ETSI has published a technical specification for reducing risks from generative-AI deepfakes, setting out safeguards from system design through maintenance and end of life. For developers and operators, the practical change is a framework that includes risk assessments, human oversight and ways to test whether protections are in place.
Watch Desk analysis
What happened
The specification, ETSI TS 104 275, covers five stages: secure design, development, deployment, maintenance and end of life. Measures described include documentation, content filtering, labelling, ongoing monitoring and steps to detect and respond to misuse.
It also includes test scenarios and pass/fail criteria for assessing protections. The Biometrics Update report says the work was developed by ETSI’s Technical Committee on Securing Artificial Intelligence and builds on the organisation’s baseline cybersecurity requirements for AI systems.
Why it matters
Deepfake controls often arrive after a harmful image, impersonation or fraudulent site has already spread. This specification frames mitigation as work to do throughout an AI system’s life, rather than relying only on detecting material once it exists. That gives organisations a more concrete checklist: assess risks, document safeguards, oversee systems and test whether measures work.
The report describes the specification’s provisions, but does not establish their legal status or show how widely organisations will adopt them. A standard can make expectations clearer; it cannot, by itself, make anyone follow them.
Our read
This is a useful shift from “spot the fake” to asking what developers and operators did to reduce the chance of harmful deepfakes being generated in the first place. The test criteria are particularly welcome: a safeguard that cannot be assessed risks becoming a reassuring line in a policy document.
For organisations working with generative AI, the practical next step is to examine the specification’s requirements and compare them with existing risk assessments, oversight and testing. The paperwork may not be thrilling, but neither is discovering your safeguards were decorative.
What to watch
- How organisations translate the specification’s requirements into their development and deployment processes.
- Whether testing and pass/fail criteria become visible in real-world assessments.
- How the specification is used alongside existing cybersecurity and AI governance requirements.
Discussion spark: Should deepfake safeguards be judged mainly by whether organisations document and test them, or should they also have to show measurable reductions in harmful outputs?
Sources and evidence
- Source update (30 October 2026, 16:02 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.