What happened
On 29 October 2026 ETSI's Technical Committee on Securing Artificial Intelligence (TC SAI) released Technical Specification ETSI TS 104 275, which aims to reduce the risk of generative AI systems producing harmful deepfakes. It takes a proactive, lifecycle approach rather than post-hoc detection, requiring pre-deployment risk assessments, human oversight processes, safeguards against misuse (content filtering, AI-generated-content labelling, user warnings), ongoing monitoring/incident investigation, and evidence-based assessment. It specifies test scenarios and pass/fail criteria so organisations can demonstrate the safeguards are actually met, and builds on the baseline cybersecurity requirements of ETSI EN 304 223. ETSI positions it as supporting EU AI Act objectives, extending security beyond systems classified as high-risk.
Why it matters
This is the first ETSI specification to treat deepfake prevention as a security-and-governance lifecycle problem with concrete, auditable requirements and test criteria, rather than relying on detection after the fact. It gives AI developers and operators in the EU/ETSI member states a standards-based way to demonstrate mitigation controls for generative-AI misuse, and it extends AI-security requirements beyond AI-Act high-risk classification — a practical compliance route that complements EN 304 223 and ISO/IEC 27090.
Action needed
Map generative-AI product controls against TS 104 275 requirements (pre-deployment risk assessment, human oversight, content labelling/filtering, ongoing monitoring, evidence documentation); adopt its test scenarios and pass/fail criteria as conformity evidence; align deepfake-mitigation controls with EN 304 223 and EU AI Act obligations.