A merger can be damaged by one convincing video, cloned voice message or fabricated executive statement. The risk isn’t limited to a target’s public reputation. Synthetic media can affect payment instructions, customer trust, intellectual property, litigation, regulatory exposure and the value of the deal itself.
This deepfake due diligence checklist for mergers gives buyers a practical way to test those risks before signing or completing a transaction. It covers the target’s people, systems, content rights, fraud controls, incident history and evidence-handling processes.
The legal backdrop is moving quickly. The UK Information Commissioner’s Office published its generative artificial intelligence data protection guidance in 2023, while the National Cyber Security Centre published its AI system development guidance in 2023. Neither document is a merger checklist, but both make one point clear: organisations need to understand how AI is used, governed and secured, rather than treating it as somebody else’s technology problem.
Why deepfake checks belong in merger due diligence
Most transaction teams already examine cyber security, data protection, bribery controls and business continuity. Synthetic-media risk cuts across all four. A target might have weak controls around executive voice messages, employee likenesses, customer verification or third-party video libraries without describing any of those issues as a deepfake risk.
There is also a timing problem. Fraudsters often target transactions because deal teams are busy, information is confidential and senior people may be travelling. A cloned chief executive asking finance staff to change bank details can exploit the authority of the deal and the speed of completion.
Ask a simple question: could a criminal make a believable instruction appear to come from the target’s chief executive, finance director or major shareholder? If the answer is yes, the issue belongs in the deal risk register, not in a future innovation meeting.
Deepfake due diligence checklist for mergers
1. Map people and assets that could be impersonated
- List directors, senior executives, founders, public spokespeople and customer-facing specialists whose faces or voices appear online.
- Record public videos, podcasts, webinars, investor presentations, interviews and voicemail greetings that could supply training material for a clone.
- Identify high-value payment approvers, administrators and staff who can change supplier or payroll details.
- Find branded video, audio, avatar, voice and image assets held by the target or its agencies.
- Check whether former employees, contractors or influencers still have authorised access to those assets.
Do not assume that a small target has a small exposure. A founder-led business may have years of clear speech and video online, plus informal approval processes that make impersonation easier.
2. Test identity and payment controls
- Require a second channel for payment changes, urgent transfers and changes to privileged access.
- Prohibit approval based solely on a voice call, video call, voicemail, email or messaging application.
- Define approved callback numbers and ensure staff do not use contact details supplied in the suspicious message.
- Set transaction limits, dual approvals and cooling-off periods for new beneficiaries.
- Test whether staff know how to challenge a senior person safely.
Include a controlled exercise in the buyer’s diligence programme. A simulated request is more useful than a policy document that nobody has tested. The corporate deepfake incident response plan checklist can help structure the exercise and assign ownership.
3. Review synthetic-media governance
- Ask whether the target uses voice cloning, digital avatars, face replacement, automated dubbing or generative video.
- Request an inventory of approved tools, users, purposes and data uploaded to each platform.
- Check contracts for training rights, retention periods, deletion rights and cross-border transfers.
- Confirm whether generated content is labelled, watermarked or accompanied by provenance information.
- Review human approval requirements for public statements, customer communications and regulated content.
For provenance, ask whether the target preserves Content Credentials or other source records. The practical guide to C2PA metadata verification explains what those records can and cannot prove. The C2PA standard is useful here, but provenance is not the same as truth. A genuine file can still contain a false claim.
What to request from the target
Send a focused information request rather than asking for every artificial intelligence document the target owns. The aim is to establish exposure, control maturity and potential liabilities.
| Area | Documents or evidence to request | Warning signs |
|---|---|---|
| Identity fraud | Payment procedures, callback controls, fraud cases and staff training records | Voice or video accepted as sole approval |
| Media production | Tool register, supplier contracts, prompts, approval logs and published examples | No owner for synthetic content or no usage records |
| Consent and likeness | Talent releases, employee permissions, licence terms and withdrawal processes | Broad informal permissions or unclear expiry dates |
| Security | Access logs, incident reports, vendor assessments and account recovery controls | Shared accounts, weak multi-factor authentication or missing logs |
| Legal and reputation | Complaints, takedown requests, disputes, regulator contact and litigation holds | Unresolved impersonation claims or unexplained deleted content |
Ask for original files, not just screenshots. Preserve file hashes, creation dates, export history and the identity of people who supplied the material. That record may matter if a disputed video becomes evidence in a warranty claim or court proceeding.
Consent, privacy and intellectual property checks
Consent is often the weakest part of a synthetic-media programme. A release allowing a person to appear in a filmed advert does not automatically allow the organisation to create a reusable voice model or digital replica. The wording, purpose, duration, territory and withdrawal process all matter.
Review employee, contractor, actor, customer and celebrity permissions separately. Look for rights to create derivatives, use biometric information, train models and distribute content through third parties. If consent was bundled into a broad employment document, ask whether it was specific enough for the actual use.
Privacy risk deserves its own assessment. Face and voice data may be personal data, and some processing can involve biometric data used for uniquely identifying a person. The buyer should understand the lawful basis, transparency information, retention period, access controls and international transfers before inheriting the target’s programme.
