Deepfakes Are a Board Problem, Not an IT Problem
From January 2026, UK boards must declare on the effectiveness of internal controls including deepfake schemes. Most are still routing the problem to IT.
One day. One office. Hong Kong, January 2024. The case became public mid-2024.
A finance employee at Arup, the London engineering firm of 18,500 staff behind the Sydney Opera House and Beijing’s Bird’s Nest, received an email from the CFO in London about a “confidential transaction.” The employee was suspicious. He had the right instincts. The email looked like phishing.
Then came an invitation to a video conference. On the call were the CFO and several colleagues from different departments. They looked exactly like themselves. They addressed him by name. They confirmed the instructions from the email.
Fifteen transfers. Five Hong Kong bank accounts. HKD 200 million, around $25.6 million, in one day. None of the internal controls fired, because every control assumed that the person on the video call was a person.
Everyone on the call, except the employee himself, was AI-generated.
Arup’s Chief Information Officer Rob Greig later described the attack as “technology-enhanced social engineering.” The phrase matters. It was not a cyber breach. It was a coordination failure that used technology as the entry method.
This essay is about what category that puts the problem into.
The numbers boards should be looking at
The volume. DeepStrike’s 2025 tracking estimates around 500,000 deepfakes on social media in 2023 and more than 8 million by 2025. Voice cloning fraud rose 680% in a single year. US corporate deepfake fraud reached $1.1 billion in 2025, roughly three times the $360 million seen in 2024. Deloitte and others project AI-enabled fraud losses approaching $40 billion by 2027.
The readiness. A 2025 survey of corporate executives found 32% considered their organisation prepared to handle a deepfake incident. Gartner’s 2025 cybersecurity leader survey reported 43% had encountered an audio deepfake in the past year and 37% had encountered a video deepfake.
Recent public incidents are no longer anomalies.
January 2026, Bombay Stock Exchange issued an urgent warning after a deepfake of its CEO began promoting fraudulent stock tips. November 2025, a deepfake of Warren Buffett on TikTok promoted a crypto giveaway scam; one impostor channel gathered 17,000 followers before Berkshire could react. December 2025, a synthetic image of a collapsed UK bridge after an earthquake circulated widely enough that rail services were cancelled. October 2025, an AI-generated livestream impersonating Jensen Huang during the NVIDIA GTC keynote peaked at 95,000 concurrent viewers; the official NVIDIA broadcast peaked at 12,000. The fake livestream had a larger audience than the real one.
Detection lags creation. Top AI classifiers lose up to 50% of their accuracy on real-world deepfake videos in lab tests. High-quality deepfakes fool human observers more than half the time. The asymmetry is permanent: generation models improve continuously, detection models react. By the time a detector recognises a pattern, generation has moved on.
The pattern is consistent. The attack doesn’t need to be sophisticated. It needs to be faster than verification.
Why this is not an IT problem
Four reasons, each structural.
No system was breached. Arup’s CIO did not say “we suffered a cyber attack.” He said “technology-enhanced social engineering.” The attack did not pass through the firewall. It passed through a person. No compromised credentials, no network intrusion, no malware. A classically IT-secure company can lose entirely.
The controls belong to other functions. Verification procedures sit in finance and treasury. Brand response sits in communications. Executive communication protocols sit in HR and corporate affairs. Regulatory disclosure sits in compliance. Legal action sits in legal. IT can buy a detection tool. IT cannot design an inter-functional response. Coordination is the control. IT does not coordinate.
The speed is mismatched. Classic IT incident response operates in hours and days. Detect, contain, eradicate, recover. A deepfake attack operates in minutes for the financial transfer and in hours for viral spread on social platforms. By the time the IT team has opened an incident ticket, the money has cleared its sixth banking jurisdiction and the video is on TikTok.
The regulator has already made the choice. This is the most important point and the one most boards have not absorbed.
The UK has explicitly moved the risk up to the board.
The Economic Crime and Corporate Transparency Act 2023 came into full force in September 2025 with a “failure to prevent fraud” offence for large firms, unlimited fines, and an expanded senior manager liability regime. The Act applies to any large organisation regardless of where it is headquartered, provided it has a UK nexus. The defence available is the existence of “reasonable fraud prevention procedures.” A board that cannot describe its procedures specifically against synthetic-media-enabled fraud has a weak defence in 2027 if a case arises. Deepfake-enabled fraud sits squarely inside the fraud perimeter.
Provision 29 of the UK Corporate Governance Code 2024 takes effect for accounting periods beginning on or after 1 January 2026, with first disclosures landing in annual reports in early 2027. The board must declare the effectiveness of material controls as at the balance sheet date. Controls span financial, operational, reporting and compliance domains. If a material control did not operate effectively, the board must explain why and what is being done. The declaration is in the board’s name.
