AI Content Authenticity: Deepfakes and Synthetic Media Compliance in Australia

Your CEO receives a video message from the CFO authorising an urgent $2.5 million transfer. It’s authentic-looking, sounds right, and appears credible—except it’s not real. This is no longer fiction. In 2024, Australian businesses lost AU$37 million to a single deepfake fraud scam using executive impersonation. Deepfakes and synthetic media powered by generative AI are advancing faster than regulation, creating unprecedented compliance risks for Australian organisations.

If your business creates, hosts, or distributes content, you need a deepfake compliance strategy now. Australia’s legal framework is crystallising quickly, with federal Criminal Code amendments, state legislation, defamation law, and electoral integrity protections all converging on synthetic media. This guide walks you through your legal obligations, the risks of misuse, how to detect synthetic content, and the governance structures organisations must build to stay compliant.

What Are Deepfakes and Synthetic Media?

Deepfakes are digitally manipulated images, videos, or audio created or altered using machine learning, typically generative adversarial networks (GANs) or diffusion models, to depict someone saying or doing something they never did. Synthetic media is the broader category: any content—images, video, audio, or text—generated or substantially modified by AI to appear authentic.

The technology itself is neutral. Synthetic media powers legitimate applications: film production, accessibility tools, medical imaging, and virtual assistance. The harm comes when deepfakes or synthetic media deceive audiences, bypass consent, or facilitate fraud, defamation, or electoral interference. For organisations, the compliance question is straightforward: are you creating, hosting, or profiting from synthetic media that could breach Australian law?

Australia’s Legal Landscape: Criminal Code, Defamation, and Electoral Integrity

Federal Criminal Code Amendment (Deepfake Sexual Material) Act 2024

Australia’s primary deepfake criminal law commenced 3 September 2024. The Criminal Code Amendment targets non-consensual distribution of sexually explicit deepfake material—images or videos created or altered to depict someone in sexual content without consent. The offence carries a maximum penalty of six years imprisonment for primary offenders. Aggravated offences—for those who created the material or had prior civil penalties under the Online Safety Act 2021—carry up to 10 years.

Critically, the law applies to the distributor, not just the creator. If your platform hosts or permits distribution of non-consensual sexually explicit deepfakes, you face liability. The Act includes narrow defences: a reasonable person would consider transmission acceptable given the content nature, relationship, privacy impact, and vulnerability of the depicted person.

State-Level Legislation: South Australia’s Lead

South Australia passed nation-leading laws in 2024 criminalising the creation of invasive, humiliating, or degrading synthetic images or videos—not limited to sexual content. Penalties reach AU$20,000 or four years imprisonment. This signals a widening regulatory net beyond sexual material to include political, professional, and reputational harm. Other states are expected to follow.

Defamation Law and Electoral Integrity

Australia’s defamation framework (Defamation Act 2005 and state equivalents) applies fully to synthetic media. Publishing a deepfake that lowers someone’s reputation in the community is defamation, regardless of technology. Electoral integrity laws—particularly those protecting Commonwealth, state, and local elections—criminalise spreading inaccurate or misleading information that damages election integrity. A coordinated deepfake campaign targeting candidates or electoral processes could trigger both electoral and defamation liability.

Mandatory statement requirements under the Electoral Act 2022 (Cth) require digital platforms and advertisers to disclose synthetic media in political advertising with prominence and clarity—a compliance obligation that extends to organisations commissioning or hosting election-related content.

Modern Slavery Act and Supply Chain Synthetic Media Risk

Australia’s Modern Slavery Act 2018, which applies to entities with annual consolidated revenue above AU$100 million, requires assessment and disclosure of modern slavery risks across global operations and supply chains. AI tools and synthetic media create emerging risks: biometric data collection in supply chain monitoring, algorithmic labour exploitation in gig economy platforms, and opacity in AI-driven supplier surveillance. Organisations must describe in their annual Modern Slavery Statement how they assess these AI-enabled risks.

Business Use vs Misuse: Drawing the Compliance Line

Most organisations deploying synthetic media face a simple question: are we transparent and consensual, or deceptive and non-consensual? The dividing line is authenticity and consent. Using AI to generate product mockups for internal marketing? Compliant. Generating a deepfake of a competitor’s CEO making inflammatory statements and circulating it? Criminal. Synthetic avatars for customer service with clear disclosure? Compliant. Deepfake impersonation of a regulator to collect data? Fraud and potentially criminal.

Think of synthetic media compliance like pharmaceutical labelling: the product itself may be safe, but transparency and intent matter. A paracetamol label must disclose active ingredients, uses, and risks. Similarly, synthetic media should disclose its AI origin, the tools used, intended use, and consent status. Where consent is absent and intent is deceptive—fraud, defamation, non-consensual sexual material—the law steps in.

