Artificial intelligence is making it easier than ever to create realistic images, videos and voice recordings. While these technologies offer new opportunities for businesses, they also create serious legal and reputational risks. AI-generated deepfakes can imitate company executives, manipulate customer communications, spread misleading information and damage personal or corporate reputations.
In Thailand, businesses must understand how existing laws apply to these emerging threats. From the Personal Data Protection Act (PDPA) to the Computer Crime Act and criminal defamation provisions, several legal frameworks may become relevant when AI-generated content is used without permission or for fraudulent purposes.
As Thailand continues developing its artificial intelligence regulatory framework, companies should take proactive steps to protect their identities, information and digital assets.
What Are AI Deepfakes and Identity Fraud?
Deepfakes are digitally generated or manipulated images, videos or audio recordings designed to make someone appear to say or do something that never happened.
Using artificial intelligence, individuals can reproduce another person’s voice, create convincing video appearances or manipulate existing photographs.
Common examples include:
- Executive impersonation: Fraudsters use cloned voices or videos to impersonate company directors and request urgent payments or confidential information.
- Customer identity fraud: Criminals imitate customers or employees to gain access to accounts, financial information or internal systems.
- Fake endorsements: AI-generated videos make it appear that a public figure or business representative is promoting a product or service without authorization.
- Reputation attacks: Manipulated images, recordings or videos are distributed to damage an individual’s or company’s reputation.
- Social engineering: Fraudsters use synthetic identities to establish trust with employees, suppliers or customers before requesting money or sensitive information.
These incidents are not simply technological problems. Depending on the circumstances, they can involve fraud, unauthorized personal data processing, computer-related offences and defamation.
How Thai Law Applies to AI Deepfakes
Although Thailand is developing a more comprehensive framework for artificial intelligence, existing legislation already provides several legal protections against certain forms of misuse.
The Computer Crime Act
Thailand’s Computer-Related Crime Act B.E. 2550 (2007), as amended in 2017, addresses several forms of unlawful activity involving computer systems and digital information.
Section 16 is particularly relevant to manipulated images. It addresses the introduction into publicly accessible computer systems of electronically created, edited or modified images of another person in circumstances likely to cause defamation, insult, hatred or embarrassment.
The provision carries a maximum penalty of three years’ imprisonment and a fine of up to THB 200,000.
However, Section 16 specifically concerns images. Other forms of AI impersonation, including fabricated audio, must be assessed under the applicable legal provisions rather than automatically treated as offences under this section.
Criminal Defamation Under the Thai Criminal Code
AI-generated content may also create criminal defamation risks.
Under Sections 326–328 of the Thai Criminal Code, publishing false or damaging statements about another person may result in criminal liability when the legal elements of defamation are satisfied.
For example, distributing a manipulated video that falsely attributes damaging statements to a company director could raise defamation concerns.
The legal assessment depends on the content, the circumstances of publication, the intention involved and the available evidence.
Thailand’s Personal Data Protection Act (PDPA)
The PDPA may apply when deepfake creation or distribution involves identifiable personal information.
A person’s photograph, voice recording, name or other identifying information may constitute personal data when it relates to an identifiable individual.
Additional requirements may apply when biometric information is technically processed for the purpose of uniquely identifying an individual, as this can constitute sensitive personal data under the PDPA.
Businesses should therefore examine:
- Whether personal data was collected or used lawfully.
- Whether an appropriate legal basis exists for processing.
- Whether personal data was disclosed to unauthorized parties.
- Whether appropriate security measures were implemented.
- Whether a personal data breach has occurred and notification obligations apply.
Using publicly available photographs or recordings does not automatically give a business permission to use them for every purpose.
Thailand’s Proposed AI Act: What Businesses Should Know
Thailand is also moving towards a more comprehensive regulatory framework for artificial intelligence.
On 9 July 2026, the Electronic Transactions Development Agency (ETDA) released a Draft Artificial Intelligence Act for public consultation.
The proposed framework introduces a risk-based approach to AI regulation, including transparency obligations for certain AI-generated or modified content, such as deepfakes.
Depending on the final legislation, developers, providers, deployers and platform operators may face additional responsibilities relating to risk assessment, transparency, documentation and risk management.
For businesses, this development is important because AI compliance may become a broader operational responsibility rather than simply an IT or cybersecurity concern.
However, the proposed AI Act should not be confused with legislation currently in force. Its provisions remain subject to the legislative process and may change.
