Regulating Deepfakes: International Trends and the UAE Legal Landscape

Deepfakes have moved from online curiosities to a systemic risk for politics, markets, and individual rights, prompting legislators and regulators to adapt fast. This article sketches the core risks, shows how key jurisdictions are responding, and then zooms in on how the UAE is dealing with deepfakes under its current legal framework.

What deepfakes are and why they matter

Deepfakes are images, audio, or video generated or manipulated by AI to resemble real people or events in a way that is likely to mislead viewers. The EU’s AI Act captures this by defining deepfakes as AIgenerated or AImanipulated image, audio, or video content that looks real enough that a person could believe it authentic. These tools can replicate an individual’s face or voice from limited source material, generate convincing real-time video calls, simulate speech and mannerisms, fabricate events that never occurred, or create highly realistic images and videos of people who never posed for them.

The harm is not theoretical. In 2024, a finance employee at engineering firm Arup was tricked into wiring about USD 25–26 million after a video conference where the supposed CFO and colleagues were actually deepfaked/AIgenerated video and audio used to impersonate senior staff and push 15 fraudulent transfers.

Emerging global approaches in brief

Rather than banning deepfakes outright, most jurisdictions are focusing on two recurring themes: punish harmful uses, and demand transparency when synthetic content is used.

In the United States, laws have been enacted to criminalize nonconsensual explicit deepfakes, deceptive political deepfakes near elections, or create civil actions for victims. Proposed federal measures such as the DEFIANCE Act have sought to give victims of non-consensual explicit deepfakes a right to sue for damages, while agencies continue to use existing consumer protection and fraud laws (such as the FTC Act) to address deceptive uses of deepfakes in advertising or scams.

In the European Union, deepfakes are addressed mainly through transparency and platformgovernance obligations. Article 50(4) of the EU AI Act requires deployers of AI systems that generate or manipulate content constituting a deepfake to disclose that the content has been artificially generated or manipulated, with limited exemptions for lawenforcement and clearly artistic or satirical works.

Across Asia and other regions, countries are plugging deepfakes into their existing cybercrime, intimateimage, and intellectual property laws. Singapore’s misinformation law (POFMA) for example allows authorities to require platforms to label or remove deepfake‐driven falsehoods about public affairs.

The UAE’s legal framework and practice

The UAE has not enacted a standalone “Deepfake Law” yet, but deepfake conduct is already captured under Federal DecreeLaw No. 34 of 2021 on Combating Rumors and Cybercrimes (the “Cybercrimes Law”), the Penal Code, and privacyrelated provisions.

Cybercrimes Law No. 34 of 2021

Federal DecreeLaw No. 34 of 2021 criminalizes a range of falseinformation and onlineharm behaviours that map directly onto deepfakes.

Articles 52 and 54 penalize creating or disseminating fake news, fabricated images or videos, or misleading digital content that harms the reputation or interests of the UAE, or that spreads rumors and false information likely to incite panic or undermine stability.

The law imposes strict penalties: fines can range from AED 100,000 up to AED 1 million, and serious offences can also lead to imprisonment, particularly where impersonation of officials or misuse of national symbols is involved.

Penal Code, defamation, and privacy

The Federal DecreeLaw No. 31 of 2021 also provides the underlying offences for defamation, insult, and invasion of privacy, which are then aggravated when committed online.

Defamation provisions apply when false statements, whether text or synthetic media, harm an individual’s honor or reputation. When defamation occurs through digital means, such as a deepfake video, Article 44 of the Cybercrimes Law increases penalties to up to one year’s imprisonment and/or a fine between AED 250,000 and AED 500,000 per offence.

Privacy offences cover using technology to record, copy, or share images, audio, or video of individuals without consent, particularly in private contexts, with penalties that include imprisonment and substantial fines.

Soft Law

In addition to binding laws, the UAE is increasingly steering AI and deepfake use through softlaw instruments such as ethical charters, government guidelines, and sectoral toolkits. At federal level, the UAE Cabinet approved the country’s official “UAE’s International Stance on Artificial Intelligence Policy” in October 2024 (policy document dated 1 September 2024), which sets out nonbinding principles on fairness, accountability, transparency, human rights, and safety to guide AI deployments at home and abroad. Complementing these, the UAE National Programme for Artificial Intelligence launched a “Deepfake Guide” in July 2021 under the UAE Council for Digital Wellbeing, aimed at raising public awareness of both the beneficial and harmful uses of deepfake technologies and offering practical tips on detection and response.

As generative AI continues to advance, businesses, platforms, and individuals operating in the UAE should proactively assess legal exposure, strengthen compliance measures, and adopt internal safeguards when deploying or interacting with synthetic media.

How We Can Help

Our firm regularly advises on emerging technology, AI governance, cybercrime, privacy, intellectual property, and regulatory risk across the UAE and the wider region. Please do not hesitate to reach out should you require any assistance or further information.