Compliance Obligations for Organisations Creating or Hosting Synthetic Media

Detection and Disclosure

Organisations hosting user-generated content must implement detection systems to identify non-consensual synthetic sexual material, particularly deepfakes. The Online Safety Act 2021 (Cth) already mandates this for sexual abuse material. For broader synthetic media, the eSafety Commissioner’s guidance emphasises that detection tools are lagging behind creation tools—but organisations cannot rely on detection failure as a defence if they knowingly host or distribute harmful synthetic content.

If your organisation commissions or creates synthetic media, disclose its synthetic nature clearly to all audiences. In electoral advertising, disclosure is mandatory. In commercial content, disclosure builds trust and mitigates defamation and consumer protection liability.

Policy Development and Governance

Your organisation should adopt a synthetic media policy covering:

• Creation scope: What synthetic media is permitted internally? When must you seek consent from depicted individuals?
• Consent requirements: Define when synthetic depictions of real people require explicit written consent.
• Disclosure standards: How and where must synthetic media be labelled as AI-generated?
• Harmful use prohibition: Explicitly ban creation or distribution of deepfakes for fraud, defamation, non-consensual sexual material, electoral interference, or modern slavery exploitation.
• Vendor management: If you contract with AI providers or creative agencies, include contractual protections requiring synthetic media compliance.
• Audit and escalation: Who reviews synthetic media before publication? What escalation triggers legal or compliance review?

Privacy Act Compliance

From 10 December 2026, Australia’s Privacy Act will require transparency about automated decision-making affecting individuals’ rights. If your synthetic media generation or deployment uses personal data (biometric data, identity information, behavioural data), you must disclose this in your privacy policy. The Office of the Australian Information Commissioner (OAIC) has published detailed guidance clarifying that AI and algorithmic systems fall within the Act’s scope.

Detection Tools and Best Practice

Detection technologies include:

• Facial forensics: Tools like MediaForensics and Forensic Similarity Networks detect artefacts in facial manipulation.
• Audio forensics: Specialized analysis identifies voice synthesis patterns and artifacts.
• Digital provenance: Blockchain-based tagging systems embed authenticity metadata into content at creation.
• Human review: For high-stakes content (regulatory, electoral, financial), human expert review remains essential.

However, detection is an ongoing arms race. The eSafety Commissioner’s 2024 position statement notes that open-source creation tools proliferate online, often free and easy to use, while detection lags significantly behind. Organisations should assume detection tools will fail and design governance accordingly: prohibit harmful use at source, require disclosure, and implement escalation processes for suspicious content.

Frequently Asked Questions

Q1: If someone creates a deepfake on my platform without my knowledge, am I liable?

Potentially yes, under the Criminal Code and state legislation. The law applies to distributors as well as creators. You have a defence if you can demonstrate you took reasonable steps to detect and remove the material, complied with removal notices from the eSafety Commissioner, and acted expeditiously once notified. This is why hosting policies and detection systems matter: they demonstrate reasonable care.

Q2: Can I use synthetic media in advertising if I disclose it clearly?

For commercial advertising, yes—disclosure typically suffices. For electoral advertising, disclosure is mandatory and must be prominent. For content depicting real people in scenarios that could damage their reputation, obtain explicit written consent even if disclosing synthetic nature. Defamation law protects reputation independent of whether content is synthetic; disclosure doesn’t eliminate liability if the synthetic depiction defames someone.

Q3: What should our Modern Slavery Statement say about synthetic media risks?

Describe how your organisation assesses AI-driven risks in supply chain transparency, labour practices, and data collection. If you use biometric scanning, algorithmic worker scheduling, or AI-driven supplier monitoring, assess and disclose modern slavery risks associated with those tools. If you don’t currently assess these risks, state that and outline your plan to do so.

The Editorial View: Compliance as Competitive Advantage

Many organisations view deepfake and synthetic media compliance as regulatory burden. But in a world of declining trust in digital content, authenticity is becoming competitive advantage. Organisations that build transparent, policy-driven synthetic media practices signal maturity to regulators, customers, and investors. Those that remain silent until scandal hits face criminal liability, reputational damage, and loss of trust. The organisations winning in 2026 are not those avoiding synthetic media—they’re those deploying it responsibly with governance that matches the technology’s power.

Take Action: Build Your Deepfake Compliance Framework

Deepfakes and synthetic media are reshaping content authenticity and trust. Your compliance obligation is clear: assess your organisation’s exposure, implement detection and governance, disclose synthetic content transparently, and prohibit harmful use. Australian law is tightening, and regulators are watching. If your organisation creates, hosts, or distributes synthetic media, you need a compliance strategy aligned with the Criminal Code, state legislation, defamation law, electoral requirements, and Privacy Act obligations.

Anitech helps Australian organisations navigate AI compliance, from policy development to audit and governance. We work with boards, legal teams, and product leaders to build frameworks that keep your organisation on the right side of deepfake and synthetic media law. Contact us to discuss your synthetic media compliance strategy.