AVZ Law Office | Private Client Lawyers in Cyprus
AI Nude Deepfakes in Cyprus: When Does Criminal Liability Begin?
Cyprus has enacted serious criminal protections against the non-consensual sharing of intimate and manipulated sexual material. The difficult legal question is whether creating an adult AI-generated nude image in private, before anyone else sees it, is already an offence.
Grigoris Aivazidis · Lawyer, AVZ Law Office · Legal Briefing · 1 October 2026
AI nude deepfakes in Cyprus raise a question that is both technically new and legally precise. The fact that an image is fabricated does not make the harm imaginary. A realistic false nude can be used to humiliate, blackmail, isolate or damage the reputation of a real person just as decisively as a genuine intimate photograph.
Cyprus has a focused statute for this conduct: the Non-Consensual Use of Personal Sexual Material Law of 2024, Law 148(I)/2024. Its wording is strong, and it expressly reaches manipulated sexual material. Yet it is directed at particular acts of dissemination, threat and attempt. That distinction matters.
The question is not whether a fabricated nude can cause real harm. It plainly can. The question is when the present wording of the criminal law turns that harm into a completed offence.
What AI Nude Deepfakes in Cyprus Actually Are
An AI-generated nude deepfake is not necessarily an altered intimate photograph. The starting point can be an ordinary image taken from Instagram, Facebook, LinkedIn or another public profile. The image is uploaded to software designed to remove clothing or generate a sexually explicit version of the person depicted.
The output may retain a face, hair, skin tone, posture and other recognisable features, while generating a nude body that appears visually coherent with the source image. No genuine intimate image need have existed. What matters legally is not whether the generated body is anatomically accurate. The image may be entirely fabricated below the face, but if it is designed to make an identifiable person appear naked or sexually exposed, a colleague, partner, employer or family member may reasonably believe it is real. The harm comes from using a real person’s identity to place that person into sexual content without consent.
This is why it is too narrow to speak only of a “deepfake”. The Cyprus legislation uses broader concepts, including realistic sexual images and material processed so that it refers to a particular person.
What Law 148(I)/2024 Covers
Law 148(I)/2024 defines “sexual material” widely. It includes material depicting a person in a real or simulated sexual act, sexual depictions of breasts, genitals or buttocks, realistic sexual images, and material that has been processed so as to refer to a particular person. The Act defines a “person” for its purposes as a natural person over 18, which is why the adult analysis in this article must be kept separate from material involving children.
Section 3(1) makes it a felony to send, distribute, circulate, publish, disseminate, reproduce, transmit, display or otherwise make sexual material available to a third person or public view, by any electronic, digital, printed or other means, where the relevant consent is absent. It covers material obtained in circumstances giving rise to a reasonable expectation of privacy and material created through processing in relation to another person without consent.
The Greek statutory words, “σε τρίτο πρόσωπο ή σε δημόσια θέαση”, are central. The law does not require a social-media post, a website or a large audience. A deliberate showing to one other person, or a private message to one recipient, can be legally significant because the material may have been displayed or made available to a third person.
The Present Legal Line: Private Creation and Possession
For an adult depicted person, section 3 does not expressly list mere private creation or possession as a free-standing offence. Its operative verbs are directed to sending, distributing, publishing, displaying, making available, threatening to do so, or attempting those acts.
Accordingly, where a person creates an AI-generated nude of an identifiable adult and keeps it privately, with no display, transmission, threat, attempted dissemination or access by anyone else, the conduct does not on its face fall within the completed dissemination offence in section 3(1). The mere fact that another person has heard of the image, without seeing it or receiving access to it, does not itself establish a third-person disclosure.
This is not an endorsement of the conduct, nor a conclusion that no other criminal or civil issue can arise on different facts. It is a careful reading of this particular statute. Evidence showing an intention to send or publish may alter the analysis, and a case must always be assessed as a whole. But criminal legislation must be applied according to what it actually criminalises.
A, B and C: Five Practical Scenarios
Assume that A uses an AI platform to create a realistic nude image of B, an identifiable adult woman, without B’s knowledge or consent. The outcome changes materially as A’s conduct moves from private creation to access by another person.
Scenario 1: A keeps the image alone
A generates the image and retains it only on his own phone. C has heard that A possesses it, but C has never seen it and A has not sent, displayed or otherwise made it available to anyone. On those facts alone, section 3 does not expressly criminalise the creation or private possession of the adult image. That is the possible legislative gap discussed below.
Scenario 2: A shows the image to C
A opens the phone and deliberately shows the image to C. This materially changes the position. The material may have been “displayed” or made available to a third person. A public upload is not required for section 3(1) to be engaged.
Scenario 3: A sends it privately to C
A transmits the image to C through WhatsApp, Telegram, email or another messaging application. This is the clearest example of sending or transmitting material to a third person. Private messaging does not remove the conduct from the statute.
Scenario 4: A uploads it online
A uploads the image to a website, social-media account, Telegram group or other online service. This may involve publication, dissemination or making the material available to public view or third persons. The likely practical damage is wider, but the basic offence does not depend on proving a large audience.
Scenario 5: A threatens B
A tells B that he has created the image and threatens to distribute it unless B complies with a demand. Section 3(2) separately addresses coercion and threats to send, distribute, publish, display or make the material available. The threat can therefore be an offence even if A never ultimately publishes the image.
