ETSI introduces standard to prevent harmful deepfakes at source

The European Telecommunications Standards Institute (ETSI) has published a new Technical Specification aimed at reducing the risk of generative AI systems being misused to produce harmful deepfakes.

Developed by ETSI’s Technical Committee on Securing Artificial Intelligence (TC SAI), ETSI TS 104 275 takes a preventive approach to deepfake-related risks. Rather than focusing primarily on detecting manipulated content after its creation, the specification addresses safeguards throughout the lifecycle of AI systems, from design and development to deployment and ongoing operation.

The specification builds on the baseline cybersecurity requirements in ETSI EN 304 223 for AI models and systems. It provides practical measures to help organisations identify and mitigate the risks of harmful deepfakes, supporting objectives of the EU AI Act and extending security considerations beyond systems classified as high-risk.

The recommended measures include conducting risk assessments before deployment to identify potential misuse and establish safeguards. Organisations are also expected to maintain human oversight, introduce protections such as content filtering, AI-generated-content labelling and user warnings where appropriate, and monitor emerging threats and incidents.

ETSI TS 104 275 also calls for organisations to maintain documentation and records showing that the relevant controls have been implemented and are working as intended. It includes test scenarios and pass/fail criteria to help assess whether the safeguards effectively reduce deepfake-related risks.

According to Alex Cadzow, rapporteur and secretary of ETSI TC SAI, the specification is intended to help organisations address risks earlier in the development process, rather than relying solely on measures taken after harmful content has been generated.

The full ETSI TS 104 275 specification is available on the ETSI website.