Languages: Polski | English | Русский
Modern technology makes it possible to create a video, voice recording or photograph that may be virtually indistinguishable from authentic material. A deepfake may depict a person saying something they never said, participating in a fictitious event or supposedly requesting an urgent transfer of money.
As at 28 July 2026, the Polish Criminal Code does not contain one general offence consisting solely in creating or distributing a deepfake. This does not mean that such conduct is lawful. Criminal classification depends on the perpetrator’s purpose, the content of the material, the manner in which it was used and the consequences for the victim. The President of the Polish Data Protection Office has stated that the existing protection remains fragmented and does not directly address all aspects of deepfake technology.
Creating a deepfake is not always a criminal offence
Not every generated or manipulated item of content automatically constitutes an offence. A clearly labelled parody must be assessed differently from a realistic recording used to obtain money, destroy a person’s reputation or initiate false criminal proceedings.
The same material may satisfy the elements of several offences. For example, a false video may amount to impersonation and defamation while also being used as part of fraud or blackmail.
Impersonation
Article 190a § 2 of the Polish Criminal Code criminalises impersonating another person by using their image, personal data or other data by which that person is publicly identified, where this causes personal or financial harm.
The provision may apply to a deepfake using a recognisable face or voice, provided that all the other statutory elements are met. Technical manipulation alone is insufficient. There must be impersonation and actual personal or financial harm.
The offence is punishable by imprisonment for between six months and eight years. Prosecution requires an application from the victim, which should be expressly included in the criminal complaint. API Sejm
A cloned voice used to obtain money
A cloned voice may be used to impersonate a family member requesting immediate help or a company director ordering an urgent transfer.
Where the perpetrator acts for financial gain, misleads another person and causes that person to make an adverse disposition of property, the conduct may constitute fraud under Article 286 § 1 of the Criminal Code. The offence is punishable by imprisonment for between six months and eight years.
The person whose voice or image was used will not necessarily be the only victim. Depending on the circumstances, the victim may also be the person who transferred the funds, the company from whose account they were transferred or a financial institution. API Sejm
Deepfake blackmail
A perpetrator may threaten to publish an embarrassing but entirely fabricated video unless the victim pays money.
Where a threat to publish information seriously violating privacy or damaging reputation is used to induce another person to dispose of property, the conduct may amount to extortion under Article 282 § 2 of the Criminal Code. The offence is punishable by imprisonment for between one and ten years. API Sejm
Depending on the circumstances, provisions concerning criminal threats, coercion or persistent harassment may also apply.
Defamation
A fabricated recording may falsely portray a person as having committed an offence, being addicted, being unfaithful or conducting business dishonestly. Where the content is capable of humiliating the person in public opinion or exposing them to a loss of confidence required for their profession or business, it may constitute defamation.
Where the deepfake is distributed through the internet or another mass communication medium, Article 212 § 2 permits a sentence of up to one year’s imprisonment. Defamation is generally prosecuted privately, meaning that the victim, rather than the public prosecutor, files and supports the indictment. API Sejm
A deepfake used as evidence
Particularly serious consequences may arise where a deepfake is created in order to initiate criminal proceedings against an innocent person.
Falsely accusing another person before a law-enforcement authority is punishable by imprisonment for between three months and five years. The same penalty applies to a person who fabricates evidence or uses other deceptive measures to direct prosecution against a specified person. API Sejm
Digital material presented as evidence should therefore not be assessed solely by its appearance or sound. Examination of metadata, the source file, transmission history and expert evidence may be required.
Intimate deepfakes
Particularly harmful cases involve placing the victim’s face on a nude body or pornographic material.
Article 191a of the Criminal Code criminalises, among other conduct, distributing without consent the image of a nude person or a person engaged in sexual activity. Its application to entirely synthetic material depicting an adult is not straightforward. The provision does not expressly refer to a “generated or processed” image of an adult. Each case therefore requires an individual assessment, including consideration of impersonation, harassment, coercion and defamation. API Sejm
The protection of minors is more explicit. Article 202 § 4b directly covers the production, distribution, presentation, storage or possession of pornographic content depicting a generated or processed image of a minor participating in sexual activity. The maximum penalty is three years’ imprisonment. API Sejm
Labelling obligations from 2 August 2026
From 2 August 2026, the transparency obligations under Article 50 of the EU Artificial Intelligence Act begin to apply. Deployers of AI systems generating or manipulating images, audio or video constituting a deepfake are required to disclose that the content has been artificially generated or manipulated.
Labelling does not automatically make the content lawful. It does not replace the consent of the person depicted, remove the protection of personal rights or exclude criminal liability for fraud, extortion, harassment or defamation.
What should a victim do?
The content and data that may identify the perpetrator should be secured immediately. The victim should retain the publication address, date and time, account name, profile identifiers, correspondence, original file and any payment information, rather than relying only on screenshots.
Depending on the circumstances, appropriate steps may include reporting the content to the platform, requesting preservation of account data, filing a criminal complaint, expressly requesting prosecution where required, notifying the bank, pursuing civil injunctions and damages, and submitting a complaint to the data protection authority.
Evidence should be preserved before the content or the perpetrator’s account becomes inaccessible.
Law stated as at 28 July 2026.
This article is for general information only and does not constitute legal advice in an individual case.
Author: Radosz Pawlikowski, Attorney-at-Law
Do you need legal assistance?
Briefly describe your case. We will contact you to discuss the possible next steps.