AI-generated content: unlawful speech, harassment and liability
A text, an image or a message generated automatically can defame, insult, harass, steal an identity or mislead through a doctored image or recording. The rules and the liabilities differ according to the role of the organisation — publisher of its own output, hosting provider for third-party content, or platform. Moderation must be designed before publication, not improvised after a report.
Law verified as at 16 August 2026. This page is not individualised legal advice.
AI does not make the liability attached to publication disappear. Content generated or relayed online may fall under the French Press Act of 29 July 1881 (loi du 29 juillet 1881 sur la liberté de la presse), under the French law on communication to the public online, under harassment, under the offence of doctoring a person’s image or words, or under the obligations of the DSA. The classification depends on the content, on how it is distributed, on the editorial role and on knowledge of the unlawfulness. Source: French Press Act of 29 July 1881 ↗(opens in a new tab).
Quotable legal markers
What you need to be able to cite
Defamation or insult online
The 1881 Act can apply to content published online; its classifications and its time limits are specific to it.
Editorial author and publisher: Blue Lemon Agent, a brand of LINDBERGH FORMATION. Method: texts and decisions verified on EUR-Lex, Légifrance, the CNIL, the courts and the competent authorities. Legal review: Mohamadou Hamady DIA, juriste, on 18/08/2026. Updated on 10/09/2026.
the offence of defamation: the allegation or imputation of a specific fact that harms the honour or the reputation of a person;
the offence of insult: an outrageous expression, a term of contempt or an invective which contains the imputation of no fact.
The penalties are set out in articles 32 and 33 of the 1881 Act ↗(opens in a new tab), with aggravated forms according to the person targeted or the motive. Choosing the right classification is essential. French press-law proceedings are subject to strict formal requirements. As a rule, criminal and civil actions are time-barred after three full months from the date of the offence or the latest investigative or prosecutorial act; before proceedings are brought, only a formal request for investigation interrupts the limitation period (Article 65 of the French Law of 29 July 1881 ↗(opens in a new tab)).
A publishing agent must therefore prevent:
the invention of a dishonouring fact presented as certain;
imputations naming a person without a source or a check;
the repetition of a contentious remark in a summary;
the automatic amplification of a rumour;
the “more hard-hitting” rewriting of an accusation.
Who answers for the content?
A site that publishes its own content is a publisher. Every service of communication to the public by electronic means must have a publication director (directeur de la publication) under article 93-2 of the 1982 Act ↗(opens in a new tab). Article 93-3 sets up a cascading liability for certain press offences committed online, with a particular regime for contributions posted by internet users.
A service that stores content provided by users may fall within the French hosting-provider regime and within the DSA. It is not subject to a general monitoring obligation, but it must have the required mechanisms in place, handle notices and act according to its role. As soon as the operator selects, orders or itself generates the content, it must not automatically present itself as a passive hosting provider.
Harassment and the digital “mob”
The offence created by article 222-33-2-2 of the French Criminal Code (code pénal) ↗(opens in a new tab) covers repeated speech or conduct whose purpose or effect is a deterioration of living conditions resulting in an impairment of physical or mental health. The provision also covers conduct inflicted on one and the same victim:
by several people acting in concert or at the instigation of one of them, even where no single one of them acted repeatedly;
one after another by several people who know that their acts amount to a repetition.
An agent must not make it possible to orchestrate message campaigns targeting a person, to generate variants designed to get around a block, or to send coordinated follow-ups from several accounts.
Paris Court of Appeal, 31 January 2023 — the case known as Mila.Official press release. ↗(opens in a new tab) The official press release reports convictions for aggravated harassment and, for one of the defendants, a death threat. Limit: a press release does not have the precision of a full judgment and must not be used to generalise beyond the facts that were tried.
Doctored content, identity theft and deepfakes
Among other things, article 226-8 of the French Criminal Code ↗(opens in a new tab) punishes the publication, without consent, of a doctored item made using the words or the image of a person, where it is not obvious that the item has been doctored or where this is not expressly stated. Since 2024, the provision has included aggravated forms for certain publications using an online service and for sexual content.
In addition, Article 50, paragraph 4, of the AI Act ↗(opens in a new tab) requires deployers to disclose that an image or an audio or video content constituting a deep fake has been generated or manipulated by an AI, with adjustments for works that are manifestly artistic, creative, satirical or fictional. That disclosure does not make lawful an infringement of a person’s image, dignity, reputation or private life.
The DSA: obligations according to role
The DSA applies to intermediary services offered in the Union. The relevant obligations, which vary by category, include:
a point of contact and intelligible terms and conditions;
a notice-and-action mechanism for hosting;
a statement of reasons for moderation decisions;
an internal complaint-handling mechanism for platforms;
advertising transparency and the prohibition of certain deceptive designs;
for very large platforms, the assessment and mitigation of systemic risks, audits and data access.
The DSA does not turn every site fitted with a chatbot into an online platform. What must be classified is the intermediary service actually provided.
Commission proceedings and decisions
On 18 December 2023 the Commission opened formal proceedings against X. On 5 December 2025 it adopted the first non-compliance decision under the DSA and imposed a fine of 120 millioneuros for transparency failings: deceptive design of the blue checkmark, the advertising repository and researcher access to data. On 16 July 2026 it accepted an action plan on part of those obligations, subject to monitoring and audit.
In January 2026 the Commission also opened a specific investigation into the Grok features integrated into X, in particular the risks linked to manipulated sexual images. Scope: opening an investigation is not a finding of infringement; only the December 2025 decision may be presented as such.
The Cour de cassation, France’s supreme court, held the publication director liable, under the regime of the 1982 Act, after a defamatory message had been reported and had not been removed promptly. Outsourcing moderation did not erase his role. Limit: liability depends on the status of the service and on the precise statutory mechanism.
Cour de cassation, Criminal Division, 11 June 2024, n° 23-86.920
The Court restates that the limitation period under the 1881 Act runs from the first publication; a change in the name of the site’s owner does not, on its own, amount to a new publication. Lesson: publication dates, versions and acts of republication must be retained.
Integration checklist
To check before putting the agent into service
Publication director and legal notices identified.
Pre-publication filter on accusations, insults, threats and private data.
Human escalation for any sensitive content naming an individual.
Accessible notice mechanism and traceable handling.
Prevention of coordinated campaigns and of block circumvention.
Deepfakes disclosed, without claiming that the disclosure alone makes them lawful.
Publication dates and versions retained.
Reasons given for moderation responses where the DSA requires it.
Regular tests on defamation, identity theft and harassment.
Frequently asked
What we get asked most
Is the organisation liable for a sentence invented by the AI?
Automation does not set liability aside. The exact regime depends on the offence, on the role of the organisation and on the way the content is published, but a publisher cannot shift the burden onto the model.
Does removing content quickly avoid all liability?
No. Removal can limit the harm and satisfy certain obligations, but it does not necessarily erase an offence that has already been published.
Does the DSA require every message to be monitored?
No, it prohibits any general monitoring obligation. It does, however, require notice, statement of reasons, complaint-handling and risk management mechanisms according to the category of the service.
Does a “parody” label authorise any deepfake?
No. Transparency does not erase the rights to one’s image, to private life and to dignity, nor defamation, nor the offences relating to doctored items.
Can a single message contribute to mob harassment?
When does the limitation period for online defamation start?
As a rule, when the content is first made available to the public. Republication may raise a separate question; a mere technical change is not necessarily a new publication.