Two further regulatory developments compound the UK position. The EU AI Act in force imposes transparency requirements on deepfake content. The US TAKE IT DOWN Act comes into effect on 19 May 2026, criminalising knowing publication of intimate digital forgeries. India’s IT Amendment Rules took effect 20 February 2026 with mandatory labelling and tightened takedown timelines. The regulatory direction is one-way.
The regulator is not asking the board whether IT has deepfake detection. The regulator is asking the board whether it declares its material controls effective, including against the social engineering and synthetic media attack vectors documented every quarter since Arup. Moving accountability from IT to the board is not a recommendation. It is the law from January 2026.
Five questions the risk committee should be asking this quarter
These are not “boards should do better.” They are the specific questions an audit or risk committee should be putting to management between now and Q3 2026.
One. What is our maximum verification latency for high-value transactions? Arup lost $25 million in a single day. A mandatory 24-hour cooling period with independent-channel callback on a verified number, not a video call, for any transaction above a defined threshold, would have stopped the attack. The control does not require AI detection. It requires a process.
Two. Who owns the deepfake response playbook, and when was it last tested? Most companies do not have one. Those that do have rarely tested it. A simulated deepfake attack in a tabletop exercise, run once a year, exposes coordination gaps before an actual incident does. If the board cannot name the playbook owner and the date of the last test, the playbook is notional.
Three. How exposed are our executives in terms of voice and video material? A CEO who speaks frequently at conferences, gives interviews, and presents at webinars is materially more exposed than one who keeps a low public profile. This is not a call for executives to go silent. It is a question about whether the board has mapped public exposure to attack surface. Most have not.
Four. What is our crisis communications response time for a viral deepfake of our CEO? Berkshire responded quickly to the Buffett fakes because Berkshire has resources to do so. Most companies will not respond for hours, sometimes days. The SEC standard for material event disclosure is four business days. Viral spread runs in hours. The process loses structurally if the board has not set a faster internal threshold. The board should know who clears the corrective statement, on what authority, through what channel, and within what time window from detection. If the answer involves multiple sign-offs across legal, comms and investor relations, the response time is too long.
Five. Does our cyber insurance cover synthetic media fraud, or is there an AI exclusion? This is a specific question boards rarely ask. Some policies include synthetic media endorsements. Some are adding AI exclusion clauses. Hunton Andrews Kurth has tracked the “continued proliferation” of AI exclusions in 2025 policy renewals. A board that reviews insurance coverage annually without putting this specific question to the broker has a gap. The same question applies to crime policies, professional indemnity, and D&O coverage. Each of these may respond differently to a deepfake-enabled loss. The board should know which policy responds and which excludes, before the incident, not after.
None of these five questions requires the directors to be AI experts. All five are questions about process ownership, response time, and coverage. Classic governance questions.
Closing
From 1 January 2026, UK boards declare on the effectiveness of material controls. From the same date, deepfake fraud is no longer an exotic risk. It is a documented attack vector with public case studies, regulatory scope, and unlimited fines for failure to prevent.
The CEO’s face used to be an asset. It is now also an attack surface.
Deepfakes are not a technology problem masquerading as a governance problem. They are a governance problem disguised by technology. The boards that learn to ask this quarter’s five questions will sign the 2027 declaration with evidence. The boards that delegate to IT will sign it on faith.
Sources:
CNN Business, “Hong Kong Arup fraud worker tricked into transferring $25 million” (May 2024)
Fortune, “Arup CFO deepfake scam” coverage (May 2024)
World Economic Forum, interview with Rob Greig, Arup CIO (February 2025)
DeepStrike, 2025 Synthetic Media Volume Report
Gartner, 2025 Cybersecurity Leader Survey
Bombay Stock Exchange notice, deepfake CEO advisory (January 2026)
UK Economic Crime and Corporate Transparency Act 2023, https://www.legislation.gov.uk/ukpga/2023/56
UK Corporate Governance Code 2024, FRC, Provision 29
Corporate Compliance Insights, K2 Integrity analysis on Provision 29 scope (2025)
Hunton Andrews Kurth memo on AI exclusions in cyber insurance (2025)
D&O Diary, Kevin LaCroix, “The Growing Threat of AI Deepfake Attacks” (29 August 2025)
EU AI Act, deepfake transparency requirements
TAKE IT DOWN Act (US), effective 19 May 2026
India IT Amendment Rules 2026, effective 20 February 2026
Internal references in The Governance Gap series and INTA arc:
“IP as Infrastructure, Not Legal” (May 2026): on the misclassification of intangibles, including CEO identity as a value asset
The Governance Gap, Part 4 (”The Information Gap”): on the delay between information existing and information reaching the board
The Governance Gap, Part 11 (”AI in the Boardroom Without Understanding”): on AI as a new risk category boards are not equipped to evaluate