AI Deepfakes Are No Longer Just a Reputation Risk: What Should Companies Document After the AI Act?

Updated: 3 September 2026 · Category: AI, Data Security and Breaches

AI Deepfakes Are No Longer Just a Reputation Risk: What Should Companies Document After the AI Act?

Article 50 of the AI Act introduces transparency and disclosure obligations for AI-generated or manipulated images, audio and video constituting deepfakes. Recording how content was produced, the tool used, human oversight and publication approval is not a separate record-keeping obligation independently established by Article 50; it is a practice that strengthens a company’s compliance, governance and capacity to provide evidence when needed.

Contents

Short answer
Why does it matter?
What should companies do?
How should it be measured?
Sources
Frequently asked questions

Short Answer

Why Does It Matter?

Deepfake risk should be considered beyond fake news and reputational attacks. When a brand uses AI to create a real person’s image, voice or behavior in its own advertising, both the transparency rules in Article 50 of the AI Act and the impression the advertisement creates among consumers may be relevant.

Distinguish legally required disclosure under Article 50 from the company’s internal evidence records. Keeping records of the model, production time, human oversight and approval is sound governance, but it is inaccurate to present all these records as a separate “Evidence Pack obligation” expressly imposed by Article 50.

What Should Companies Do? 7 Checks Before Publishing a Deepfake

Determine whether the content artificially represents a real person or event.
Distinguish provider and deployer responsibilities for the use case.
Check the required machine-readable marking capability.
Document whether disclosure by the deployer is required and how it is visibly implemented.
Separately verify permissions covering the real person’s image, voice and personality rights.
Do not give the misleading impression that the person actually tried or recommended the product.
Keep the final file, disclosure decision and human approval in the version record.

Proposed Measurement Model for B10

Control	KPI
Deepfake classification	Classification coverage
Provider marking	Machine-readable marking test success
Deployer disclosure	Disclosure completeness
Personality rights	Consent or license evidence coverage
Human control	Human review coverage
Version	Published-file traceability

Rather than using the deepfake count alone as a KPI, track how many relevant deepfakes have disclosure, rights checks and evidence of the final version together.

Expert Assessment

The key distinction in deepfake governance is not merely whether content was made with AI, but what reality it imitates and how it could mislead users. A wholly fictional virtual character and a digital replica of a real executive or customer carry different levels of risk.

How Can Deepfake Risk Levels Be Distinguished?

A deepfake file’s life cycle extends beyond production. The identity of the real person depicted, the context imitated, the extent of audio or image manipulation and the perception of reality created by the advertising message are separate risk signals. For example, a corporate announcement in an executive’s synthetic voice requires different controls from a wholly fictional avatar describing product features.

For uses suggesting a testimonial or endorsement, the message matters as much as the production technique. Giving the impression that a real person made a recommendation they never made is not a risk resolved simply by adding “Made with AI”. Disclosure, rights ownership and whether the advertisement is misleading must be assessed separately.

Final File Traceability

When a production team creates many variants, retaining the project folder alone is insufficient. It must be possible to show which file was published, when, on which platform and with which disclosure. Keeping the final file hash, creative ID, publication URL and approval record under the same case helps detect variants altered later or accidentally reused.

Post-publication Deepfake Incident Plan

If deepfake content is misused or reused without permission, removing the creative alone may be insufficient. Check whether the same file has spread to other social media accounts, ad libraries or third-party channels. The approved original file’s hash and publication records help the brand distinguish its own content from subsequently altered copies.

Synthetic media governance therefore continues beyond pre-production approval. A separate incident procedure can cover takedown, misuse detection, rights-holder notification and prevention of reuse. For content depicting senior executives or well-known people, this also reduces reputational and fraud risks.

Digital Risk and Compliance Analysis

B10 can assess deepfake and synthetic media use with separate risk scores for classification, disclosure, rights ownership and evidence of the published version.