child-protection incident, not simply a discipline or AI-policy issue. Follow safeguarding procedures, involve the designated safeguarding lead or safeguarding focal point, avoid copying or sharing the images, report through the appropriate channels and support the child depicted.
The safeguarding needs of the child who created or shared the material should also be considered. Accountability and safeguarding are not mutually exclusive.
Why do you say "child sexual abuse material" rather than "child pornography"?
Because the material records, depicts or represents the sexual abuse or exploitation of children, and children cannot consent to that abuse. The Terminology Guidelines recommend avoiding "child pornography" wherever possible outside legal texts.
Can platforms detect AI-generated abuse material?
Partly. Hash-matching is important for detecting known images, but newly generated material may have no existing match. Companies therefore also need other detection technologies, appropriately trained human review and safeguards built into AI models themselves.
Where can I report an AI-generated sexual image of a child?
Report through the appropriate platform and national child-protection or law-enforcement channels.
In the UK, under-18s can use Report Remove, while the IWF accepts reports of child sexual abuse material found online. NCMEC's Take It Down can help remove images from participating platforms that were taken when the person depicted was under 18, including AI-generated images, and NCMEC's CyberTipline accepts reports of suspected child sexual exploitation.
In the UAE, child protection concerns can be reported to the Ministry of Interior's Child Protection Centre on 116111. In an immediate emergency, call 999.
Sources
- Terminology Guidelines for the Protection of Children from Sexual Exploitation and Sexual Abuse, Second Edition, Interagency Working Group, ECPAT International, 2025.
- 2025 Annual Data & Insights Report: Executive Summary, Internet Watch Foundation, 2026.
- Harm without limits: AI child sexual abuse material through the eyes of our Analysts, Internet Watch Foundation, 2026.
- Generative AI, National Center for Missing & Exploited Children, accessed September 2026.
- Over 300 million children a year are victims of online sexual exploitation and abuse, Childlight Global Child Safety Institute, 4 December 2024.
- Crime and Policing Act 2026: child sexual abuse material factsheet, Home Office, 19 May 2026.
- Crime and Policing Act 2026, section 72, legislation.gov.uk, accessed 25 September 2026.
- Crime and Policing Act 2026 (Commencement No.1 and Saving Provision) Regulations 2026, regulation 2, legislation.gov.uk, 2026.
- Circular 004/2026: Crime and Policing Act 2026, Home Office, 26 June 2026.
- Commission welcomes political agreement on criminal law rules to fight child sexual abuse, European Commission, 29 June 2026.
- Revision of the combating child sexual abuse Directive, Legislative Train Schedule, European Parliament, updated 1 August 2026.
- AI Act, European Commission, accessed September 2026.
- Child Sexual Abuse Material Created by Generative AI and Similar Online Tools is Illegal, Federal Bureau of Investigation, 29 March 2024.
- 18 U.S. Code § 1466A, Obscene visual representations of the sexual abuse of children, Legal Information Institute, Cornell Law School.
- Take It Down Act enforcement starts now: what to know about the FTC and TIDA, Federal Trade Commission, 19 May 2026.
- President Trump Signs Take It Down Act Into Law, Latham & Watkins, May 2025.
- Online Safety (Designated Internet Services, Class 1A and Class 1B Material) Industry Standard 2024, Federal Register of Legislation, registered 21 June 2024.
- Thorn and All Tech Is Human forge generative AI principles with AI leaders to enact strong child safety commitments, Thorn, 2024.
- Image Hash List, Internet Watch Foundation, accessed September 2026.
- Child sexual abuse material generated by artificial intelligence: guidance for professionals (England), Internet Watch Foundation and NCA CEOP Education.
- Professionals working with children given vital guidance to tackle threat of AI-generated child sexual abuse material, Internet Watch Foundation, 27 June 2025.
- New guidance for parents and carers as AI-manipulated images of children become a growing concern, National Crime Agency, 3 July 2026.
- Keeping children safe in education 2026, Department for Education, September 2026.
- Sharing nudes and semi-nudes: advice for education settings working with children and young people, UK Council for Internet Safety, updated March 2024.
- Report Remove, Internet Watch Foundation and Childline.
- Take It Down, National Center for Missing & Exploited Children.
Last reviewed . Legal status in the UK and EU was changing as this was written; check commencement and adoption against the primary sources before relying on it.