Glossary
Deepfake
Written with AI from the sources below and checked against our facts sheet. Last checked . How this site is made · Spot an error?
Part of: EU AI Act
A deepfake is AI-generated or manipulated image, audio or video that resembles real people, objects, places or events and would falsely appear authentic. The EU AI Act defines the term in Art. 3(60). Under Art. 50(4), deployers who create deepfakes must disclose that the content is artificial, a duty that has applied since 2 August 2026.
In plain English
A deepfake is a counterfeit recording. Like a forged banknote, it does harm because it passes for the real thing.
Not every AI image is a deepfake. The legal test has two parts (Art. 3(60)). The content must resemble existing persons, objects, places, entities or events. And it must falsely appear authentic or truthful. A cartoon robot fails both tests. A realistic video of a real chief executive saying words she never spoke passes both.
Example
Kestrel Bank, a fictional EU lender, wants its chief executive to announce a new app in five languages. She speaks two. The marketing team uses Lumen Studio, a fictional video generator, to clone her face and voice, with her written consent.
- Lumen (provider) must mark every output as AI-generated in a machine-readable format (Art. 50(2)). Lumen launched in 2025, so it has until 2 Dec 2026 to comply.
- Kestrel (deployer) must tell viewers the video is AI-generated, clearly and no later than first viewing (Art. 50(4) and (5)).
- Consent does not remove the duty. The video still falsely appears authentic, so it is still a deepfake.
If Kestrel had produced an obvious parody for a comedy show, a lighter disclosure would do.
Why it matters
EU AI Act transparency. Deepfakes sit in the transparency tier, not the high-risk tier. Providers mark outputs and deployers disclose them. These Art. 50 duties have applied since 2 Aug 2026. Breaches can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99(4)(g)).
New bans. The Digital Omnibus added two prohibitions to Art. 5, applying from 2 Dec 2026. Point (ba) covers AI that generates realistic intimate or sexually explicit depictions of an identifiable person without explicit consent. Point (bb) covers AI that generates child sexual abuse material. Prohibitions carry the top fine tier: up to €35 million or 7% of worldwide turnover, whichever is higher.
United States. The TAKE IT DOWN Act targets non-consensual intimate deepfakes. Other misuse, such as fake endorsements or voice-clone fraud, falls under existing fraud and consumer protection law.
How the AIGP exam tests it
The Art. 50 duties appear in lesson II.C.3, the dates in lesson II.C.10 and US law in lesson II.C.13.
Common traps:
- Swapped roles. Providers mark outputs. Deployers disclose deepfakes.
- Invented duties. Art. 50 requires disclosure, not an opt-out or a ban. Most deepfakes are lawful once disclosed; the new Art. 5 bans target intimate imagery and child abuse material.
- Wrong date. Art. 50 applies from 2 Aug 2026, not the deferred high-risk date of 2 Dec 2027. The marking grace covers only systems launched before 2 Aug 2026.
- Business days. The TAKE IT DOWN clock is 48 calendar hours, and the request needs a good-faith statement, not proof.
The tell: ask who built the tool, who published the content, and when the tool launched.
Frequently asked questions
Are deepfakes illegal?
Not as such. In the EU, most deepfakes are lawful if they are disclosed (Art. 50(4)). From 2 Dec 2026, AI that creates non-consensual intimate images of an identifiable person, or child sexual abuse material, is banned outright. In the US, the TAKE IT DOWN Act makes it a crime to knowingly publish non-consensual intimate imagery, including AI forgeries.
What does the EU AI Act require for deepfakes?
Two things. Providers of generative AI must mark outputs in a machine-readable, detectable way (Art. 50(2)). Deployers who generate or manipulate deepfake content must disclose that it is artificial (Art. 50(4)). The information must be clear and given at the latest at first exposure (Art. 50(5)). Breaches can cost up to €15 million or 3% of worldwide turnover.
When do the EU deepfake rules apply?
Art. 50 has applied since 2 Aug 2026, and the Digital Omnibus did not delay it. Generative systems already on the market before that date have until 2 Dec 2026 for machine-readable marking (Art. 111(4)). The two new Omnibus prohibitions, on non-consensual intimate deepfakes and child sexual abuse material, also apply from 2 Dec 2026.
Does a satirical deepfake need a label?
Yes, but a lighter one. Art. 50(4) eases the duty for evidently artistic, creative, satirical or fictional works. There, the deployer only has to disclose that generated content exists, in a way that does not spoil the work. Full disclosure applies to everything else.
What is the TAKE IT DOWN Act?
A US federal law signed on 19 May 2025. It criminalizes knowingly publishing non-consensual intimate imagery, including AI-generated digital forgeries. Covered platforms must remove such content within 48 hours of a valid request, plus known identical copies. The FTC has enforced the platform duty since 19 May 2026.
Related
Sources
- Regulation (EU) 2024/1689 (EU AI Act), Arts. 3(60), 5, 50, 99 and 111, EUR-Lex
- EU AI Act Service Desk, Article 50: Transparency obligations
- EU AI Act Service Desk, Article 3: Definitions
- EU AI Act Service Desk, Article 5: Prohibited AI practices
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
- Congress.gov, S.146, TAKE IT DOWN Act (2025)
- FTC, FTC begins enforcing the TAKE IT DOWN Act (19 May 2026)