Recent European cases indicate that consent and simple disclosure no longer suffice to manage the risks posed by AI‑generated avatars, deepfakes and voice clones. Deloitte experts advise organisations to assess risks during design and procurement, tighten supplier oversight, and ensure clear, consistent disclosure across every channel where content appears.
What the European cases revealed
- In one case, videos altered by AI using a real person's likeness appeared realistic to viewers. Authorities concluded that producing and using such content requires appropriate technical and organisational measures to uphold data protection principles.
- In another instance, a third‑party partner created a cloned voice without the necessary authorisations; the client's internal controls failed to detect the unauthorised AI use in time. This highlights that suppliers' unauthorised actions can create legal and reputational exposure for contracting organisations.
- A further case involved highly realistic avatars, voice technology and real‑time interaction, underlining why AI governance cannot be postponed until after deployment and why specific pre‑deployment risk assessments are necessary.
Recommendations from Deloitte experts
Dr. Barta Gergő, Director at Deloitte Consulting, stressed that understanding technology capabilities is not enough: corporate control systems must prevent deception and ensure consistent information across all channels where content is published.
Páll Zoltán, Deloitte's lead AI expert, added that formal compliance alone is insufficient. Companies should review the full process—from approval of intended use and supplier oversight to human sign‑off before publication and ongoing monitoring of released content.
Recommended controls and procedures
Based on European experience, organisations using digital avatars, deepfakes or voice clones should implement the following core controls:
-
Design and approval
- Pre‑approval of the intended use.
- Verification of rights to use a person's likeness or voice, and documented scope of consent.
- Conducting a data protection impact assessment (DPIA) or AI risk assessment.
- Mapping potential misuse scenarios in advance.
-
Suppliers and technical restrictions
- Stricter oversight of suppliers and contractual guarantees.
- Technical safeguards to prevent unauthorised AI usage.
-
Publication controls
- Human approval of content prior to publication.
- Clear, conspicuous labelling on every platform indicating that content is AI‑generated or manipulated.
-
Supplementary protective measures
- Provenance markers or digital watermarks for content.
- Detailed logging and continuous monitoring to detect misuse.
- Rapid takedown procedures and the ability to shut down systems immediately.
- Regular review and update of controls.
Regulatory context and business implications
The European Union's proposed regulatory framework for artificial intelligence (AI Act) introduces further transparency obligations for AI‑generated or manipulated image, audio and video content. Organisations must therefore build controls that can be demonstrated as compliant from technological, legal and operational perspectives.
Deloitte experts emphasise that conscious AI governance is not an innovation barrier but a prerequisite for safe scaling. Firms that align business objectives, supplier practices, legal requirements and technical controls from the outset can turn AI into a reliable, sustainable business tool and gain competitive advantage.
Conclusion
European experience shows that consent and disclosure are necessary but insufficient. Companies must establish layered, end‑to‑end controls across the AI lifecycle—starting in design and procurement, through supplier management and human approvals, to continuous monitoring—to mitigate legal, privacy and reputational risks associated with AI‑generated and AI‑modified content.
