#
CAP and ASA guidance on AI-generated advertising and deepfakes (Published 2026-06-11): Self-regulatory guidance from CAP and the ASA saying the CAP and BCAP Codes contain no AI-specific rules but apply media-neutrally: misleading deepfake endorsements, harmful AI-generated images and automated ad campaigns are judged under the existing Codes and the advertiser stays responsible.
5 instruments (5 current) · 6 obligations · 16 claims · 6 milestones
Instruments
- CAP and ASA guidance on AI-generated advertising and deepfakes Published 2026-06-11
Self-regulatory guidance from CAP and the ASA saying the CAP and BCAP Codes contain no AI-specific rules but apply media-neutrally: misleading deepfake endorsements, harmful AI-generated images and automated ad campaigns are judged under the existing Codes and the advertiser stays responsible.
- CMA guidance: Complying with consumer law when using AI agents Published 2026-03-09
CMA guidance of 9 March 2026 telling businesses that they are responsible for what an AI agent does as for an employee, that they should consider labelling AI agents, and that they should train, monitor and quickly refine agents, with a human in the loop. It sits alongside CMA research on agentic AI and consumers.
- CMA publisher conduct requirement on Google general search (generative AI controls) Published 2026-06-03; entry into force not recorded
Conduct requirement imposed by the CMA on Google requiring publisher controls over use of search content in generative AI, clear information, engagement metrics and attribution.
- Data (Use and Access) Act 2025 In force since 2025-08-20
Act amending UK data protection law; for AI governance it creates the s.138 purported-intimate-image offences, the ss.135-137 copyright-and-AI reporting duties, and establishes the Information Commission.
- Online Safety Act 2023 Date not recorded
Act imposing illegal-content risk assessment and safety duties on regulated user-to-user and search services, enforced by Ofcom with penalties of up to the greater of £18 million or 10% of qualifying worldwide revenue. Ofcom has said it applies to generative AI chatbots and platforms.
Obligations
- Sexual Offences Act 2003 s.66E (inserted by DUAA s.138)
It is an offence to intentionally create a purported intimate image of another person without consent and without reasonable belief in consent.
- Online Safety Act 2023 s.9(2)
Providers of regulated user-to-user services must carry out a suitable and sufficient illegal content risk assessment.
- Publisher conduct requirement (final decision and notice)
Google must provide publishers with effective controls over use of their search content in generative AI and related transparency, metrics and attribution measures.
- Guidance section "Tell your customers if you use an AI agent"
Businesses using AI agents with customers should consider labelling them so customers are not misled into thinking a real person provides the service, and should not overstate the role of AI.
- CAP Code (media-neutral application to AI-generated ads); CAP News 11 June 2026
Advertisers using AI to create or distribute ads, including deepfakes and automated ad platforms, must make the ads comply with the CAP Code and remain responsible for AI output used in their ads.
- Automated Vehicles Act 2024 s.79 (Part 4)
It is an offence to make, in the course of business, a communication about a product or service likely to confuse end-users in Great Britain as to whether a vehicle that is not an authorised automated vehicle can travel autonomously, safely and legally; due-diligence defences apply.
Milestones
- Sexual Offences Act 2003 ss.66E-66F (purported intimate image offences) in force Met
- CMA guidance on complying with consumer law when using AI agents published Met
- Section 136 report on copyright works and AI due within nine months of 19 June 2025; report published 18 March 2026 Met
- CAP guidance "AI and Deepfakes: Four Things Advertisers Need to Know" published Met
- Ofcom expectation that platforms have hash-matching for illegal intimate images and deepfakes in place Status not recorded
- Ofcom evidence request on protections for women and girls closes Upcoming
Claims and evidence (16)
Derived: Probable Section 138 of the Data (Use and Access) Act 2025, creating offences of intentionally creating or requesting the creation of a purported intimate image of another person without consent, came into force on 6 February 2026 under SI 2026/31.
Evidence and sources
- Data (Use and Access) Act 2025, section 138 (Creating, or requesting the creation of, purported intimate image of adult)
S. 138 in force at 6.2.2026 by S.I. 2026/31, reg. 2
- The Data (Use and Access) Act 2025 (Commencement No. 5) Regulations 2026 (SI 2026/31)
Section 138 of the Data (Use and Access) Act 2025 (creating, or requesting the creation of, purported intimate image of adult) comes into force on 6th February 2026.
- Data (Use and Access) Act 2025, section 138 (Creating, or requesting the creation of, purported intimate image of adult)
Derived: Probable Section 99 of the Crime and Policing Act 2026 inserts Sexual Offences Act 2003 section 66I, making it an offence to make, adapt, supply or offer to supply a 'nudification' tool for generating purported intimate images; section 99 came into force on 29 June 2026.
