Deepfake

The EU AI Act defines a deepfake in close to these words (Art. 3(60)) and regulates it through transparency rather than prohibition. Providers of generative systems must mark synthetic outputs in a machine-readable, detectable way, and deployers who generate or manipulate deepfake content must disclose that it is artificial. For evidently artistic, satirical or fictional works, disclosure can be limited so as not to spoil the work.

Other rules apply alongside. A deepfake of an identifiable person processes personal data, often biometric, so data protection law governs it; intimate or defamatory deepfakes may also be crimes under national law. For organizations, the most common risks are fraud (voice clones of executives authorizing payments), reputational attacks and manipulated evidence. Controls include verification procedures for unusual requests, staff awareness and incident response plans.

Example: a finance clerk receives a video call from what appears to be the CFO asking for an urgent transfer; a call-back procedure through a known number exposes the fraud.