For Board · Heads-of · Practitioner
Deepfake
Also known as: deep fake
AI-generated or manipulated image, audio or video content that resembles real people, objects, places or events and would falsely appear to a person to be authentic. For an organisation, the most immediate risk is impersonation fraud: a cloned voice or a faked video call instructing a payment.
- deepfake
- synthetic media
- voice cloning
- impersonation fraud
- Article 50
Definition and law
The EU AI Act defines a deep fake in Article 3(60) and requires deployers who create or publish one to disclose that it is artificially generated (Article 50(4)). In England and Wales, creating or requesting a purported intimate image of another person without consent has been a criminal offence since 6 February 2026, under provisions the Data (Use and Access) Act 2025 added to the Sexual Offences Act 2003.
The fraud risk
In January 2024 an employee of the engineering firm Arup in Hong Kong transferred HK$200 million (about US$25 million) after a video call in which every other participant, including the apparent chief financial officer, was a deepfake. Voice cloning makes the same attack possible by phone. Controls that rely on recognising a voice or a face no longer work on their own.
Controls
Out-of-band verification for any high-value or unusual payment instruction, through a channel the requester did not choose; staff awareness that video and voice can be faked; and, for organisations that publish synthetic media, AI transparency and disclosure labelling. The register entry for undisclosed synthetic content is undisclosed AI interaction.
Sources
Related Terms
Content Provenance
Verifiable information about where a piece of content came from and how it was made or changed, attached to the content itself. It is the technical basis for labelling AI-generated material, through standards such as C2PA Content Credentials and through watermarking.
EU AI Act
The European Union's regulation of AI systems by risk category, in force since 1 August 2024 and applying in stages. As of October 2026 the prohibitions, the AI literacy duty, the general-purpose model obligations and the Article 50 transparency duties all apply. The 2026 Digital Omnibus, Regulation (EU) 2026/1744, deferred the high-risk obligations to December 2027 and August 2028, softened the literacy duty and added two prohibitions. It reaches any organisation whose AI output is used in the EU, wherever the organisation sits.
Multimodal AI
AI systems that process and combine more than one type of data (text, images, audio, video) to understand and respond to the world.
Prohibited AI Practices
The uses of AI that Article 5 of the EU AI Act bans outright. Eight have applied since 2 February 2025, and the 2026 Digital Omnibus adds two more from 2 December 2026: systems that create non-consensual intimate material and systems that generate child sexual abuse material.
Transparency
The disclosure of information about an AI system to the people who need it: that AI is being used, what it does, what it is for and what risks it poses, in terms they can understand. For people whose personal data it uses, being informed is also a legal right.