When Digital Evidence Can Be Manufactured

The integrity problem has moved beyond the file itself

The UK Fraud Strategy identifies generative AI's ability to create deepfakes that impersonate trusted people and organisations as a significant threat. It also records government work on a framework for detecting deepfake media, including fraudulent documents and synthetic audio. ¹

That matters because a manipulated item rarely arrives in isolation. A convincing recording may be accompanied by a familiar email thread. A synthetic executive may have a plausible profile, company page and supporting references. A fabricated document may reproduce genuine names, formatting and transaction details.

Integrity question: do not ask only “does this look real?” Ask who created it, where it came from, what independent evidence supports it and what decision depends upon it.

Synthetic identity is broader than a fake face

UK identity-proofing guidance expressly distinguishes an impostor from a synthetic identity and notes that synthetic identities can be wholly fictional or built partly from real information. It recommends checking claimed identities against authoritative counter-fraud sources where the risk warrants it. ²

The FCA's 2026 review of AI and retail financial services similarly identifies deepfakes and synthetic identities as technologies capable of exploiting onboarding and decision-making processes. ¹⁰

For due diligence and investigation, this creates an important distinction. A document can be genuine while the narrative attached to it is false; a real person can be presented with invented employment or ownership claims; and a legitimate company can be used as cover for an impersonated contact.

Detection is evidence, not a verdict

The emergence of dedicated deepfake-detection programmes reflects the seriousness of the problem, but no individual detector should be treated as a complete evidential conclusion. Detection systems can be valuable indicators; the surrounding source chain and external facts still require examination.

That is particularly important where a decision could lead to litigation, payment, reputational action or exclusion of a person. A defensible assessment should preserve the original material, record how it was obtained, compare independent sources and distinguish technical indicators from established facts.

Provenance helps, but it does not prove that a claim is true

The C2PA Content Credentials standard is designed to preserve provenance as digital material changes, allowing information about source and transformations to be cryptographically verified. ⁴ The European Commission's Article 50 guidance also requires machine-readable marking for certain AI-generated or manipulated content and disclosure of deepfakes in defined circumstances. Those transparency obligations apply from 2 August 2026. ³

Provenance is therefore increasingly useful, but it answers a particular question: what can be established about an asset's origin and declared history? It does not automatically establish that every statement depicted or asserted in the asset is factually correct.

Legal material requires particular discipline

The SRA's August 2026 warning notice makes clear that regulated firms remain responsible for AI-assisted legal material and highlights risks including inaccurate outputs, confidentiality failures and inadequate human oversight. ⁵

The Civil Justice Council's 2026 work on AI in court documents identifies witness statements as an area requiring particular attention because AI may reshape or embellish evidence in ways that are not immediately apparent; its June update emphasises preservation of authenticity, integrity and the witness's personal recollection. ⁶

This does not mean AI involvement automatically invalidates evidence. It means the preparation history, source material and human responsibility around consequential evidence may itself become relevant to reliability.

Authoritative language is not the same as factual reliability

The ICO distinguishes data-protection accuracy from the statistical accuracy of an AI system and warns that users may wrongly rely on generative AI where the risk and impact of hallucinated or incorrect outputs are not understood and controlled. ⁹

NIST's Generative AI Profile likewise treats generative AI as a risk-management problem spanning design, development, use and evaluation, rather than something solved by a single test. ⁸

For investigators and decision-makers, the practical implication is straightforward: an AI-generated summary can accelerate review, but material assertions still need traceable source support.

Assurance should match the consequence of the decision

The UK government's third-party AI assurance roadmap describes independent assurance as a means of verifying the quality and trustworthiness of AI systems, especially where organisations lack equivalent in-house capability. It estimates the UK AI assurance market at about £1.01 billion GVA in 2024 and says it could exceed £18.8 billion by 2035 if adoption barriers are addressed. ⁷

That does not mean every organisation needs a full technical model audit. Assurance should be proportionate to use. A low-consequence drafting aid and an AI system influencing onboarding, claims, legal evidence or financial decisions present very different evidential and governance requirements.

A practical digital-integrity framework

1. Preserve. Retain the original material, metadata and route by which it was received where possible.
2. Identify the claim. Separate what the material appears to show from the specific fact that matters to the decision.
3. Trace the source. Establish origin, publication history, associated accounts, domains, people and relevant transformations.
4. Corroborate independently. Test the material claim against reliable records and sources that do not depend on the questioned item.
5. Assess inconsistencies. Record conflicts in identity, chronology, ownership, language, metadata or external facts.
6. Report confidence. Distinguish confirmed facts, source assertions, technical indicators and unresolved questions.

The objective is not to prove that AI was involved at any cost. It is to establish whether the information is sufficiently reliable for the decision in front of the client.