If One Pillar Falls, the Whole Thing Wobbles.

The image shows the surviving columns of the Temple of Zeus at Ancient Nemea, once at the heart of the Panhellenic Nemean Games. The temple dates to the late 4th century BC.

Could my first blog post have been about almost anything? Yes. Was I realistically going to start anywhere other than with the topic I spent years writing a PhD about? Probably not. A thesis is a very strange way to have a conversation: you spend years thinking about a problem, write hundreds of pages about it, and then discover that you still have more to say.

Since 2 August 2026, Article 50's transparency obligations have applied to providers and deployers of certain AI systems. Among other things, relevant providers must make AI-generated or manipulated content detectable through machine-readable marking, while deployers must disclose deepfakes in the circumstances covered by the Act. There is a lot to unpack here: what sufficient disclosure looks like, how these obligations will work in practice, and how responsibility will be divided. I am not going to do that in this post. Article 50 deserves one of its own, and this blog post hopefully is going to be one of the many on the topic.

What interests me here is the larger question behind it: what is the solution to combat malicious uses of deepfakes? Somewhere along the way, we have started searching for the solution in regulation, detection, watermarking, provenance, platform moderation, and media literacy.

I do not think any of them is the answer. Not because they are misguided, but because none can carry the weight alone.

This post takes inspiration from Chapter 7 of my PhD thesis, where I proposed a four-pillar approach to addressing the malicious use of deepfakes. Now you can understand the reasoning behind choosing a photo I took in Nemea. I admit, the connection is not exactly difficult to spot, so there is no need to spend too much time trying to decode the puzzle. The image of pillars, though, feels particularly fitting here: a structure remains standing not because one column is exceptionally strong, but because the weight is shared. Simple? Yes. So why not do the same with deepfakes?

We have been solving a multidimensional problem one piece at a time

The response to deepfakes is often very fragmented. Lawyers understandably look to law. Technologists work on detection. Platforms develop content policies. Governments legislate nationally. Researchers focus on particular harms. Many of those efforts are valuable, but deepfakes do not belong to one discipline, and I am not the first person to say that.

They are not exclusively a technology problem: their consequences concern, amongst others, privacy, reputation, fraud, democratic processes, justice and individual rights. They are not exclusively a legal problem: legislation cannot authenticate a video. Nor are they only a misinformation problem: malicious uses range from impersonation and fraud to non-consensual pornography, while deepfakes can also be used to recreate deceased loved ones.

Now, if the challenges are interdisciplinary and fragmentation is the problem, can there even be a single solution? That is why I organise the response around four pillars: each addresses a different part of the problem, and if one is removed, the structure starts to wobble.

Pillar 1: Regulation (necessary, but it cannot do the job alone)

The instinctive response to a harmful technology is often to regulate it. And regulation is necessary. Law can define prohibited conduct, assign responsibility, protect victims and provide enforcement and redress.

But technology moves quickly, and law generally does not. That is why the relationship between hard and soft law also matters. Hard law provides enforceability and clear legal boundaries, while soft law offers flexibility and can respond more quickly at the time when binding rules are still developing. Neither is sufficient by itself. The stronger approach is to treat them as complementary.

Article 50 now offers a contemporary example of that interaction. Its transparency obligations are legally binding, while the EU's Code of Practice on Transparency of AI-Generated Content is voluntary and intended to help providers and deployers comply. The Commission concluded in July 2026 that the Code adequately covers the relevant Article 50 obligations, while also making clear that signing it is not conclusive evidence of legal compliance. I promised not to turn this into an Article 50 post, so I will stop there.

The important point is even simpler: even good regulation (combined with soft law) cannot tell us whether every audio clip, photograph or video circulating online is authentic. Law can define what is prohibited, establish responsibility and provide remedies when harm occurs, but it cannot, by itself, determine whether the content in front of us has been manipulated. For that, we need another part of the response: technology.

Pillar 2: Detection (matters, but we cannot detect our way out of the problem)

Detection is the most obvious technological response. If AI can create deepfakes, can AI also identify them? We should continue trying. Detection tools can flag suspicious material, support investigations and help platforms and users make more informed decisions.

But detection has limits. The technology producing deepfakes is developing at the same time as the technology trying to identify it. As one side becomes more sophisticated, the other is forced to catch up. The finish line keeps moving. Then there is the liar's dividend: once convincing deepfakes are known to exist, genuine material can also be dismissed as fake. The problem therefore cuts in two directions. We are not only dealing with people believing things that never happened, but also with people refusing to believe things that did.

That does not make detection ineffective. Quite the opposite: it remains indispensable. But it must be continuously developed and integrated into a wider system rather than treated as the answer. That leads to a different question. Instead of only asking how we identify what is fake, we should also ask how we know what is real, and this leads us to Pillar 3.

Pillar 3: Provenance (changes the question)

Detection starts with suspicious content and asks whether it has been manipulated. Provenance begins further upstream: where did this content come from, who created or published it, and has it been altered? Can some form of digital history travel with it?

Provenance can be understood as a foundation for regaining trust in information because it changes where we place the burden of verification. Much of the current conversation still tells the user to look carefully, check the face, listen to the voice, find the source and verify before sharing. There is value in that, but it is unrealistic to build an information system in which every person is expected to become their own digital forensic investigator.

Provenance offers another possibility: creators and publishers can attach information about origin and modification from the beginning. Trust, in other words, can be built into the chain rather than reconstructed after the fact. That does not mean provenance certifies truth. An authentic image can still be miscaptioned, stripped of context or used deceptively. What provenance can help establish is something narrower but crucial: where content came from and what has happened to it along the way. We are already seeing broader moves in this direction. In July 2026, C2PA announced that TikTok had joined its Steering Committee after implementing Content Credentials, with the aim of helping scale provenance standards across major platforms. More recently, in September 2026, Apple announced Apple Reference Image, an opt-in feature for its new iPhones designed to create securely timestamped, verifiable photographs. Apple says the system can provide assurance that a reference image is a real photograph captured by a real iPhone camera sensor at a particular time, and describes it as setting “a new standard for verifiable digital photography.”

But the central difficulty remains the same. Provenance only works at scale if it is adopted at scale. A strong authentication standard used by a small number of organisations does not create a trusted information environment. Creators, publishers and platforms have to participate; standards need to work together; and users need to understand what the signals mean. Without coordinated adoption, provenance remains fragmented even within its own pillar.

Pillar 4: The part of the solution that is not really about technology

I called the fourth pillar acceptance, awareness and collaboration. By acceptance, I do not mean accepting malicious deepfakes. I mean accepting that the technology exists and that the task is to reduce its harms rather than pretend we can eliminate it. Otherwise, we cannot build a serious response.

That requires awareness. People need to understand what deepfakes can do and how to think about sources and authenticity. Media literacy matters. But awareness cannot become an excuse for institutional failure. At some point, telling people simply to get better at spotting deepfakes becomes a way of shifting responsibility onto individuals.

Governments cannot outsource the problem to citizens. Platforms cannot solve it with a warning buried in their terms of service. Technology companies cannot build the tools and leave everyone else to deal with the consequences. And governments cannot legislate and consider the matter finished.

This is why collaboration may be the most important word in the fourth pillar. Legal and technological measures cannot protect the information environment without public awareness and cooperation across sectors. Collaboration is not an optional addition to the framework; it is what allows the other pillars to function together.

The “or” is the problem

We keep talking about these responses as alternatives. Regulation or detection. Labelling or provenance. Better technology or better media literacy. I think the “or” is the problem.

We need regulation and adaptable governance; detection and provenance; technology and awareness; national responses and international collaboration. Law without detection may prohibit conduct without giving us the means to identify it. Detection without law can tell us content is manipulated without answering what responsibility follows. Provenance without adoption creates isolated pockets of authenticated content. Awareness without institutional safeguards places too much responsibility on individuals.

That is why removing any one of the four pillars significantly weakens our ability to respond. Malicious deepfakes are not solely a legal or technological problem. They are a societal problem requiring coordination and shared responsibility.

Perhaps the real question is trust

The more I worked on this subject, the less I thought the deepest problem was simply fake content. Fake information is not new. Manipulated images are not new. Political propaganda is certainly not new. What is different is what happens when sophisticated deepfakes meet an information environment that is already personalised, fragmented and increasingly difficult to navigate.

This is where the idea of personalised truth matters. By this, I mean an information environment in which algorithmic curation and increasingly individualised information streams can leave different people inhabiting very different versions of reality. The concern is not only that somebody can manufacture something false and persuade us that it is real. It is that people increasingly encounter different informational realities in the first place. Deepfakes enter that environment and complicate something more fundamental: our ability to establish what we can trust.

A fake can be presented as real. A real recording can be dismissed as fake. Uncertainty itself becomes useful. So perhaps “How do we stop deepfakes?” was never quite the right question. A better one is: how do we preserve trust in an information environment in which what we see and hear can be fabricated - and authentic material can be challenged as fabricated?

There will not be one perfect detector, one piece of legislation, one watermark, one platform policy or one media-literacy campaign that resolves this. That is precisely the point of the four pillars. The solution is not one of them. It is the architecture created when they work together. Perhaps that is also why this answer might be less appealing. Complexity is harder to communicate and certainly harder to sell than a single technological or legal fix. But a multidimensional problem is unlikely to yield to a one-dimensional solution.

P.S. AI tools were used to assist with editing and refining this post.