# What is a deepfake? Definition, law and obligations > A deepfake is an image, sound or video generated or manipulated by AI that resembles a real person, place or event and can be mistaken for authentic. In Europe, the AI Act requires such content to be disclosed as artificial. In France, Article 226-8 of the Criminal Code punishes its dissemination without consent and without a mention. ## Definition The word "deepfake" combines "deep learning" and "fake". The AI Act's official French text calls it an "hypertrucage". Article 3(60) of Regulation (EU) 2024/1689 (AI Act) covers AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and could falsely appear to be authentic. Text alone is outside this definition. Article 50(4) requires deployers, that is, the companies that use the tool, to disclose that the content has been generated or manipulated by AI. For an evidently artistic, creative, satirical or fictional work, the obligation is limited to a disclosure that does not hamper the enjoyment of the work. This rule has applied since 2 August 2026. French criminal law rests on consent. Since the law of 21 May 2024 on securing and regulating the digital space (the SREN law), Article 226-8 of the Criminal Code punishes with one year of imprisonment and a EUR 15,000 fine anyone who makes available to the public or to a third party algorithmically generated content showing a person's image or words without their consent, if it is not obvious that the content is artificial or if this is not expressly stated. The penalties rise to two years and EUR 45,000 when an online public communication service is used. Article 226-8-1 covers sexual content: two years and EUR 60,000, and three years and EUR 75,000 online. ## Example At the end of January 2024, Hong Kong police received a report of fraud at the local office of a multinational, later identified as the British engineering firm Arup. A finance employee had made 15 transfers, totalling HK$200 million (about US$25 million), to five bank accounts. He had attended a video conference in which the chief financial officer and several colleagues appeared to be present. According to the police, every participant other than him was a fake built from public video and audio. Arup confirmed in May 2024 that fake voices and images had been used. ## For a leader Relying on each employee's vigilance to spot a deepfake, or believing the risk only concerns public figures. | Treat the deepfake as a procedural risk, in three points. First, require double approval for any payment or change of bank details requested by video call, phone or voice message, with a call-back to a known number, whoever the apparent caller is. The Arup case shows that a meeting with several familiar faces proves nothing. Second, if you use AI to produce images, sounds or videos that depict real people or events (advertising, training, internal communication), disclose it: this has been a deployer obligation since 2 August 2026. Third, obtain written consent before using the image or voice of an employee or executive, avatars included. Publishing without consent and without a mention can amount to the offence in Article 226-8. ## FAQ **What is a deepfake?** It is an image, sound or video generated or manipulated by AI to imitate a real person, place or event, so convincingly that it can be mistaken for authentic. European law uses the term "deep fake" (AI Act, Article 3(60)). **Is a deepfake illegal in France?** Not in itself. Article 226-8 of the Criminal Code targets the dissemination of AI-generated content showing a person's image or words without consent, when it is not obvious that it is artificial or when this is not stated. One year in prison and EUR 15,000, two years and EUR 45,000 online. Sexual content falls under the stricter Article 226-8-1. **What is the difference between a deepfake and an "hypertrucage"?** None in substance. "Deepfake" is the everyday word; "hypertrucage" is the term used in the French version of the AI Act. The Criminal Code speaks of "content generated by algorithmic processing" and, for classic edits, of a "montage". **Do companies have to label AI-generated content in their communication?** Yes when it amounts to a deep fake. Article 50 of the AI Act requires deployers to disclose that the image, sound or video is AI-generated or manipulated, with a lighter mention for evidently artistic or satirical works. The rule has applied since 2 August 2026. The Commission's guidelines on Article 50 clarify the cases covered. **How can a company protect itself from CEO fraud by deepfake?** By procedure rather than by eye. Require double approval and a call-back to a known number for any transfer or change of bank details requested remotely. In the Arup case, an employee made 15 transfers after a video conference in which all the other participants were fakes. ## See also - [AI-generated content labelling (Article 50)](https://wyp.agency/en/glossary/ai-content-labelling/) - [AI Act](https://wyp.agency/en/glossary/ai-act/) - [AI literacy (Article 4)](https://wyp.agency/en/glossary/ai-literacy/) - [Guardrails](https://wyp.agency/en/glossary/guardrails/) - [GDPR and AI](https://wyp.agency/en/glossary/gdpr-ai/) - [Human in the loop](https://wyp.agency/en/glossary/human-in-the-loop/) ## Sources - Regulation (EU) 2024/1689 (AI Act), Article 3(60) (definition of deep fake) and Article 50(4), EUR-Lex (https://eur-lex.europa.eu/eli/reg/2024/1689/oj) - Regulation (EU) 2026/1744 "Digital Omnibus on AI", EUR-Lex (https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX:32026R1744) - French Criminal Code, Article 226-8, in force since 23 May 2024, Légifrance (https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000049571542) - French Criminal Code, Article 226-8-1 (created by Law No. 2024-449 of 21 May 2024), Légifrance (https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000049567458) - Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space, Légifrance (https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000049563368) - Multinational loses HK$200 million to deepfake video conference scam, Hong Kong police say, Hong Kong Free Press, 5 February 2024 (https://hongkongfp.com/2024/02/05/multinational-loses-hk200-million-to-deepfake-video-conference-scam-hong-kong-police-say/) - Deepfake fraud costs engineering giant Arup £20m, Computing, May 2024 (https://computing.co.uk/news/4209651/deepfake-fraud-costs-engineering-giant-arup-gbp20m) --- Entry from the WYP.agency AI glossary · https://wyp.agency/en/glossary/deepfake/ · Last updated : 2026-10-14