Ireland to fast-track criminal laws on AI misuse of images and voices
Ireland is moving to criminalise the unauthorised use of people's images and voices in AI, fast-tracking legislation after X's Grok bot was found generating sexualised images of women and minors. Government lawyers are reviewing existing statutes and options to act against the platform. X acknowledged "isolated cases where users prompted for and received AI images depicting minors in minimal clothing," adding that "XAI has safeguards, but improvements are ongoing to block such requests entirely."
The European Commission has so far asked the company to preserve its AI files for a year, drawing criticism that the response is too soft. Meanwhile, Irish politicians want stronger local powers to intervene when platforms fail to prevent clear illegality.
What the Bill would do
The proposed law would criminalise the use of private citizens' images and voices in AI without consent, aiming to prevent the "weaponisation" of these tools. It was introduced last year by Fianna Fáil TD Malcolm Byrne and is now set to be accelerated. Expect explicit offences tied to synthetic sexual imagery and deceptive impersonation, with penalties designed to deter both creators and distributors.
Who bears liability: users, platforms, or both?
Minister for Communications Patrick O'Donovan argues the people making the requests should be held responsible. Fianna Fáil's AI spokesman Naoise Ó Cearúil agrees but insists platforms hosting and amplifying the content must share accountability. The political focus is shifting from voluntary safeguards to enforceable duties.
Regulatory posture and limits
Coimisiún na Meán has opened interim investigations but is constrained without broader EU action, given that platforms with over 45 million users fall squarely within the EU's regime. Minister for AI Niamh Smyth will question the regulator next week on enforcement steps against X. Fine Gael MEP Regina Doherty called the EU response "weak," suggesting geopolitical caution is slowing action.
For context on EU platform obligations, see the Digital Services Act overview from the European Commission: Digital Services Act. Ireland's regulator information is here: Coimisiún na Meán.
Implications for legal teams
- Criminal exposure: Individuals who generate, request, or share synthetic sexual images-especially involving minors-face direct liability. Corporate exposure arises where teams build or deploy tools that enable such outputs without effective controls.
- Platform duties: Under the DSA, very large platforms must maintain risk assessments, mitigation measures, and transparency. Expect Irish law to add offences and duties tied to likeness misuse and synthetic CSAM prevention.
- Evidence and preservation: Anticipate retention orders for prompts, outputs, model safety logs, and takedown actions. Preserve chain of custody for rapid regulator engagement.
- Data, consent, and provenance: Map datasets and fine-tunes; document consent and licensing for any training material that includes identifiable people.
- Guardrails: Enforce prompt blocking for any sexual content involving minors or non-consensual depictions of adults. Maintain human escalation for edge cases.
- Cross-border reach: Plan for jurisdictional overlap-Irish criminal law, EU DSA duties, GDPR, and existing child-protection statutes will interact.
What counsel should do now
- Audit generative features and third-party integrations for abuse risk; disable or geofence features you cannot secure.
- Implement layered safety: prompt classifiers, output filters, blocklists, image/video hashing, and rapid kill-switches for flawed features.
- Update terms and acceptable use to ban deepfake sexual content, non-consensual impersonation, and child-related prompts. Pair with graded sanctions and repeat-offender rules.
- Run DPIAs and safety assessments; document mitigations and testing. Log safety overrides and engineer access to model controls.
- Strengthen incident response: 24/7 intake, regulator notification playbooks, and victim support workflows. Pre-negotiate contacts with Coimisiún na Meán and EU counterparts.
- Vendor governance: Flow down safety and logging obligations to model/API providers; require timely patching and transparency on failures.
- Retention: Prepare to preserve AI files, prompts, and model logs for at least a year where required.
Key open questions to track
- Definition of "private citizen" and scope of consent: How will exceptions apply for public figures, satire, or public-interest reporting?
- Mens rea and strictness: Will offences require intent, recklessness, or be strict in certain contexts (e.g., minors)?
- Platform accountability: What triggers liability-actual knowledge, constructive knowledge, or failure of due diligence under codified safety standards?
- Interplay with existing law: Fit with CSAM offences, harassment, defamation, image-based abuse, GDPR, and ePrivacy rules.
- Extraterritoriality: How will Ireland assert jurisdiction over non-EU actors serving Irish users?
Bottom line
The legislative direction is clear: consent-less AI replicas of people's voices and images-especially sexualised depictions and anything involving minors-will attract criminal sanctions. Platforms and developers will need demonstrable controls, logs, and fast takedowns. Legal teams should lock in safety by design now rather than wait for the final text.
If your team needs structured training on AI governance and compliance, see: AI courses by job.
Your membership also unlocks:
