{"id":4414,"date":"2026-10-28T08:40:45","date_gmt":"2026-10-28T08:40:45","guid":{"rendered":"https:\/\/sawaryn.com\/?p=4414"},"modified":"2026-10-28T09:57:49","modified_gmt":"2026-10-28T09:57:49","slug":"sharenting-deep-nudes-ai-childrens-images-business-risks","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/sharenting-deep-nudes-ai-childrens-images-business-risks\/","title":{"rendered":"Sharenting, Deep Nudes and AI. Why a Child\u2019s Image Online Is a Legal Risk for Your Company, Too."},"content":{"rendered":"<p>Every 108 seconds, the Internet Watch Foundation receives a report concerning child sexual abuse material. AI-generated content is growing at a rate of more than 1000% per year. And your platform, your AI tool, or your influencer campaign may be part of this chain \u2014 even if you are unaware of it.<\/p>\n<p><strong>Sharenting<\/strong> \u2014 the practice of parents posting images of their children on social media \u2014 is no longer merely a private decision. It has become a source of legal, reputational, and operational risk for technology companies, platforms, marketing agencies, and every organization that processes images or works with content creators. The rise of AI-generated CSAM (child sexual abuse material generated by artificial intelligence) and deep nude tools is changing the scale of the threat. And three EU regulations \u2014 the <strong>GDPR<\/strong>, the <strong>AI Act<\/strong>, and the <strong>DSA<\/strong> \u2014 impose obligations on companies that most founders are not even aware of.<\/p>\n<p>In this article, you will find an analysis of the legal risks associated with children\u2019s images online, an overview of current and upcoming regulations, and specific steps your company should take now.<\/p>\n<h2>Key concepts and legal framework<\/h2>\n<p>Before we move on to business risks, let us clarify the terminology and regulations that will appear later in this article.<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Concept<\/th>\n<th style=\"text-align: left;\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\"><strong>Sharenting<\/strong><\/td>\n<td style=\"text-align: left;\">The posting of children\u2019s images by parents or guardians on social media and the internet<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Deep nude<\/strong><\/td>\n<td style=\"text-align: left;\">The use of AI to generate realistic nude or intimate images of a person based on their photograph \u2014 without their consent<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>CSAM<\/strong><\/td>\n<td style=\"text-align: left;\">Child Sexual Abuse Material<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>AI-generated CSAM<\/strong><\/td>\n<td style=\"text-align: left;\">CSAM created or manipulated using artificial intelligence tools<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Biometric data<\/strong><\/td>\n<td style=\"text-align: left;\">Personal data resulting from specific technical processing relating to a person\u2019s physical characteristics and enabling their identification \u2014 e.g. a facial image (Article 4(14) of the GDPR)<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>GPAI<\/strong><\/td>\n<td style=\"text-align: left;\">General-Purpose AI model \u2014 e.g. generative models capable of creating images or text<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Three overlapping regulations:<\/strong><\/p>\n<ol>\n<li><strong>GDPR<\/strong> (applicable since 25 May 2018) \u2014 protects <a href=\"https:\/\/sawaryn.com\/publikacje\/co-to-jest-rodo\/\">personal data<\/a>, including children\u2019s biometric data. Article 8 requires the consent of a parent\/guardian to process the data of a child under the age of 16 in relation to digital services. Article 9 prohibits the processing of biometric data without an explicit legal basis.<\/li>\n<li><strong>AI Act<\/strong> (Regulation 2024\/1689, phased implementation from 2024 to 2027) \u2014 <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/what-is-an-ai-system-under-the-ai-act\/\">regulates artificial intelligence systems<\/a>. The prohibitions under Article 5 (prohibited AI practices) have applied since 2 February 2025. From August 2026, there will be an obligation to label synthetic content (Article 50).<\/li>\n<li><strong>DSA<\/strong> (Digital Services Act) \u2014 imposes content moderation obligations on platforms, including CSAM as the primary category of systemic risk for very large platforms.<\/li>\n<\/ol>\n<p>In addition, there are <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/lex-kamilek-child-protection-rules\/\">Polish laws<\/a>: <strong>Article 202 of the Criminal Code<\/strong> (pornography involving minors \u2014 punishable by 2 to 12 years\u2019 imprisonment), <strong>Article 81 of the Copyright Act<\/strong> (protection of a person\u2019s image), and <strong>Article 98 of the Family and Guardianship Code<\/strong> (representation of a child by their parents).<\/p>\n<h2>The scale of the problem: why a child\u2019s image online is now a threat<\/h2>\n<p>Data from 2024 reveals a scale that demands the attention of every technology company CEO.<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Metric<\/th>\n<th style=\"text-align: left;\">Value<\/th>\n<th style=\"text-align: left;\">Source<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">CSAM reports submitted to the Internet Watch Foundation (2024)<\/td>\n<td style=\"text-align: left;\">More than 400,000<\/td>\n<td style=\"text-align: left;\">IWF<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Year-on-year growth in AI-generated CSAM<\/td>\n<td style=\"text-align: left;\">More than 1000%<\/td>\n<td style=\"text-align: left;\">IWF<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Suspected CSAM records reported to Inhope (2024)<\/td>\n<td style=\"text-align: left;\">Almost 2.5 million (an increase of more than 200% year on year)<\/td>\n<td style=\"text-align: left;\">Inhope<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Increase in CSAM reports to NASK\/Dy\u017curnet (2024)<\/td>\n<td style=\"text-align: left;\">Approx. 400%<\/td>\n<td style=\"text-align: left;\">NASK<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">CSAM files seized by the Polish Police<\/td>\n<td style=\"text-align: left;\">More than 2.5 million<\/td>\n<td style=\"text-align: left;\">Police<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">AI-generated CSAM publicly available online<\/td>\n<td style=\"text-align: left;\">99%<\/td>\n<td style=\"text-align: left;\">IWF<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Parents who have shared at least one \u201cinappropriate&#8221; photo of their child<\/td>\n<td style=\"text-align: left;\">More than 67%<\/td>\n<td style=\"text-align: left;\">Scientific research<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Parents in Poland posting images of their children online<\/td>\n<td style=\"text-align: left;\">40\u201350%<\/td>\n<td style=\"text-align: left;\">NASK<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>These figures translate directly into business risk. Photos of children posted by parents \u2014 often in high resolution \u2014 become source material for AI tools. A child\u2019s face constitutes biometric data within the meaning of Article 9 of the GDPR. High-quality photographs may be used to bypass biometric security measures or train generative models.<\/p>\n<p>The Polish Data Protection Authority actively responds to these threats. In June 2024, the supervisory authority referred to the public prosecutor the case of a teenage deep nude from a school near Warsaw \u2014 students had used an AI tool to generate a nude image of a female classmate. A similar case occurred in Bydgoszcz.<\/p>\n<h2>Legal risks for companies: who is liable and for what<\/h2>\n<p>Sharenting and deep nudes are not just a problem for parents. Below are specific risk scenarios for companies.<\/p>\n<h3>UGC platforms and SaaS solutions with content upload functionality<\/h3>\n<p>If you operate a platform where users can upload photos or generate content, your company may unknowingly be storing AI-generated CSAM. The consequences include:<\/p>\n<ol>\n<li><strong>Criminal liability<\/strong> \u2014 Article 202 \u00a7 4b of the Criminal Code criminalizes the storage of pornographic content depicting a created or manipulated image of a minor participating in a sexual act. Penalty: 2 to 12 years\u2019 imprisonment.<\/li>\n<li><strong>Administrative liability<\/strong> \u2014 infringement of the GDPR involving a child\u2019s biometric data: a fine of up to EUR 20 million or 4% of annual turnover.<\/li>\n<li><strong>Reputational risk<\/strong> \u2014 a single CSAM case on a platform can destroy a brand. The cost is difficult to estimate, but it is many times higher than the cost of prevention.<\/li>\n<\/ol>\n<p>The DSA does not impose a general obligation on platforms to proactively monitor content. The model is reactive \u2014 notice and action. However, <strong>very large platforms<\/strong> (with more than 45 million users in the EU) must conduct an annual systemic risk assessment, including risks associated with CSAM.<\/p>\n<p>For smaller platforms, the lack of a proactive detection obligation does not mean there is no liability. If you receive a report and fail to act promptly, you lose the protection afforded by the \u201csafe harbor&#8221; principle.<\/p>\n<h3>Companies developing generative AI tools<\/h3>\n<p>If you are building an <a href=\"https:\/\/sawaryn.com\/en\/publications\/limiting-the-abuse-of-artificial-intelligence-according-to-assumptions-in-the-us-and-eu-what-do-you-need-to-know-about-it\/\">AI tool for photo editing, content generation<\/a>, or image processing, you must implement safety guardrails that prevent the generation of intimate content using images of real people, with particular attention to minors.<\/p>\n<p><strong>The AI Act and deep nudes \u2014 the legal position:<\/strong><\/p>\n<ol>\n<li>Article 5 of the AI Act (since 2 February 2025) does not explicitly prohibit the provision of generative tools capable of creating deep nudes. Prohibition No. 2 (exploitation of children\u2019s vulnerabilities) may apply if a system is deliberately designed for harmful uses targeting minors \u2014 but it concerns how the tool is used, not merely the provision of a general-purpose tool.<\/li>\n<li>Article 50 of the AI Act (from August 2026) requires synthetic content to be marked in a machine-readable format \u2014 using watermarks, metadata, or cryptographic methods. Failure to implement these mechanisms exposes the provider to penalties.<\/li>\n<li>Penalties for violating the prohibitions under Article 5: up to <strong>EUR 35 million<\/strong> or <strong>7% of global turnover<\/strong> (whichever is higher).<\/li>\n<\/ol>\n<p>Liability for AI depends on the company\u2019s role in the value chain. It is not only the manufacturer of an <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/high-risk-ai-systems-eu-ai-act\/\">AI system<\/a> that is liable \u2014 a company using a generative AI tool is responsible for how it is used, including whether the system generates content that infringes third-party rights.<\/p>\n<h3>Employer branding and corporate events<\/h3>\n<p>A company organizes a family picnic, Children\u2019s Day celebration, or another event attended by employees\u2019 children. Photos are posted on the company\u2019s social media profile. Without the formal, written consent of both parents\/guardians and a GDPR privacy notice, this constitutes an infringement.<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Element<\/th>\n<th style=\"text-align: left;\">Legal requirement<\/th>\n<th style=\"text-align: left;\">Legal basis<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Consent to publish a child\u2019s image<\/td>\n<td style=\"text-align: left;\">Written consent of <strong>both<\/strong> parents\/legal guardians<\/td>\n<td style=\"text-align: left;\">Articles 97\u201398 of the Family and Guardianship Code, Article 81 of the Copyright Act<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">GDPR privacy notice<\/td>\n<td style=\"text-align: left;\">Mandatory \u2014 information on the purpose, scope, and duration of processing<\/td>\n<td style=\"text-align: left;\">Article 13 of the GDPR<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Ability to withdraw consent<\/td>\n<td style=\"text-align: left;\">It must be \u201cas easy to withdraw as to give&#8221;<\/td>\n<td style=\"text-align: left;\">Article 7(3) of the GDPR<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">A child\u2019s face as biometric data<\/td>\n<td style=\"text-align: left;\">Potentially \u2014 where the photograph undergoes specific technical processing that enables identification<\/td>\n<td style=\"text-align: left;\">Article 4(14) and Article 9 of the GDPR<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The judgment of the Warsaw Court of Appeal of 4 July 2018 (V ACa 484\/17) confirms that publishing a child\u2019s image requires the consent of the parents as legal representatives. Verbal consent is insufficient \u2014 in the event of a dispute, the company will be unable to prove that it was obtained.<\/p>\n<h3>Working with influencers<\/h3>\n<p>An influencer working with your e-commerce brand documents her child\u2019s life starting with the ultrasound scan. Your brand becomes indirectly associated with sharenting practices. The reputational risk transfers to the company.<\/p>\n<p>If an influencer features a child\u2019s image in sponsored content and your agreement does not regulate this issue, you have no control over how the minor\u2019s image is used in connection with your brand.<\/p>\n<h2>Article 202 of the Criminal Code and AI-generated deep nudes: what Polish law says<\/h2>\n<p>This issue raises many questions among technology company founders. The answer depends on whether the victim is a minor.<\/p>\n<p><strong>Minors \u2014 generating a deep nude is a criminal offence even without distribution.<\/strong><\/p>\n<p>Article 202 \u00a7 4b of the Criminal Code criminalizes the \u201cproduction&#8221; of pornographic content depicting a created or manipulated image of a minor participating in a sexual act. The term \u201cproduces&#8221; includes creating content using AI algorithms. The provision does not require an intent to distribute \u2014 merely generating and saving the material to a drive satisfies the elements of the offence. The level of realism is irrelevant \u2014 both a crude photomontage and a hyperrealistic deepfake are subject to criminal penalties.<\/p>\n<p><strong>Adults \u2014 generating a deep nude without distributing it is not a criminal offence.<\/strong><\/p>\n<p>Under the current provisions of the Criminal Code, there is no provision criminalizing the mere generation of a deep nude of an adult without distributing it. Article 191a of the Criminal Code requires the victim to have actually been naked \u2014 with a deep nude, the victim was not actually naked. Article 190a \u00a7 2 of the Criminal Code (identity theft) requires \u201cimpersonation&#8221; in dealings with third parties. Article 212 of the Criminal Code (defamation) and Article 216 of the Criminal Code (insult) require dissemination.<\/p>\n<p><strong>Important:<\/strong> EU Directive 2024\/1385 (violence against women) requires Poland to criminalize the creation and sharing of \u201cdeep porn&#8221; involving adults by <strong>June 2027<\/strong>.<\/p>\n<p>Pre-legislative work is underway in Poland \u2014 the Ministry of Justice established a working group (announcement of 10 February 2026, Safer Internet Day), and in March 2026 the Extraordinary Committee on Amendments to Codifications held a meeting. No draft amendment to the Criminal Code has yet been published.<\/p>\n<h2>Platform obligations: requirements under the DSA and Polish law<\/h2>\n<p>Poland\u2019s implementation of the DSA (the amendment to the Act on Providing Services by Electronic Means adopted on 21 November 2025) appointed the President of the Office of Electronic Communications as the Digital Services Coordinator.<\/p>\n<p><strong>Order procedure:<\/strong><\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Element<\/th>\n<th style=\"text-align: left;\">Details<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Scope<\/td>\n<td style=\"text-align: left;\">27 categories of offences, including the dissemination of CSAM<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Who issues the order<\/td>\n<td style=\"text-align: left;\">President of the Office of Electronic Communications or Chairperson of the National Broadcasting Council<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Time limit for implementation (Police\/public prosecutor request)<\/td>\n<td style=\"text-align: left;\">2 days<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Time limit for implementation (user request)<\/td>\n<td style=\"text-align: left;\">7 days<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Complex cases<\/td>\n<td style=\"text-align: left;\">21 days<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Nature<\/td>\n<td style=\"text-align: left;\">Reactive \u2014 initiated upon request<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Note: some AI-generated CSAM \u2014 material containing nude images of children that does not depict sexual acts \u2014 does not satisfy the elements of an offence under Article 202 of the Criminal Code and is not formally considered \u201cillegal content&#8221; within the meaning of the DSA. This is a loophole highlighted by court-appointed experts and the Polish Data Protection Authority. However, manipulating a minor\u2019s image constitutes the processing of personal data and is unlawful under the GDPR \u2014 even if it does not satisfy the elements of a criminal offence.<\/p>\n<p>Temporary EU Regulation 2021\/1232, which allows communications service providers to voluntarily scan content to detect CSAM, has been extended until <strong>April 2026<\/strong>. Poland opposes the mass scanning of private correspondence (end-to-end encryption).<\/p>\n<h2>What your company should do: action checklist<\/h2>\n<p>Below you will find structured recommendations \u2014 from measures you need to implement immediately to those worth planning for the coming months.<\/p>\n<h3>Priority actions (implement now)<\/h3>\n<ol>\n<li><strong>Audit marketing and social media materials<\/strong> \u2014 review all published content for images of children. Remove any content for which you do not have the written, documented consent of both parents\/guardians.<\/li>\n<li><strong>Internal policy on children\u2019s images<\/strong> \u2014 introduce a rule prohibiting the publication of employees\u2019 children in corporate communications or requiring formal consent accompanied by a GDPR privacy notice.<\/li>\n<li><strong>Integration of CSAM detection tools<\/strong> (if you operate a UGC platform or SaaS solution with photo upload functionality) \u2014 consider implementing PhotoDNA (Microsoft, free of charge), CSAI Match (Google), or hash matching. Establish a reporting procedure for NASK\/Dy\u017curnet.<\/li>\n<li><strong>Safety guardrails for AI tools<\/strong> (if you develop generative AI tools) \u2014 implement safeguards that prevent the generation of intimate content using images of real people. Document these as part of your AI Act compliance.<\/li>\n<\/ol>\n<h3>Actions to implement in the coming months<\/h3>\n<ol start=\"5\">\n<li><strong>Update influencer agreements<\/strong> \u2014 add a clause prohibiting the use of children\u2019s images in sponsored content or requiring compliance with child protection guidelines.<\/li>\n<li><strong>Training for marketing, HR, and social media teams<\/strong> \u2014 explain the legal risks associated with children\u2019s images online: corporate sharenting, events, and employer branding.<\/li>\n<li><strong>Review platform\/service terms and conditions<\/strong> \u2014 ask a lawyer to verify them in terms of liability for AI-generated content and the processing of minors\u2019 biometric data.<\/li>\n<\/ol>\n<h3>Regulatory timeline \u2014 key dates to remember<\/h3>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Date<\/th>\n<th style=\"text-align: left;\">Event<\/th>\n<th style=\"text-align: left;\">Impact on the company<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">From 2 February 2025<\/td>\n<td style=\"text-align: left;\">The prohibitions under Article 5 of the AI Act apply<\/td>\n<td style=\"text-align: left;\">Check whether your AI systems fall within the scope of prohibited practices<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">From 2 August 2025<\/td>\n<td style=\"text-align: left;\">Obligations concerning GPAI models<\/td>\n<td style=\"text-align: left;\">If you provide or use GPAI models, implement the required procedures<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">April 2026<\/td>\n<td style=\"text-align: left;\">Expiry of temporary Regulation 2021\/1232 (voluntary CSAM scanning)<\/td>\n<td style=\"text-align: left;\">Monitor whether it is extended or replaced by the final CSAM regulation<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">From August 2026<\/td>\n<td style=\"text-align: left;\">Obligation to label synthetic content (Article 50 of the AI Act)<\/td>\n<td style=\"text-align: left;\">Implement labeling mechanisms (watermarks, metadata) for AI-generated content<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">June 2027<\/td>\n<td style=\"text-align: left;\">Deadline for implementing Directive 2024\/1385 (criminalization of adult deep porn)<\/td>\n<td style=\"text-align: left;\">Prepare for an expansion of criminal liability<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>How we can help<\/h2>\n<p>The risks associated with children\u2019s images, AI-generated content, and new obligations under the AI Act lie at the intersection of IT law, data protection, compliance, and the day-to-day operations of technology companies.<\/p>\n<p>We combine these areas into a single support model \u2014 from audits and documentation to ongoing advice. We help founders and CTOs understand where risks arise within their organizations and implement changes that mitigate them without hindering product development.<\/p>\n<p>Our support includes:<\/p>\n<ol>\n<li><a href=\"https:\/\/sawaryn.com\/publikacje\/audyt-rodo-gdpr-outsourcing-iod\/\"><strong>GDPR audit<\/strong><\/a> \u2014 verification of whether your company correctly processes biometric data and images of minors, including in marketing materials and on your platform.<\/li>\n<li><strong>AI compliance<\/strong> \u2014 assessment of AI tools\u2019 compliance with the prohibitions under Article 5 of the AI Act, preparation for the transparency obligations under Article 50, and documentation of safety guardrails.<\/li>\n<li><strong>Platform policies and terms and conditions<\/strong> \u2014 review and update of terms and conditions regarding liability for UGC, AI-generated content, and the protection of minors.<\/li>\n<li><strong>Agreements with influencers and content creators<\/strong> \u2014 clauses concerning children\u2019s images, compliance rules, and control mechanisms.<\/li>\n<li><strong>Team training<\/strong> \u2014 practical workshops for marketing, HR, product, and management teams.<\/li>\n<\/ol>\n<p>If you would like to check whether your company is prepared for these risks, <a href=\"https:\/\/sawaryn.com\/en\/contact\/\">contact us<\/a>.<\/p>\n<h2>Children\u2019s images online: summary and next steps<\/h2>\n<p>Sharenting and deep nudes are not abstract threats. They pose risks to UGC platforms, AI tools, influencer campaigns, and corporate events. Three EU regulations \u2014 the GDPR, the AI Act, and the DSA \u2014 create a multilayered protection regime that imposes obligations on every company processing minors\u2019 images or data.<\/p>\n<p>Penalties for infringements can reach EUR 35 million (AI Act) or EUR 20 million (GDPR). Article 202 \u00a7 4b of the Criminal Code criminalizes the mere generation of a deep nude of a minor \u2014 with no requirement for it to be distributed.<\/p>\n<p>Start with an audit: review your marketing materials, verify your influencer agreements, and check your platform\u2019s safeguards. The sooner you bring these areas into compliance, the lower your financial, criminal, and reputational risk will be.<\/p>\n<p>If you need legal support regarding the protection of minors\u2019 images, AI Act compliance, or a GDPR audit, <a href=\"https:\/\/sawaryn.com\/en\/contact\/\">contact us<\/a>.