EU law might actually force Musk to take responsibility for Grok generating nude images

Elon Musk has a well-established habit of blaming users when his platforms generate toxic content. But that tactic is about to hit a brick wall in Europe.

The European Parliament’s Internal Market and Civil Liberties committees just voted 101–9 (with 8 abstentions) to simplify the AI Act and explicitly ban “AI ‘nudifier’ systems.” The target is obvious: apps that strip clothing from photos, a category where Musk’s Grok chatbot has become the most prominent example of what happens when an AI platform doesn’t bother to block sexualized outputs of real people, including children.

The vote came after the European Commission admitted earlier this year that the current AI Act doesn’t actually prohibit “AI systems that generate child sexual abuse material (CSAM) or sexually explicit deepfake nudes.” That’s a pretty glaring loophole, and Parliament members had already started drafting amendments before this vote.

What’s interesting here is how this flips the script on Musk’s usual defense. When Grok was caught generating nude images of public figures, the response from X’s camp was predictable: users were misusing the system, it was a fringe case, the technology is neutral. But the EU is now saying, effectively, if your platform can do this at scale, you built it wrong. That’s a fundamentally different approach from the American model of platform liability, where Section 230 gives companies cover for what users do with their tools.

I’ve been watching this space for years, and the irony is thick. Musk positioned himself as a free speech absolutist, but Grok’s nudify capability isn’t about speech—it’s about generating non-consensual intimate images. That’s not protected expression anywhere in the civilized world. The EU’s move here is actually overdue. The AI Act was passed with a lot of fanfare, but it was always going to need rapid amendments as real-world harms emerged. Grok just accelerated that timeline.

The 101–9 vote margin tells you this isn’t controversial among lawmakers. Even the abstentions suggest hesitation about the wording, not the principle. The question now is enforcement. If the ban passes the full Parliament, which looks likely, companies like X will have to either implement robust content filters or face fines that make GDPR penalties look like parking tickets.

Musk can spin this however he wants, but the EU doesn’t buy the “users are responsible” narrative when the platform actively enables the harm. And honestly, neither should anyone else. If your AI can generate CSAM with minimal prompting, you don’t have a user problem. You have a design problem.