Evidence and sources
- Crime and Policing Act 2026, section 99 (purported intimate image generators)
S. 99 in force at 29.6.2026 by S.I. 2026/689, reg. 2(1)(i)
- Crime and Policing Act 2026, section 99 (purported intimate image generators)
A person commits an offence if the person— (a)makes or adapts a thing, or (b)supplies or offers to supply a thing, for use as a generator of purported intimate images.
- Crime and Policing Act 2026, section 99 (purported intimate image generators)
A “generator of purported intimate images” is a thing for creating, or facilitating the creation of, purported intimate images of a person.
- Crime and Policing Act 2026, section 99 (purported intimate image generators)
(b)on conviction on indictment, to imprisonment for a term not exceeding 3 years or a fine (or both).
- Crime and Policing Act 2026, section 99 (purported intimate image generators)
CAP confirmed on 11 June 2026 that the media-neutral CAP Code applies to AI-generated advertising content, including deepfakes, and the ASA has upheld rulings against harmful AI-generated images on that basis.
Evidence and sources
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
AI might change how ads are made, but it doesn't change how they're regulated. The Code is media-neutral, meaning the rules apply regardless of how the content
- AI, advertising, and the policy landscape - CAP proactive monitoring (CAP News)
Recent rulings have demonstrated that harmful, offensive, and socially irresponsible AI-generated images will breach the Code, just as any other type of image would. The ASA also has a Scam Ad Alert System, which it oper
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
Derived: Probable Ofcom published an open letter reminding providers what the Online Safety Act regulates and how it applies to generative AI chatbot tools and platforms.
Evidence and sources
- Open letter to UK online service providers regarding Generative AI and chatbots
published an open letter to online service providers operating in the UK about how the UK's Online Safety Act will apply to Generative AI and chatbots.
- Open letter to UK online service providers regarding Generative AI and chatbots
Section 9 of the Online Safety Act 2023 requires providers of regulated user-to-user services to carry out a suitable and sufficient illegal content risk assessment.
Evidence and sources
- Online Safety Act 2023, section 9 (Illegal content risk assessment duties)
(1)This section sets out the duties about risk assessments which apply in relation to all regulated user-to-user services.
- Online Safety Act 2023, section 9 (Illegal content risk assessment duties)
(2)A duty to carry out a suitable and sufficient illegal content risk assessment at a time set out in, or as provided by, Schedule 3.
- Online Safety Act 2023, section 9 (Illegal content risk assessment duties)
The publisher conduct requirement requires Google to provide publishers with effective controls over the use of their search content in generative AI, among other transparency and attribution obligations.
Evidence and sources
- Google search publisher conduct requirement (CMA)
provide publishers with effective controls over the use of their search content in generative AI
- Google search publisher conduct requirement (CMA)
The ASA/CAP state that the media-neutral CAP Code applies in full to AI-generated advertising, and recent rulings have found harmful AI-generated images in breach of the Code on the same basis as any other image.
Evidence and sources
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
AI might change how ads are made, but it doesn't change how they're regulated. The Code is media-neutral, meaning the rules apply regardless of how the content
- AI, advertising, and the policy landscape - CAP proactive monitoring (CAP News)
Recent rulings have demonstrated that harmful, offensive, and socially irresponsible AI-generated images will breach the Code, just as any other type of image would. The ASA also has a Scam Ad Alert System, which it oper
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
The guidance says businesses should consider labelling AI agents so they do not mislead customers into thinking they deal with a real person, and should keep a human in the loop checking the agent's decisions.
Evidence and sources
- Complying with consumer law when using AI agents (CMA guidance)
If you use an AI agent, consider whether you need to label it so you do not mislead customers into thinking that a service is being provided by a real person – if the fact they are dealing with AI rather than a person might affect people's decisions then you should tell them. Do not overstate the ro
- Complying with consumer law when using AI agents (CMA guidance)
Make sure there is a human in the loop, actively checking that the AI agent is making correct decisions and generating expected results. Regular human oversight is important to catch mistakes and ensure that AI agents are completing tasks in a legally complian
- Complying with consumer law when using AI agents (CMA guidance)
The guidance applies the DMCCA to AI agents running marketing campaigns, processing refunds, answering customer queries and providing comparison services, including accurate pricing, labelled paid endorsements and genuine offers.
Evidence and sources
- Complying with consumer law when using AI agents (CMA guidance)
Think about the requirements of the Digital Markets, Competition and Consumers Act 2024 when you design and train the AI. For example:
- Complying with consumer law when using AI agents (CMA guidance)
It's important to remember that you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf - so make sure you think about compliance with consumer law if you are procu
- Complying with consumer law when using AI agents (CMA guidance)
CAP published "AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit Run" on 11 June 2026, following earlier AI and deepfake guidance of 8 February 2024, 7 February 2025 and 12 June 2025.