Companies should monitor regulatory developments while continuing to comply with existing Thai laws.
The Business Risks of AI Identity Fraud
Deepfake-related incidents can affect businesses in several ways.
Financial losses
An employee may receive a convincing voice message appearing to come from a senior executive requesting an urgent bank transfer. Without proper verification procedures, the company could transfer funds to a fraudulent account.
Reputational damage
Fake videos or manipulated recordings can create misleading impressions about a company, its management or its products. Even when the content is eventually identified as fraudulent, reputational damage may remain.
Personal data exposure
The unauthorized collection, use or disclosure of employee and customer information may create PDPA compliance risks.
Contractual and operational disputes
AI impersonation can affect supplier communications, payment instructions, digital agreements and other business transactions. Companies may need to investigate whether communications were authentic and whether contractual obligations were properly authorized.
Loss of customer confidence
Customers may become reluctant to share information or conduct transactions with businesses that fail to protect their identities and digital communications.
How Businesses Can Protect Themselves Against Deepfake Fraud
Companies should adopt preventive measures that combine technology, internal procedures and legal oversight.
Establish Identity Verification Procedures
Do not rely exclusively on voice messages, video calls or email instructions when authorizing financial transactions or sharing confidential information.
Introduce independent verification procedures, such as calling the requester through a previously verified telephone number or requiring approval through an established internal system.
Create an AI and Digital Impersonation Policy
Develop internal guidelines covering the acceptable use of AI-generated content, employee identity protection and the handling of suspected impersonation incidents.
The policy should clearly identify who is authorized to approve public communications and financial instructions.
Protect Personal and Confidential Information
Review how employee photographs, voice recordings, customer information and corporate communications are collected, stored and shared.
Apply appropriate access controls, data security measures and retention policies.
Train Employees to Recognize Deepfake Attacks
Employees should understand that familiar voices and realistic videos are not necessarily reliable proof of identity.
Training should include examples of fraudulent payment requests, executive impersonation and suspicious communications.
Prepare an Incident Response Plan
Businesses should establish clear procedures for responding to suspected AI impersonation.
These procedures should include:
- Preserving original recordings, messages, URLs and timestamps.
- Identifying affected individuals and systems.
- Reporting suspicious content to relevant platforms.
- Assessing potential PDPA and cybersecurity obligations.
- Consulting legal professionals when criminal or civil action may be appropriate.
- Communicating with affected customers, employees and business partners.
Early evidence preservation is particularly important because online content can be modified, deleted or redistributed.
What Should Businesses Do If They Become Victims of a Deepfake Attack?
When a company discovers that someone is impersonating its executives, employees or brand, it should respond quickly but carefully.
First, preserve available evidence before requesting content removal. Screenshots, original files, URLs, account information and communication records may become important during an investigation.
Second, assess the nature of the incident. A fraudulent financial request, a manipulated photograph and a defamatory video may involve different legal considerations.
Third, report the content to the relevant platform and consider contacting the appropriate Thai authorities where criminal activity is suspected.
Finally, obtain legal advice to evaluate potential claims, regulatory obligations and appropriate remedies.
Businesses should avoid making unsupported public accusations or distributing manipulated content further when responding to an incident.
Why Legal Preparation Matters in Thailand’s AI Economy
Artificial intelligence is becoming increasingly integrated into business operations, marketing, customer service and corporate communications.
While these technologies can improve efficiency, they also introduce risks that traditional security procedures may not adequately address.
Companies operating in Thailand should therefore review their existing data protection policies, cybersecurity procedures, employee training and contractual safeguards.
They should also monitor the development of Thailand’s proposed AI legislation to understand how future regulatory obligations may affect their operations.
Preparing in advance can help businesses reduce exposure to fraud, protect their reputation and respond more effectively when digital identity misuse occurs.
Conclusion
AI deepfakes and identity fraud represent growing challenges for businesses operating in Thailand. Although the country is still developing its dedicated AI regulatory framework, existing laws already provide potential legal remedies against certain forms of digital manipulation, unauthorized personal data processing and online defamation.
Businesses should not wait for comprehensive AI legislation before addressing these risks. Implementing identity verification procedures, strengthening data protection, training employees and preparing incident response plans are essential steps towards a safer digital environment.
Pimlegal helps businesses navigate digital law, data protection, cybersecurity and online reputation risks in Thailand. Professional legal guidance can help organizations assess potential liabilities and develop appropriate strategies to protect their digital operations.