Writing
“All reasonable steps” is a record, not a score.
The UK offence that came into force in June has a defence attached to it. The defence has a property most people skim past: the defendant has to prove it. That single word changes what you need to have.
The sentence
Section 99 of the Crime and Policing Act 2026 (c. 20) inserted sections 66I to 66L into the Sexual Offences Act 2003, in force 29 June 2026 by S.I. 2026/689 (alongside sections 66E to 66H, inserted by section 138 of the Data (Use and Access) Act 2025 (c. 18), in force 6 February 2026 by S.I. 2026/31, and listed as priority offences under Online Safety Act 2023 Schedule 7 paragraph 28A). Section 66I(4) reads:
“It is a defence for a person charged with an offence under this section to prove that they took all reasonable steps to prevent the thing being used for creating, or facilitating the creation of, purported intimate images of a person without the person's consent.”
Two phrases carry the weight. To prove puts the burden on the defendant rather than the prosecution. All reasonable steps — not some, not a representative sample — sets the standard the defendant has to reach.
Read alongside 66I(3), which makes the test for committing the offence objective — whether a reasonable person, having regard to all the circumstances, would consider that you supplied a thing for that use — the structure is unusually demanding. Intent does not get you out of the offence, and the way out is a defence you must evidence.
Why the industry's standard answer does not work
Ask a generative AI provider what they do about this and you will typically get three things: a refusal rate, a policy page, and a model card. None of them is capable of discharging a burden of proof, for reasons that are about the shape of the evidence rather than the sincerity of the provider.
A refusal rate is a statistic about a model, not a record of an action. “We refuse 99.4% of such prompts” describes a measured behaviour under a chosen evaluation. It does not establish what control was in place on the date in question, who decided it, or whether it was in place at all when the thing you are being asked about happened. It is also unverifiable by anyone who was not there — a court, a regulator or a counterparty cannot reproduce it, and has only your word for the denominator.
There is a research argument pointing the same way. A paper published on 1 September 2026 (arXiv:2609.00519) argues that refusal-rate metrics cannot evidence deployment safety. The statutory problem is a sharper version of the same point: a defence you must prove needs evidence, and an unauditable percentage is not evidence.
A policy page describes an intention. The objective test in 66I(3) is specifically indifferent to what you meant. A document saying what the product is for is relevant — but as one dated artefact among others, not as an answer.
What the defence actually requires you to hold
Working backwards from the statutory language, the defence needs a record with four properties. None is exotic. All four are difficult to produce retrospectively, which is the point.
| Property | Why the statute needs it |
|---|---|
| Dated | The question is what was in place at a moment in the past, not what is in place now. |
| Attributed | “Steps taken” implies someone took them. A control with no decision-maker attached is an assertion. |
| Complete | All reasonable steps. A record you can silently remove an entry from cannot demonstrate completeness, because nothing distinguishes “we did everything” from “we deleted the part that looked bad”. |
| Externally checkable | You are proving it to someone with no reason to trust you and no access to your systems. |
The third property is where most internal logging fails. An audit log demonstrates internal consistency to a party who already trusts the system holding it. If entries can be removed without trace, the log establishes what you chose to keep. A hash-linked chain changes that: a removed link breaks the chain, so a gap is visible rather than silent. That does not make the record true — it makes incompleteness detectable, which is what “all” requires.
The fourth is where nearly everything fails. A record that can only be inspected by logging into your platform, under your access control, is a record whose weight depends on the reader trusting your platform. The useful form is one that can be handed over and checked independently, with no pre-agreed intermediary and no live connection to you.
The honest boundaries
- A record is not a control. This does not stop a model generating anything. It evidences what you did. A provider with no controls has nothing to record and should build controls first.
- Provable is not the same as compliant. We can make what you did provable. Whether what you did was enough is a different question with a different answer.
- Nobody knows what a court will accept. There is no case law on s.66I. It is eleven weeks old. Anyone claiming to know where the bar sits is guessing, including us — and the first prosecution will reshape all of this.
- Timing is the open problem. A chain proves internal order. Proving that a record existed at a particular time, to someone who does not trust you, needs an anchor somewhere neither party controls. We have not published one, so we are not claiming it.
The commercial insight, in one line: a statutory defence the defendant must prove is a standing demand for records they can show to someone who does not trust them. That is a different product from a dashboard, and it is why a percentage will not do.
This describes law. It is not legal advice, and we are not your lawyers.