<\/p>\n<h2>Frequently asked questions<\/h2>\n<p><strong>Could my company face legal problems if someone uploads an AI-generated deep nude of a child to our platform?<\/strong><\/p>\n<p>Yes. Article 202 \u00a7 4b of the Criminal Code criminalizes the storage of pornographic content depicting a created image of a minor participating in a sexual act. If your platform stores such material and you fail to act after becoming aware of its presence, you expose yourself to criminal and administrative liability (GDPR). Implement detection tools (e.g. PhotoDNA) and a reporting procedure for NASK\/Dy\u017curnet.<\/p>\n<p><strong>Can I safely publish photos of employees\u2019 children from corporate events if their parents have given verbal consent?<\/strong><\/p>\n<p>Verbal consent is insufficient. You need the written consent of both parents\/legal guardians, accompanied by a GDPR privacy notice (Article 13). Consent must be specific, informed, and freely given. You must also provide an easy mechanism for withdrawing it (Article 7(3) of the GDPR). Without this, the company may face allegations of infringing the child\u2019s personal rights and data protection laws.<\/p>\n<p><strong>What obligations does the AI Act impose if I am developing a generative AI tool \u2014 how can I prevent the creation of deep nudes?<\/strong><\/p>\n<p>The prohibitions under Article 5 of the AI Act (including the prohibition on exploiting children\u2019s vulnerabilities) have applied since 2 February 2025. From August 2026, you must implement mechanisms for labeling synthetic content (watermarks, metadata \u2014 Article 50). Implement safety guardrails that prevent the generation of intimate content using images of real people and document them as part of your compliance framework. Penalties for violating the prohibitions can reach EUR 35 million or 7% of global turnover.<\/p>\n<p><strong>Can an influencer I work with expose my brand to risk by engaging in sharenting?<\/strong><\/p>\n<p>Yes. If an influencer features a child\u2019s image in sponsored content and your agreement does not regulate this issue, the reputational risk transfers to your company. Update your agreements to include a clause prohibiting the use of children\u2019s images or requiring compliance with child protection guidelines.<\/p>\n<p><strong>Can the Polish Data Protection Authority fine a company in connection with children\u2019s images?<\/strong><\/p>\n<p>Yes. The Polish Data Protection Authority treats the manipulation of a minor\u2019s image as the processing of personal data, which is unlawful under the GDPR even if it does not satisfy the elements of an offence under Article 202 of the Criminal Code. Administrative fines under the GDPR can reach EUR 20 million or 4% of annual turnover. The Polish Data Protection Authority actively refers deep nude cases involving minors to the public prosecutor \u2014 as in the case of the school near Warsaw in June 2024.<\/p>\n<p><strong>What should I do if I receive a report that CSAM or deep nude content has appeared on my platform?<\/strong><\/p>\n<p>Act immediately. Secure the evidence, block access to the content, report the case to NASK\/Dy\u017curnet.pl and, if a criminal offence is suspected, to the public prosecutor. Poland\u2019s DSA order procedure provides response times ranging from 2 to 21 days, but any delay in acting will deprive you of the protection afforded by the DSA\u2019s \u201csafe harbor&#8221; principle.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn how sharenting and AI-generated deep nudes create risks for companies in Poland, and what to review under the GDPR, AI Act, DSA and Polish law.<\/p>\n","protected":false},"author":13,"featured_media":3680,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"08e0d2ee-dba2-458e-bea8-332a5f661403","sip_pair_state":"verified"},"categories":[1577],"tags":[1545,1552,1446,1531,1546,1534],"specialization":[1211],"practice_area":[],"class_list":["post-4414","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-ai-ip-law","tag-ai-act-en","tag-dsa-en","tag-gdpr","tag-personal-data-protection","tag-risk-assessment","tag-uodo-en","specialization-it-ai-ip-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=4414"}],"version-history":[{"count":3,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4414\/revisions"}],"predecessor-version":[{"id":4449,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4414\/revisions\/4449"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/3680"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=4414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=4414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=4414"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=4414"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=4414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}