We analyze the risks for audiovisual evidence, the forensic detection techniques, the legal framework (AI Act, Penal Code) and what lawyers and experts need to know to challenge or defend synthetic evidence.
Deepfakes on the Stand: The New Exam of the Audiovisual Test in 2026
Deepfakes have ceased to be an internet curiosity to become a real risk in Spanish legal proceedings. In May 2025, the VI Congress of Judicial Evidence organized by the Institute of Evidence and Evidentiary Law (APDP) and the ICAB already warned that the irruption of generative artificial intelligence will force us to rethink how audiovisual evidence is valued in the courts.
The figures accompany this concern. Estimates from cybersecurity companies such as DeepStrike suggest that the volume of online deepfakes has risen from around 500,000 pieces in 2023 to about 8 million projected for 2025, with growth rates close to 900% per year. In parallel, the quality of synthetic voice and manipulated video has reached a point where, in many contexts, it is indistinguishable to the human eye and ear without instrumental support.
For lawyers, experts and judges, the question is no longer theoretical: how is the authenticity of an audio, video or digital image recording accredited today when the technology to falsify them is accessible, cheap and extraordinarily credible?
The BEC scam with a cloned voice: the fraud that is already reaching the courts
Before entering the courtroom, deepfakes are leaving their mark on the business fabric. In the last two years, Business Email Compromise (BEC) fraud has increasingly been combined with synthetic voices from the CEO or executives to order urgent transfers or authorize extraordinary payments.
The script is often repeated: a finance employee receives a seemingly legitimate call or voicemail, with his superior’s voice, accent, and filler words, requesting an immediate movement of funds. In reality, the voice has been cloned from public or internal recordings and generated by an AI model trained to accurately imitate the manager.
Various reports on cyberfraud indicate that this type of attack, supported by social engineering and synthetic content, has skyrocketed in recent years and is consolidated as one of the most sophisticated forms of business fraud. When the case ends up in criminal proceedings or in civil liability claims, the recording that triggered the transfer becomes a key piece of evidence, and the question becomes whether that recording is authentic or the result of a deepfake.
What the human ear no longer sees coming
Experts agree on an uncomfortable point: purely human valuation is no longer enough. Even a forensic expert with years of experience can be fooled by a high-quality synthetic voice if he limits himself to listening, especially in poor quality recordings, short calls, or noisy environments.
The instrumental detection of audio deepfakes is supported by several lines of analysis. These include examining the spectrogram to identify atypical frequency patterns, reviewing formants and vocal resonances, searching for digital microartifacts indicative of synthesis, and checking natural breathing patterns, pauses, and tonal variations that generative models still replicate with difficulty under certain conditions. In video, the focus is on lighting inconsistencies, abnormal facial micro-expressions, artifacts at the edges of the face, and temporal mismatches between frames.
In laboratory settings, some detection systems achieve success rates of around 85–90% on specific data sets. But that yield drops when they are transferred to real contexts, with heterogeneous compressions, cuts, forwards and formats, which leaves a margin of uncertainty that the courts will have to learn to manage.
The deepfake expert: a profile that does not fit into traditional labels
The irruption of deepfakes is also stressing the figure of the expert. Neither the classical acoustic engineer nor the expert photographer alone fits the technical requirements of this type of analysis.
Examining synthetic content requires hybrid profiles: software engineers familiar with generative neural networks, machine learning specialists capable of interpreting how models have been trained and deployed, cryptographers who understand metadata and digital signature systems, and even, in some cases, insider knowledge of the hardware or software used to generate the content. This opens up very practical questions for the Spanish justice system: how are these experts located?, what objective criteria accredit their competence?, how is a report of this type paid for in an ordinary procedure?
For the legal profession, the challenge is not minor. Questioning an expert in deepfakes requires a minimum understanding of concepts such as generative models, spectral detection or watermarking techniques, otherwise relevant gaps in the report will be left unexplored.
A legal framework under construction: AI Act and the Spanish project on synthetic content
While technology advances, the law tries to keep up with it. In the European Union, the Artificial Intelligence Regulation (AI Act) is already in force and provides for its core to be fully applicable from 2 August 2026. Among its pillars are transparency obligations for systems that generate or manipulate audiovisual content.
Section 50 of the AI Act requires that synthetic content—including image, audio, or video deepfakes—be clearly identifiable as artificial or manipulated, with limited exceptions for artistic, satirical, or certain law enforcement contexts. Failure to comply with these obligations can lead to penalties of up to €35 million or 7% of annual global turnover, depending on the severity and type of infringement.
At the same time, Spain has taken steps of its own. In March 2025, the government passed a draft law setting fines of up to €35 million or 7% of global turnover for companies that fail to correctly label AI-generated content, including deepfakes depicting real people doing or saying things they never did. The proposal, aligned with the AI Act, still has to pass through Parliament, but it places Spain among the first European countries to propose a specific sanctioning regime for the lack of transparency in this area.
