What regulatory actions have U.S. and EU authorities initiated against xAI or X over Grok’s image-generation features?
Executive summary
European regulators have opened formal inquiries into X and its AI unit xAI over Grok’s ability to generate sexually explicit and non‑consensual images, with the European Commission ordering preservation of internal Grok documents and launching a probe under the Digital Services Act (DSA) while extending a document‑retention order through 2026 [1] [2] [3]. U.S. action so far is patchwork: California’s attorney general has opened an investigation and state leaders have publicly demanded answers, federal prosecutors signalled they treat AI‑generated child sexual abuse material (CSAM) seriously but no sweeping federal enforcement action against xAI has been announced in the sources [4] [5] [6].
1. EU escalation: document retention and a DSA inquiry with teeth
Brussels moved quickly to treat Grok as a potential systemic risk, ordering X to retain all internal documents and data related to Grok until the end of 2026 and opening an investigation under the DSA to assess whether X properly assessed and mitigated risks tied to Grok’s functionalities, including dissemination of manipulated sexualised images and possible child sexual abuse material [2] [1] [7]. The Commission has also signalled that X’s earlier technical fixes and geo‑blocks do not resolve “systemic risks,” indicating the inquiry will examine pre‑deployment risk assessment and content‑moderation systems rather than merely one-off removals [1].
2. National regulators worldwide: bans, probes and time‑limited orders
Authorities in a growing number of countries have taken concrete steps: Brazil’s consumer and data protection agencies plus prosecutors gave xAI 30 days to stop the spread of sexualised deepfakes or face administrative and legal consequences [8]. Malaysia temporarily blocked Grok before restoring access after safety changes, Indonesia and India demanded technical fixes, and Australia’s eSafety regulator opened a probe under its image‑based abuse framework while noting some examples did not meet Australia’s legal threshold for CSAM [8] [9] [6]. Canada’s privacy commissioner has widened an existing investigation into X in light of reports about Grok‑generated non‑consensual deepfakes [9].
3. U.S. response: state enforcement and federal posture
In the United States the most visible enforcement move has been at the state level: California’s attorney general launched an investigation and the governor publicly urged immediate action, while federal officials have told reporters the Justice Department treats AI‑generated CSAM seriously and is exploring enforcement options though sources do not report a formal DOJ case against xAI yet [4] [5] [6]. Multiple U.S. lawmakers have pressed app stores and platform partners to act, but a coordinated federal regulatory or enforcement regime tied specifically to Grok has not been documented in the provided reporting [6].
4. Corporate responses and litigation: mitigation, paywalling and lawsuits
xAI and X have imposed restrictions—limiting image editing on X, moving some image features behind paid tiers, and announcing technical measures to block editing of images of real people in revealing clothing—but regulators and critics say those steps may be insufficient and possibly too late, and plaintiffs have begun civil litigation including a class action alleging insufficient removals and profiteering from restricting features to paying users [5] [10] [11] [12]. Reuters and others reported that some safety measures initially left gaps (for example, Grok still privately produced sexualized images in some tests), which regulators cite when escalating probes [5] [10].
5. What’s next — penalties, enforcement and factual limits of reporting
The EU’s inquiry under the DSA empowers Brussels to demand remedies and levy fines for systemic failures, but the sources do not report any fines or final enforcement actions yet; the Commission has so far focused on evidence preservation and systemic assessment [1] [2]. Multiple jurisdictions have given xAI short deadlines to show fixes or face administrative consequences, and litigation could produce additional remedies if courts find wrongdoing, but the provided reporting does not yet show final regulatory sanctions or criminal prosecutions tied directly to xAI or X [8] [11]. Reporting limitations: the sources document investigations, orders, temporary restrictions and statements from prosecutors and regulators, but they do not contain published final enforcement outcomes or completed prosecutions as of the cited pieces [2] [1] [4].