EU AI Act and deepfakes: duties and timeline for security teams
What the EU AI Act requires on deepfakes and synthetic content, the new dates after the Digital Omnibus, fines up to 3% and how to fight AI-driven fraud.
In 2024 a finance employee at Arup's Hong Kong office joined a video call with people he believed were the CFO and colleagues. They were deepfakes. He approved 15 transfers totalling HK$200 million (about US$25.6 million), CNN reported. Europol's IOCTA 2025, summarised by eucrim, warns that generative AI makes social engineering more targeted and scalable.
The EU AI Act is not an anti-fraud law, but its transparency rules on synthetic content matter to anyone building, using or targeted by deepfakes, and its timeline has just shifted.
Article 50 duties
The transparency duties in Article 50 are the most relevant for deepfakes. According to Usercentrics:
- Generative AI providers must mark synthetic audio, images, video and text in a machine-readable format (Art. 50(2)).
- Deployers must disclose AI-generated or manipulated deepfakes (Art. 50(4)).
- People must be told when they are interacting with an AI system unless that is obvious (Art. 50(1)).
- AI-generated text on matters of public interest must be disclosed unless it has human editorial review.
The Cloud Security Alliance notes fines of up to €15 million or 3% of worldwide turnover for these breaches, and points out that the burden of proving timely disclosure sits with the organisation. The Act's top tier, for the most serious violations, reaches €35 million or 7%.
A new prohibition
The Omnibus also adds to Article 5 a ban on AI systems designed to generate non-consensual intimate imagery or child sexual abuse material, the so-called nudifier apps, from 2 December 2026. Taylor Wessing reports it covers systems where such output is the intended purpose or reasonably foreseeable without safeguards.
The post-Omnibus timeline
A political deal on the AI "Digital Omnibus" was reached on 7 May 2026 (Taylor Wessing); Parliament approved it on 16 June and the Council on 29 June 2026.
| Date | What applies |
|---|---|
| 2 Feb 2025 | Prohibited practices |
| 2 Aug 2025 | General-purpose AI obligations |
| 2 Aug 2026 | Most Art. 50 duties, including deployer deepfake disclosure |
| 2 Dec 2026 | Machine-readable marking for generative systems on the market before 2 Aug 2026; new "nudifier" ban |
| 2 Dec 2027 | Annex III high-risk obligations |
| 2 Aug 2028 | Annex I product-embedded high-risk AI |
The timeline follows Elevate. The CSA stresses that only the technical marking got a grace period; disclosure duties took effect on 2 August 2026, and systems placed on the market after that date get no runway.
Watermarks are not enough
Deepfakes often circulate stripped of metadata or re-encoded, watermarks have been defeated in research, and non-EU providers cannot be compelled to label content reaching EU users. Detection on the receiving side remains essential. The Commission has published voluntary labelling icons, and a Code of Practice on marking is still being drafted.
Checklist
- Require call-back on a pre-registered channel for urgent payment requests, even after a video call.
- Use dual approval and limits for unusual payments.
- Train finance teams with real cases such as Arup.
- Map Art. 50 duties if you use generative AI in the EU.
- Assess synthetic-media detection for onboarding and customer service.
来源
- Taylor Wessing – The EU Digital Omnibus on AI: what the political deal means
- Usercentrics – EU AI Act high-risk delay and Article 50 transparency
- Cloud Security Alliance – Research note: EU AI Act Article 50 transparency (jul. 2026)
- Elevate Consult – EU AI Act timeline 2026 deadlines
- eucrim – Europol IOCTA 2025
- CNN – Arup revealed as victim of deepfake scam