In the criminal field, different political and legal initiatives explore how to fit deepfakes into existing figures such as crimes against honour, forgery of documents or procedural fraud. Although the reforms are not closed, it is reasonable to think that the use of a deepfake as false evidence to mislead a court may fit into already known types of procedural fraud, with the consequent possibility of reviewing final judgments if the falsity of the evidence is subsequently demonstrated, in the terms provided for by procedural legislation.
Even so, a significant gap persists between the regulatory framework and the operational reality. Various European analyses underline that a significant proportion of public administrations still do not have internal protocols to detect synthetic content, despite the fact that the transparency obligations and the associated codes of practice have already been defined.
Five practical keys for the Spanish legal profession
In this context, procedural practice cannot wait for the rule to be fully established. There are already five guidelines that legal professionals in Spain can adopt immediately.
First, treat with caution the alleged authenticity of the audiovisual evidence. The inertia of considering audio and video recordings «reliable by default» is no longer tenable: as long as audiovisual evidence has a relevant role, it should be assumed that it may have been manipulated unless otherwise proven by technical analysis.
Second, require metadata and a traceable chain of custody. Knowing when the file was generated, with what device, what software it intervened and who has had access from its creation to its contribution to the procedure becomes a central element of the evidentiary discussion. Without this information, the challenge for possible manipulation gains strength.
Third, to demand specialized expert reports when there are indications of alteration. A generic computer report is not enough: deepfakes require specific spectral analysis tools, machine learning-based detection, and sometimes verification of watermarks or labeling systems provided for by the AI Act and European codes of practice.
Fourth, to incorporate the regulatory framework into the legal argumentation. The timetable for the implementation of the AI Act, the transparency obligations of its Article 50 and the Spanish draft on AI-generated content are already useful arguments to sustain requests for proceedings, challenges to evidence or allegations of liability.
Fifth, rely on case management tools adapted to the new reality. The preservation, documentation, and verification of digital evidence—including audiovisual evidence—requires platforms that integrate forensic analysis, chain of custody registration, and traceability of every action on the archives, aligned with the evidentiary requirements of the courts.
A new evidentiary literacy
Deepfakes are not a future threat, but one more piece of the present procedural ecosystem. Generative models will continue to improve, and the ability to destroy reputations, alter business decisions or condition judicial decisions by means of a synthetic archive will increase.
The difference, for the Spanish legal sector, will be due to three factors: sufficient technical training to understand the problem, access to forensic tools that allow the authenticity of digital evidence to be ensured – or challenged – and case management platforms that rigorously integrate the chain of custody of that evidence. In a scenario where evidence can «lie better than the witness», only a combination of technology, legal criteria and sound procedures will allow courts to continue to distinguish, with guarantees, between fact and fiction.
Sources consulted
Deepfakes, figures and evolution
- DeepStrike, «Deepfake Statistics 2025: AI Fraud Data & Trends».
- SQ Magazine, «Deepfake Content Types and Growth Statistics (2025).»
- TechXplore, «Deepfakes leveled up in 2025—here’s what’s coming next.»
Deepfakes, BEC fraud and cybercrime
- ZeroThreat, «Deepfake Attacks & AI-Generated Phishing: 2025 Statistics».
- Eftsure, «Deepfake statistics (2025): facts for CFOs».
Deepfakes and justice/judicial evidence
- WITNESS, «Deepfakes in the Dock: Preparing International Justice for Generative AI».
- UKRI, «Can deepfakes undermine justice?».
- Forbes, «Deepfakes Are Entering U.S. Courtrooms—Judges Say They’re ‘Not Ready.'»
- Impact Lab, «How Justice Survives the Deepfake Era».
- Hastings Law Journal, “Deepfakes on Trial: A Call To Expand the Trial Judge’s Gatekeeping Role To Protect Legal Proceedings from Technological Fakery”.
Regulatory framework: AI Act and transparency
- European Commission, «AI Act | Shaping Europe’s digital future».
- Platform ArtificialIntelligenceAct.eu, «Article 50: Transparency Obligations for Providers and Deployers of AI Systems».
- Legal Nodes, «EU AI Act 2026 Updates: Compliance Requirements and Business Risks».
- Naaia, «AI Act 2026 timeline: compliance obligations and challenges».
- Pearl Cohen, «New Guidance under the EU AI Act Ahead of its Next Enforcement Date».
- European Commission, «Code of Practice on marking and labelling of AI-generated content».
- European Commission, «Commission publishes second draft of Code of Practice on Marking and Labelling AI-generated Content».
- Kirkland & Ellis, «Illuminating AI: The EU’s First Draft Code of Practice on Transparency for AI-generated Content.»
Spain: draft bill and fines for unlabeled AI content
- Reuters, «Spain to impose massive fines for not labelling AI-generated content».
- PetaPixel, «Spain to Fine Companies $38.2 Million for Unlabeled AI-Generated Images».
- The Legal Wire, «Spain introduces draft law that will set massive fines for not labelling AI-generated content».
- IDTechWire, «Spain Unveils Strict AI Content Rules with €35M Fines for Unlabeled Material».
- ARA (en), «The Spanish government takes the first step towards making deepfakes a crime».
