Kristy Gouldsmith
Deepfakes are often framed as a media problem but for the legal sector they are also an evidential problem, a fraud problem, a privacy problem and, increasingly, a professional responsibility problem. A deepfake is a form of synthetic media in which audio or video is generated or manipulated by AI so that a person appears to say or do something that did not happen.1
For solicitors, barristers, judges, in-house teams and legal operations leaders, the issue is no longer confined to a hypothetical future. The judiciary in England and Wales now expressly warns that AI tools are being used to produce fake material, including text, images and video, and that judges should be aware of the challenges posed by deepfake technology. That is a significant change in tone. It signals that manipulated media is no longer just a cyber or public-policy issue. It is now part of the day-to-day risk environment of litigation and legal practice.2
Evidence is the obvious pressure point
The first concern is authenticity. Legal systems have always had to deal with forgeries, fabricated documents and coached testimony. Deepfakes do not replace those older problems — they scale them. Synthetic audio and video can now be produced more cheaply, more quickly and with far greater plausibility than most traditional falsifications. That matters wherever legal decisions depend on recordings, remote interviews, video evidence, internal investigations, employment grievances, police interviews, whistleblowing reports or social-media material.
The broader judicial response to generative AI reinforces the point. In Ayinde v London Borough of Haringey and Al-Haroun v Qatar National Bank, the court stated that lawyers are responsible for the material they place before the court and must check AI-generated material before using or relying on it. The case was not about synthetic video but it is still important because it shows that courts are likely to treat failures of verification as a professional failing, not a technological excuse.3
That direction of travel is visible in procedural reform too. In February 2026, the Civil Justice Council published an interim report and consultation on whether rules should govern the use of AI in preparing court documents. Its provisional view was that declarations may be required in some circumstances where AI has been used to generate evidence on which the court is being asked to rely. Even if the final position changes, the consultation is important because it shows that concern has moved beyond guidance and into possible rulemaking.4
There is a second evidential problem which is easier to miss — deepfakes do not merely create fake evidence but also make genuine evidence easier to attack. A 2026 study published in Communications Psychology found that people continued to rely on the content of deepfake videos even when warned in advance that the videos were fake and also suggested that warnings can contribute to broader distrust or generalized uncertainty. In legal terms, that means the problem is not just fabricated material entering the record. It is also the growing ease with which authentic recordings can be challenged as suspicious.5
Fraud, impersonation and remote practice
The second pressure point is operational. The SRA has already warned that AI can be used to create highly realistic deepfake images and videos, making phishing scams harder to recognise and raising the possibility of false evidence. The SRA’s AML sectoral risk assessment is more specific: it says firms have not yet seen evidence of deepfake technology being used to impersonate legitimate clients but they should remain alert to that possibility. In a market where onboarding, payment instructions and urgent client communications are often handled remotely, that warning should be taken seriously.6 7
The cyber-security framing points in the same direction. The NCSC has warned that generative AI is already being used to impersonate, clone and deceive people and systems and that the consequences can include reputational harm, loss of trust in data and media, and more convincing spear-phishing attacks. This matters acutely to law firms because the trust model of many legal transactions still assumes that a familiar voice, a recognisable face, a plausible email thread or a video call carries meaningful evidential value. Deepfakes erode each of those assumptions.8
Confidentiality, privilege and data protection
Deepfakes also sit squarely inside data-governance risk. The SRA says firms must use AI in ways that protect sensitive information and must ensure that confidentiality and legal privilege are not compromised. The ICO has taken an equally clear view in its Tech Horizons work on synthetic media: where personal information is used in developing or using models to create synthetic media, data protection law applies, even if the final synthetic media itself contains no personal information. The ICO also notes that identification and detection systems may themselves process personal data.9
The cross-regulatory concern is becoming sharper. In February 2026, a joint statement coordinated through the ICO warned that AI systems are enabling the creation of realistic images and videos depicting identifiable individuals without their knowledge and consent, including non-consensual intimate imagery and defamatory depictions. The statement called for robust safeguards, meaningful transparency and effective, accessible removal mechanisms. 10 Alongside that, section 66E of the Sexual Offences Act 2003 created an offence of creating a purported intimate image of an adult, such as a deepfake or AI-generated image, and section 66F created an offence of requesting one.11
The law is moving, but unevenly
The legal response to deepfakes is developing across several fronts but it remains uneven. Some of the response is criminal, as with intimate-image offences. Some is regulatory, as with data protection and professional conduct. Some is procedural, as with judicial guidance and the Civil Justice Council’s consultation. Some is market-facing, as with cyber guidance on provenance and authenticity. What is still missing is a single, settled framework that tells courts, regulators and practitioners exactly how synthetic media should be authenticated, disclosed, challenged and weighed across all contexts.
At EU level, Article 50 of the AI Act adds an important transparency layer. The European Commission says that providers of generative AI systems must mark outputs in a machine-readable format so they are detectable as artificially generated or manipulated and that deployers of systems that generate or manipulate image, audio or video content constituting a deep fake must disclose that fact. These obligations become applicable on the 2nd August 2026. For legal practice, that is significant, especially for cross-border businesses and evidence streams that move between the UK and the EU. 13 14 But these are transparency duties, not a complete evidential code for litigation or investigations.
