The European Telecommunications Standards Institute has published ETSI TS 104 275, a technical specification that sets safeguards for reducing the risk of generative AI systems producing harmful deepfakes, including those used for identity fraud and impersonation. Announced on October 29, the specification was developed by the Technical Committee on Securing Artificial Intelligence (TC SAI) and takes what ETSI calls a proactive approach: treating deepfake prevention as a security and governance challenge across the AI system’s lifecycle rather than detecting manipulated content after it has been created.
What the Specification Does
The specification, formally titled “Securing Artificial Intelligence (SAI); Application of Baseline Cyber Security Requirements for AI Models and Systems principles to Generative AI; Preventing Harm from Deepfakes,” aims to “strengthen accountability among AI developers and operators by providing practical measures and safeguards that demonstrate how to mitigate deepfake-related risks,” according to the release reported by Biometric Update.
It builds on baseline cybersecurity requirements set out in ETSI’s EN 304 223 standard for AI models and systems, and supports objectives laid out in the EU AI Act, which sets transparency duties for AI-generated content.
Five Stages of the AI Lifecycle
The specification organizes its requirements around five stages: secure design, development, deployment, maintenance and end of life. The measures it outlines include identifying potential misuse of generative AI systems and implementing safeguards before release, establishing processes for human review and intervention, implementing content filtering, labeling of AI-generated content and user warnings, reviewing emerging threats, investigating incidents, updating safeguards and maintaining documentation and records, as Telecoms.com reports.
Crucially, the document includes test scenarios and pass/fail criteria, which ETSI says allow organizations to show whether a reduction in deepfake-related risks has actually occurred, “rather than relying on commitments to responsible AI development.”
Why It Matters
Deepfake risks have mostly been fought at the detection end, with tools that try to spot manipulated media after it circulates. TS 104 275 shifts the responsibility earlier: to how generative systems are designed, built and operated in the first place. For AI developers and operators, it offers a concrete checklist against which to assess their safeguards; for buyers and regulators, it offers testable criteria instead of blanket safety promises.
Alex Cadzow, rapporteur and secretary of ETSI TC SAI, warned that the threat does not depend on exotic tooling: “Harmful, misleading and illegal deepfake material such as abusive images or fraudulent product sites can be created from the misuse of legal and commercially available software.” The full specification is available from ETSI’s official library.
Sources
- ETSI, press release “ETSI unveils new standard to reduce production of harmful deepfakes” (October 29, 2026): press release
- ETSI TS 104 275, official specification (PDF): specification
- Biometric Update, “ETSI releases specification to help mitigate AI deepfake risk” (October 30, 2026): article
- Telecoms.com, “ETSI deploys new standard to combat deepfakes” (October 29, 2026): article
