Holyrood’s Criminal Justice Committee has opened a short inquiry into AI-generated intimate-image abuse and deepfake pornography. This is the point at which the law has entered the room carrying a careful folder, while the machine in the corner has already produced several thousand convincing lies and asked whether anyone would like them in high definition.
The inquiry is deliberately narrow. MSPs are not attempting to solve artificial intelligence, social media or the internet before lunch. They will examine the impact on victims, whether existing laws and powers are adequate, and how effectively these offences can be reported, investigated and prosecuted in practice.
Scotland’s current law is more useful than the phrase “nothing can be done” suggests. The Abusive Behaviour and Sexual Harm (Scotland) Act 2016 makes it an offence, in specified circumstances, to disclose or threaten to disclose an intimate image. The Scottish Government says that includes manipulated images which only appear to show a person in an intimate situation.
But sharing is not the whole story. A Scottish Government consultation earlier this year said that the newer offences covering the creation, or requested creation, of purported intimate images in England and Wales do not extend to Scotland. Ministers proposed separate Scottish offences for making the images, asking someone else to make them and supplying tools designed principally to generate them. Those were proposals in a consultation, not laws already passed. The Professor has placed a ruler under that distinction.
The scale of the wider problem is not theoretical. Scotland recorded 770 intimate-image offences in 2024-25, although that broad figure does not tell us how many involved AI-generated material. The technology may be new, but the harm is drearily traditional: humiliation, control, fear and the removal of someone’s ability to participate in ordinary life without a counterfeit version of them being manufactured for an audience.
The committee is asking organisations, academics and practitioners to respond by 16 November. Its separate call for people with direct experience remains open until 11 January 2027, with an initial evidence session expected in December. The separation matters because lived experience should not be squeezed into the same questionnaire as a policy institute’s footnotes.
Police Scotland says people in Scotland can report intimate-image abuse and deepfakes online, by phone or in person. Its advice includes saving screenshots and messages, recording where and when material appeared, reporting it to the platform and using services such as StopNCII. Those are useful routes, though a justice system should be wary of turning every victim into their own digital archivist, evidence technician and unpaid complaints department.
The committee’s job is therefore more exacting than declaring deepfakes bad, a conclusion the machine is unlikely to contest. It must work out whether Scottish law reaches the act of creation, whether police and prosecutors can apply it at machine speed, and whether victims can get practical support before an inquiry has finished choosing its stationery. Very few technology stories begin where people think they do. This one begins with consent, and the software does not get to redefine it.