Evidence and sources
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit “Run” - CAP News - 11 Jun 2026 - Home - Advice and resources - News
- In at the Deep(fake) End (CAP News)
In at the Deep(fake) End - CAP News - 08 Feb 2024 - Home - Advice and resources
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
CAP said on 12 June 2025 that the CAP and BCAP Codes do not contain specific rules relating to AI and that marketers must ensure AI use does not breach the existing rules; there is no separate Code section for AI-generated or deepfake ads.
Evidence and sources
- "Write a useful article helping marketers with tips for using AI" (CAP News)
Whilst the CAP and BCAP Codes do not contain specific rules relating to AI at this time, marketers should ensure that their use of AI doesn’t generate an issue with the existing rules. Download the latest advice for marketers on using AI in ads.
- In at the Deep(fake) End (CAP News)
There isn’t a separate section of the CAP Code that deals with AI-generated ads. This means any ads the ASA might assess that use deepfake t
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
AI might change how ads are made, but it doesn't change how they're regulated. The Code is media-neutral, meaning the rules apply regardless of how the content
- "Write a useful article helping marketers with tips for using AI" (CAP News)
CAP says an AI-generated celebrity endorsement that looks real enough to mislead consumers is likely to breach the Code, and that marketers must ensure deepfake content complies with the rules on misleadingness, testimonials and endorsements; personality and intellectual property rights are not ASA matters.
Evidence and sources
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
If an AI‑generated celebrity “endorsement” looks real enough to mislead consumers, it’s likely breaching the Code.
- "Write a useful article helping marketers with tips for using AI" (CAP News)
Marketers should ensure that content created in this way complies with the rules, especially on misleadingness, testimonials and endorsements. Implying an endorsement that simply doesn’t exist will be
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
Derived: Probable CAP says the advertiser remains responsible for any AI output used in its ads, and the ASA found that an advertiser was still primarily responsible for CAP Code compliance although the ad was produced with Google's automated tools.
Evidence and sources
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
If an AI tool produces something problematic, the advertiser remains responsible for any output used in their ads. They should therefore sense‑check AI outputs
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
Crucially, the ASA stated that even though the ad was produced using Google’s automated tools, the advertiser was still primarily responsible for ensuring compliance with the CAP Code.
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
The ASA applies the CAP Code to ads within its remit, so AI-generated ads must comply with it; the guidance itself adds no new rule.
Evidence and sources
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
If an ad falls within the ASA’s remit, it must comply with all relevant rules.
- "Write a useful article helping marketers with tips for using AI" (CAP News)
Whilst the CAP and BCAP Codes do not contain specific rules relating to AI at this time, marketers should ensure that their use of AI doesn’t generate an issue with the existing rules. Download the latest advice for marketers on using AI in ads.
- AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News)
Derived: Probable CAP said on 7 February 2025 that it is closely monitoring AI policy developments and that the rules in Section 6 of the CAP and BCAP Codes on depicting or referring to living persons would likely apply to generative AI replicas.
Evidence and sources
- AI, advertising, and the policy landscape - CAP proactive monitoring (CAP News)
Recent rulings have demonstrated that harmful, offensive, and socially irresponsible AI-generated images will breach the Code, just as any other type of image would. The ASA also has a Scam Ad Alert System, which it oper
- AI, advertising, and the policy landscape - CAP proactive monitoring (CAP News)
it is likely that the rules in Section 6 of the CAP and BCAP Codes (which include rules about permissions for depicting or referring to living persons in ads) would apply, and it important that CAP tracks relevant developments.
- AI, advertising, and the policy landscape - CAP proactive monitoring (CAP News)
Derived: Probable Part 4 of the Act (marketing restrictions), so far as not already in force, comes into force on 7 January 2027 under SI 2026/731 made 1 July 2026.
Evidence and sources
- The Automated Vehicles Act 2024 (Commencement No. 3) Regulations 2026 (SI 2026/731)
Part 4 of the Automated Vehicles Act 2024 (marketing restrictions), so far as not already in force, comes into force on 7th January 2027.
- The Automated Vehicles Act 2024 (Commencement No. 3) Regulations 2026 (SI 2026/731)
They bring into force Part 4 of the Act, so far as not already in force, on 7th January 2027. Part 4 of the Act makes provision for marketing restrictions in relation to automated vehicles. Section 78 of the Act came int
- The Automated Vehicles Act 2024 (Commencement No. 3) Regulations 2026 (SI 2026/731)