Deepfakes Are Now a Compliance Problem. Here Is What Changed in 2026.

For years, deepfake regulation was mostly hearings, frameworks and voluntary commitments. In 2026 that changed. Three deepfake rules took effect between January and August, in three different jurisdictions, and each one moved responsibility for synthetic media onto the companies that build, host and publish it. A fourth is on its way.

If your product touches user-uploaded images, video or audio, this is now a compliance question, not just a trust and safety one. Here is what changed, what the numbers say about why, and what to do about it if you run a platform today.

January 22, South Korea: the AI Basic Act

South Korea's AI Basic Act took full effect on January 22, 2026 ^[1]. Companies must tell users when a product or service uses generative AI, and content that cannot readily be told apart from reality, deepfakes included, must be clearly labeled. The government calls watermarks a minimum safety measure. Fines run up to 30 million won, about $20,000. Small by EU standards, but the principle is the same: if it looks real and it is not, say so.

May 19, United States: the TAKE IT DOWN Act

The TAKE IT DOWN Act's platform obligations became enforceable on May 19, 2026 ^[2]. Covered platforms that receive a valid report of non-consensual intimate imagery, including AI-generated deepfakes, must remove it within 48 hours.

Two details matter. First, it explicitly covers synthetic content, so "it is not a real photo" is not a defence. Second, 48 hours is short. If your removal process depends on a human finding the right reviewer in the right time zone, that clock gets tight fast.

August 2, European Union: AI Act Article 50

Article 50's transparency obligations kicked in on August 2, 2026 ^[3]. Anyone deploying an AI system that generates or manipulates deepfake content must disclose that the content is artificially generated or manipulated. The EU's Digital Omnibus, which delayed other AI Act rules, left this date in place. Only machine-readable watermarking for AI systems already on the market before August 2 got extra time, until December 2, 2026.

What surprises people: the obligation applies even with no intent to deceive. Marketing and entertainment content is covered too. Clearly artistic or satirical work still needs disclosure, just in a way that does not spoil the work. And, like GDPR, the rules reach companies outside the EU whose content reaches EU audiences. Fines can reach 15 million euros or 3% of worldwide annual turnover, whichever is higher.

Also on the radar, United Kingdom: Ofcom's September 30 hash-matching deadline

Under the Online Safety Act, Ofcom set September 30, 2026 as the date by which it expects UK platforms hosting user-generated content to have automated hash-matching in place to detect and block known illegal intimate images, including AI-generated deepfakes ^[4]. It opened an enforcement programme on September 9. Platforms can use the hash-matching tools Ofcom has identified, or prove that an alternative is equally effective. Penalties reach 10% of qualifying worldwide revenue.

This is the most technically interesting of these rules. Hash matching works for known images, ones that have already been reported and fingerprinted. A brand-new deepfake has no hash. Catching it means classifying content nobody has seen before. That is a detection problem, not a lookup problem.

Next: Denmark wants consent for deepfakes of real people

On October 8, 2026, Denmark's culture minister tabled a bill that would require anyone publishing a realistic, AI-generated imitation of a real person's face, voice or movements to have that person's consent, and to be able to prove it ^[5]. Satire and parody are exempt. It is still a proposal, but if it passes it would apply from January 1, 2027. It treats a person's likeness almost like copyright, which is a very different idea from labeling.

Why regulators moved: the numbers

The money. Surfshark has tracked at least $3.7 billion in documented deepfake fraud losses ^[6]. Losses were $335 million in 2024, then $2.5 billion in 2025, and about 89% of the total was recorded in 2025 and the first half of 2026. Social media was the starting point for 47% of losses, largely driven by fake celebrity endorsements of investment schemes.

The workplace. In a Gartner survey of 297 security leaders, 41% said their organisation had at least one deepfake social engineering incident on an audio call in the past year, and 36% on a video call ^[7].

The trend is not subtle. The cost of making convincing fake media has collapsed, and the losses are following.

What the three rules have in common

Read together, they share three ideas.

Responsibility sits with the platform, not only with the person who made the deepfake.

Speed matters. 48-hour removal, automated detection and labelling at publication are operational requirements, not policy statements.

Detection is assumed. You cannot label, block or remove what you cannot identify. Each rule quietly assumes you have a reliable way to tell synthetic from real.

What to do this quarter

If you run trust and safety at a platform hosting user media, this is where to start.

Map your exposure. Which of these rules apply to you? With EU, UK or Korean users, probably more than one.

Time your takedown flow. Run a test report end to end. Does it close inside 48 hours, including weekends?

Label what your own product generates. If you ship any generative feature, Article 50 applies to your outputs too.

Do not rely on a single signal. Watermarks only exist if the generator added one. C2PA metadata disappears with a screenshot. Classifiers drift when new generators ship. Layer them.

Document your decisions. Regulators will ask how you decided something was or was not synthetic. "A model said so" is a weak answer. A record of what was checked, and why, is a strong one.

The bigger shift

For most of the last decade, the question was whether deepfakes were a real problem. That debate is over. The 2026 question is operational: who is responsible, how fast do they have to act, and how do they prove they acted correctly?

The companies that treat detection as infrastructure now, rather than a feature bolted on after an incident, will have a much easier 2027.

Check any image or video now

Upload at witness.vision/scan. Witness reads C2PA provenance alongside AI detection models. Free to use, no account required.

Scan now at witness.vision/scan