Why detection is not a silver bullet
It may be tempting to answer deepfakes with detection tools alone but the UK government’s March 2026 report on deepfake detection technology says the market has potential but that development is still in its early stages. 14 NIST similarly warns that the efficacy of many technical approaches to provenance tracking and synthetic-content detection is not yet fully examined and that many approaches may still be years away from widespread deployment on mobile devices. 15 The message for the legal sector is plain — detection tools may help but they are not a clean substitute for provenance, corroboration, process controls and human judgment.
What the legal sector should do now
The practical response should therefore be institutional rather than ad hoc. Firms should review onboarding and verification procedures so that identity is not established through a single video call. Urgent payment instructions should be subject to call-back procedures, dual approval and known-channel confirmation. Internal AI policies should cover not just drafting tools, but also synthetic-media risk, evidential verification, confidentiality, escalation routes and incident response. Litigation teams should be ready to ask early questions about provenance, metadata, editing history, chain of custody and whether expert evidence is needed.
Training also needs to change. Fee earners, compliance teams, investigators and support staff should all understand that synthetic media risk is not confined to social media scandals. It affects witness handling, client communication, reputational investigations, internal disciplinary work, cyber response and disclosure strategy. In many organisations, the most serious failures are likely to come not from sophisticated courtroom fakery but from ordinary workflow assumptions that have become outdated.
The central legal issue is trust. Deepfakes weaken the reliability of audio and video, increase the plausibility of impersonation and fraud and complicate the responsible use of both AI systems and personal data. For the legal sector, that means standards of verification, supervision and governance are rising. These need to be treated as a core legal risk rather that something that ‘won’t happen to us’.
Footnotes
1. Department for Science, Innovation and Technology, ‘Deepfake detection technology’ (GOV.UK, 26 March 2026). Deepfake detection technology – GOV.UK. Accessed 7th of April 2026.
2. Judiciary of England and Wales, Artificial Intelligence (AI) Guidance for Judicial Office Holders (31 October 2025) 7. Artificial-Intelligence-AI-Guidance-for-Judicial-Office-Holders-2.pdf. Accessed 7th of April 2026.
3. Ayinde v London Borough of Haringey and Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin), [16]. Ayinde-v-London-Borough-of-Haringey-and-Al-Haroun-v-Qatar-National-Bank.pdf. Accessed 7th of April 2026.
4. Civil Justice Council, Use of AI for Preparing Court Documents: Interim Report and Consultation (February 2026) paras 1.3-1.5, 2.2 and 2.10. Interim-Report-and-Consultation-Use-of-AI-for-Preparing-Court-Documents-2.pdf. Accessed 7th of April 2026.
5. Simon Clark and Stephan Lewandowsky, ‘The continued influence of AI-generated deepfake videos despite transparency warnings’ Communications Psychology (2026). The continued influence of AI-generated deepfake videos despite transparency warnings | Communications Psychology. Accessed 7th of April 2026.
6. Solicitors Regulation Authority, Risk Outlook report: The use of artificial intelligence in the legal market (20 November 2023) sections ‘Confidentiality and privacy’ and ‘Crime’. SRA | Risk Outlook report: The use of artificial intelligence in the legal market | Solicitors Regulation Authority. Accessed 7th of April 2026
7. Solicitors Regulation Authority, Sectoral Risk Assessment – Anti-money laundering and terrorist financing section ‘Emerging Risks’. SRA | Sectoral Risk Assessment – Anti-money laundering and terrorist financing | Solicitors Regulation Authority. Accessed 7th of April 2026
8. National Cyber Security Centre, ‘Preserving integrity in the age of generative AI’ (29 January 2025). Preserving integrity in the age of generative AI | National Cyber Security Centre – NCSC.GOV.UK. Accessed 7th of April 2026.
9. Information Commissioner’s Office, ‘Synthetic media and its identification and detection’, Tech Horizons Report 2025. Tech Horizons report 2025 | ICO. Accessed 7th of April 2026.
10. Information Commissioner’s Office and co-signatories, Joint Statement on AI-Generated Imagery and the Protection of Privacy (23 February 2026). 20260223-iewg-joint-statement-on-ai-generated-imagery.pdf. Accessed 7th of April 2026
11. Crown Prosecution Service, Communications Offences, section on Sexual Offences Act 2003 ss 66E and 66F. Communications Offences | The Crown Prosecution Service. Accessed 7th of April 2026.
12. European Commission, ‘Guidelines and Code of Practice on transparent AI systems’. Guidelines and Code of Practice on transparent AI systems | Shaping Europe’s digital future. Accessed 7th of April 2026
13. European Commission, ‘Navigating the AI Act’, Navigating the AI Act | Shaping Europe’s digital future. Accessed 7th of April 2026.
14. Department for Science, Innovation and Technology, ‘Deepfake detection technology’ (GOV.UK, 26 March 2026), Deepfake detection technology – GOV.UK. Accessed 7th of April 2026
15. NIST, Reducing Risks Posed by Synthetic Content: An Overview of Technical Approaches to Digital Content Transparency (2024), Reducing Risks Posed by Synthetic Content An Overview of Technical Approaches to Digital Content Transparency | NIST. Accessed 7th of April 2026.