What it means
- Two sides:
- Do not enable deepfakes: stop your AI tools from creating deceptive likenesses or voices of real people without consent, and detect synthetic content on your platform.
- Do not be impersonated, and do not impersonate: make it easy for customers to verify that AI communications really come from you, and never pass off AI as human or human as AI.
- Covers face swaps, voice clones, avatar videos and morphed images.
- ISO 27001 reuse: None. New for AI, not covered by ISO 27001. Social engineering awareness training under ISO 27001 helps with the staff fraud angle only.
Why it matters
- The 2026 IT Rules require technical measures against deceptive depictions of real people, 2-hour removal of impersonation content on complaint, and for SSMIs a technical check of uploader SGI declarations.
- MeitY advisories ask SSMIs to identify and remove reported deepfakes within 36 hours and to protect electoral integrity.
- RBI FREE-AI asks regulated entities to use only verifiable channels (for example 1601-series numbers for voice, labelled digital interfaces) and never to falsely claim AI use.
- Voice-clone fraud against Indian bank customers and CXO impersonation scams are rising.
Checklist
- If you offer image, video or voice generation: require consent or rights for real-person likenesses; block public figure and candidate likenesses by default.
- Use face and voice similarity checks to refuse cloning without verified consent.
- Label and embed provenance in all synthetic media (SC-AI-023 Label AI-generated and synthetic content).
- SSMIs: deploy deepfake detection tools to verify uploader declarations, proportionate to content type and source; test their accuracy (SC-AI-015 Pre-deployment testing and validation).
- Offer a fast reporting route for impersonation victims linked to the 2-hour takedown process (SC-AI-035 Takedown and response timelines).
- BFSI: run AI voice and messaging only from registered, verifiable channels (1601-series numbers, verified sender IDs); publish them to customers.
- Train staff against deepfake CEO or vendor fraud: call-back verification for payment requests.
- Add election-period controls and monitoring (SC-AI-034 Unlawful and prohibited content safeguards).
Evidence examples
- Consent capture records for voice or face cloning features.
- Blocked-likeness list and refusal test results.
- Deepfake detection tool evaluation report (accuracy, false positives).
- Registered channel list (1601 numbers, sender IDs) and customer communication publishing them.
- Impersonation report tickets with response times.
- Staff anti-impersonation training and call-back procedure.
Common pitfalls
- Consent checkbox with no verification that the uploader is the person in the sample.
- Detection tool bought and never tested on Indian faces, accents or languages.
- Bank AI calls from ordinary mobile numbers that customers cannot distinguish from fraudsters.
- Treating deepfakes only as a content problem and ignoring payment fraud risk.
Satisfies
- BindingEU AI Act
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- BindingTexas TRAIGA
- BindingKorea AI Basic Act
- SupervisoryMeitY AI and Deepfake Advisories
- VoluntaryRBI FREE-AI
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- A.6.2.4 verification and validation
- A.9.2 processes for responsible use
- A.9.4 intended use
ISO/IEC 27001
No direct equivalent
SOC 2
No direct equivalent
Key takeaways
- Prevent your tools from cloning people without consent, and detect deepfakes on your platform.
- Make your own AI channels verifiable so customers can spot fakes.
- Link deepfake reports to the 2-hour takedown clock.