ETSI Releases Standard to Curb Harmful Deepfakes at the Source
ETSI has released a Technical Specification, ETSI TS 104 275, that aims to reduce the risk of generative AI systems producing harmful deepfakes. Rather than focusing on detection after the fact, it treats prevention as a security and governance task across an AI system's lifecycle.
- ETSI has published Technical Specification ETSI TS 104 275 to reduce the risk of generative AI systems producing harmful deepfakes.
- It takes a proactive approach, treating deepfake prevention as a security and governance issue across the AI system lifecycle.
- Measures include pre-deployment risk assessments, human oversight, content filtering and labelling, ongoing monitoring and documented evidence.
- The document includes test scenarios and pass/fail criteria so organisations can show safeguards are in place.
- It builds on ETSI EN 304 223 and, according to ETSI, supports EU AI Act objectives beyond high-risk systems.
A proactive approach to deepfake risk
The specification was developed by ETSI's Technical Committee on Securing Artificial Intelligence (TC SAI). According to ETSI, it aims to strengthen accountability among AI developers and operators by offering practical measures and safeguards that show how deepfake-related risks can be mitigated.
ETSI says that efforts to combat deepfakes have so far concentrated mainly on detecting manipulated content once it has been created. The new document takes a different route. It frames deepfake prevention as a security and governance challenge that has to be addressed throughout the lifecycle of an AI system.
The specification builds on the baseline cybersecurity requirements in ETSI's EN 304 223 standard for AI models and systems. ETSI also says it supports objectives set out in the EU AI Act, and extends security beyond systems classified as high-risk.
The measures TC SAI outlines
ETSI lists five areas of measures:
- Risk assessments before deployment: identifying potential misuse of generative AI systems and putting safeguards in place before release.
- Human oversight: processes for human review and intervention, so organisations keep control over system behaviour.
- Safeguards against misuse: measures such as content filtering, AI-generated-content labelling and user warnings where appropriate.
- Ongoing monitoring: reviewing emerging threats, investigating incidents and updating safeguards as new risks are identified.
- Evidence-based assessment: keeping documentation and records that show whether appropriate controls have been implemented and are operating as intended.
The specification also includes test scenarios and pass/fail criteria. According to ETSI, these let organisations demonstrate whether the measures to reduce deepfake-related risks have actually been met, rather than relying on commitments to responsible AI development.
Why ETSI says it matters
Alex Cadzow, Rapporteur and Secretary of ETSI TC SAI, pointed to how easily such material can be produced. "Harmful, misleading and illegal deepfake material such as abusive images or fraudulent product sites can be created from the misuse of legal and commercially available software," he said, according to ETSI.
He added that "AI organisations need support in addressing the risks much earlier, starting with how generative AI systems are designed." In his words, the specification gives organisations "a clear set of requirements to help reduce those risks, alongside ways to assess whether the necessary safeguards are in place."
What it means for AI developers and operators
For companies building or running generative AI systems, ETSI TS 104 275 offers a checklist of safeguards together with a way to test and document them. The inclusion of pass/fail criteria means compliance can be assessed against defined results instead of general statements of intent.
ETSI is one of only three bodies officially recognised by the European Union as a European Standards Organisation, and has over 900 member organisations from more than 60 countries. The specification is available on the ETSI website.