Threats, Attempts and Penalties
The completed dissemination offence under section 3(1), and the coercion or threat offence under section 3(2), are felonies punishable by imprisonment of up to 14 years. The statutory maximum reflects the seriousness with which Cyprus treats non-consensual sexual material.
Section 3(3) separately criminalises an attempt to commit either offence, with imprisonment of up to 5 years. Attempt is not a substitute label for every troubling preparatory act. It requires conduct that, on the evidence and the applicable criminal-law principles, amounts to an attempt to commit the offence. It should not be assumed merely because an image exists on a phone.
The Act also makes clear that the depicted person’s agreement to the creation of the material or to another person obtaining it is not a defence or mitigating factor for a later non-consensual dissemination. Consent to create is not blanket consent to share.
Aggravating Factors and Court Powers
For offences under section 3, the court must treat specified circumstances as aggravating. They include conduct by a present or former partner, family member or person abusing a position of trust or influence, repeated offending, vulnerable victims, material reaching a child, serious harm, humiliating comments, identifying personal information and a purpose of intimidation, humiliation, harassment, emotional distress, damage or unlawful financial gain.
Most relevantly for AI imagery, the fact that the sexual material was created without the consent of the person depicted is itself an aggravating circumstance. It is important not to overstate that provision. It affects sentencing for an offence under section 3. It does not create a separate, completed offence of private generation by itself.
Where prohibited material has been disseminated online, the Act gives the court power to order removal or non-access to websites and to block access for internet users in Cyprus. Providers within Cyprus, and digital-service providers or platforms based in Cyprus, have specific duties after notice from the Police or another relevant service. The statutory time limit is immediate action and no later than one hour. For platforms outside Cyprus, the Police may request deletion. The Act also extends jurisdiction where an offence is committed through an electronic system accessible from Cyprus, even if the system itself is outside Cyprus.
Material Involving Children Is Different
This article concerns identifiable adults. Law 148(I)/2024 defines “person” for its purposes as an adult. Any material involving a child requires a separate and far stricter analysis under the Protection of Children from Sexual Abuse, Sexual Exploitation and Child Sexual Abuse Material Law.
That law contains stand-alone offences for possessing, knowingly accessing, distributing, making available and producing material within its statutory definition, with penalties that may reach 10, 15 or 20 years and, in specified cases involving a child under 13, life imprisonment. No adult deepfake analysis should be carried across to a child case. The facts, the definition of the material and the applicable offences require immediate specialist assessment.
A Possible Legislative Gap
The legislative choice currently visible in Law 148(I)/2024 is to criminalise non-consensual dissemination, threatened dissemination and attempts. It does not expressly criminalise the private creation or possession of an adult synthetic nude simply because it was generated without consent.
There is room for a serious policy debate about whether that line remains sufficient. A person who deliberately creates a highly realistic sexual image of an identifiable adult without consent has already interfered with that person’s sexual dignity and identity, even before a recipient is chosen. The harm may intensify once the image is shared, but its creation is not morally or socially neutral.
Whether the creation of such material should become a separate offence is a question for the legislature. It requires careful drafting so that a criminal prohibition is clear, proportionate and directed at the fabrication of sexual material concerning an identifiable real person. It should not be answered by stretching an existing offence beyond its words.
Commentary by Grigoris Aivazidis
Cyprus law already gives victims meaningful protection once material is shown, sent, disseminated, threatened or attempted to be disseminated. That should be stated clearly. It also provides targeted removal and blocking tools where prohibited material has entered the online environment.
My view is that the law should not focus exclusively on the individual who ultimately sends or posts the image. There is a material difference between a general-purpose generative AI system capable of legitimate uses and a service deliberately designed, marketed or operated to generate non-consensual nude or sexually explicit images of identifiable real people.
“The law should not wait until a fabricated nude has travelled across the internet before it treats the conduct with the seriousness it deserves. Where a business is deliberately built to let users create sexual images of identifiable people without consent, and its operators earn from that activity, the law should be capable of reaching not only the person pressing ‘generate’ but those who knowingly operate and profit from the system.”
That is not a claim that every developer, host, payment provider or investor is already criminally liable under Law 148(I)/2024. The current Act does not create a general offence for operating an AI model, providing infrastructure or receiving revenue from a service. Criminal responsibility remains dependent on the existing statutory language and the specific facts.
But the legislature should consider a focused offence for operators, financiers and commercial beneficiaries who knowingly run or profit from platforms whose principal purpose is the creation of non-consensual sexual deepfakes of identifiable people. Such services should not be treated as technically untouchable simply because they operate online or beyond Cyprus. Subscription payments, card processors, cryptocurrency payment routes, advertising revenue, corporate structures, domain records and hosting arrangements can all provide legitimate investigative routes.
Subject to proper judicial safeguards, the law should permit authorities to trace the commercial operators behind these services, disrupt payment channels, obtain blocking or removal orders and pursue those who knowingly operate or financially benefit from a business model built around non-consensual sexual fabrication. That would be a development of the law. It should not be confused with what Law 148(I)/2024 already criminalises today.
Private advice
AVZ Law Office advises individuals, families and businesses on criminal-law exposure, digital harm, reputation protection and urgent legal responses. For confidential advice on a specific situation, submit a private enquiry.
This briefing is general information, not legal advice. The application of criminal law depends on the precise material, the identity and age of the person depicted, consent, communications, access, intention and all surrounding facts.