Also check ownership. A target may have paid an agency to produce an avatar or synthetic voice without receiving the underlying model, source files or full commercial rights. That can create a costly gap between what the target thinks it owns and what it can legally continue using after completion.
Detection, provenance and evidence testing
Detection tools are helpful, but they shouldn’t be treated as a courtroom oracle. Compression, editing, poor lighting and platform processing can produce false positives, while a high-quality synthetic clip may evade a particular detector.
Use several checks together:
- Compare the file with trusted versions held by the target, broadcaster or original speaker.
- Review metadata and Content Credentials, while recognising that metadata can be removed or altered.
- Inspect timing, lip movement, reflections, background continuity and unusual speech patterns.
- Check the account, domain, telephone number and distribution path that carried the material.
- Obtain an independent technical assessment for high-value disputes.
Reverse search can also establish whether a clip existed earlier in another context. The guide on reverse video search for synthetic media is useful when a target presents a suspicious clip during diligence.
For important evidence, preserve the original download, URL, timestamps, headers, chain of custody and analyst notes. A detector score without the underlying file and method is weak evidence.
Deal protections and post-completion controls
Translate findings into transaction terms. Depending on the risk, the buyer may need specific representations about undisclosed impersonation incidents, rights to synthetic media, third-party claims, data protection compliance and security controls.
Consider targeted indemnities where ordinary warranties do not reflect the exposure. Set clear thresholds for notification and remediation. If a founder’s likeness is central to the brand, include practical arrangements for access, takedown support and continued consent after completion.
Make remediation a condition to completion when the exposure is immediate. Examples include disabling shared accounts, rotating voice authentication, imposing dual approval for payments, removing unauthorised clones and preserving disputed evidence.
After completion, merge the target into the buyer’s incident process. Train staff to verify unusual requests, monitor high-risk impersonation channels and rehearse who contacts banks, platforms, law enforcement, customers and regulators. The National Cyber Security Centre’s guidance is a sensible reference point for secure AI governance and incident planning.
If a transaction is already under pressure from a suspected impersonation attempt, speak to our team about a focused risk review before relying on the disputed material.
How to score the deepfake risk
Use a simple red, amber and green rating, but document the reason for each score. Red might mean a senior executive can authorise payments through an unverified voice call, or that the target has no rights to a widely used digital avatar. Amber could mean controls exist but have never been tested. Green should mean the control works in practice and has recent evidence behind it.
Prioritise consequences, not novelty. A synthetic training video with clear labelling is usually less urgent than a realistic audio message that can release funds. Rank each issue by financial impact, legal exposure, likelihood, detectability and time needed to fix it.
The strongest deepfake due diligence checklist for mergers ends with named owners and deadlines. If nobody owns the remediation plan, the checklist has recorded a risk without reducing it.
FAQs
Should every merger include a deepfake assessment?
Not every transaction needs forensic testing of every video. Every transaction should, however, ask how executives are authenticated, how synthetic media is used, what likeness rights exist and whether impersonation incidents have occurred. A short screening review is usually enough to decide whether the deal needs specialist testing.
Can deepfake detection software prove that a video is genuine?
No. Detection software produces an assessment based on its model, the quality of the file and the features it can inspect. It can miss manipulated material or flag genuine footage. Use it alongside provenance, source verification, communication records, metadata and expert review where the commercial or legal stakes are high.
What consent should a buyer look for when a target uses AI avatars?
Look for specific, documented permission covering the person’s face, voice, biometric information, derivative digital replicas, intended uses, territories, duration, suppliers and withdrawal rights. Check whether the permission survives the merger. A general filming release may not cover model training or the creation of a reusable synthetic likeness.
What should we do if a suspected deepfake appears during a transaction?
Do not forward it widely or confront the suspected sender through the same channel. Preserve the original file and surrounding messages, verify the claim independently, alert legal and security teams, and pause any payment or disclosure decision. Record the timeline and seek technical advice before deleting or altering evidence.
A merger does not create synthetic-media risk; it exposes whether the target has managed it properly. Use the checklist before signing, tie serious gaps to deal protections and test the controls after completion. Request a confidential consultation if you need help assessing a target’s exposure.
Frequently asked questions
Should every merger include a deepfake assessment?
Not every transaction needs forensic testing of every video. Every transaction should, however, ask how executives are authenticated, how synthetic media is used, what likeness rights exist and whether impersonation incidents have occurred. A short screening review is usually enough to decide whether the deal needs specialist testing.
Can deepfake detection software prove that a video is genuine?
No. Detection software produces an assessment based on its model, the quality of the file and the features it can inspect. It can miss manipulated material or flag genuine footage. Use it alongside provenance, source verification, communication records, metadata and expert review where the commercial or legal stakes are high.
What consent should a buyer look for when a target uses AI avatars?
Look for specific, documented permission covering the person’s face, voice, biometric information, derivative digital replicas, intended uses, territories, duration, suppliers and withdrawal rights. Check whether the permission survives the merger. A general filming release may not cover model training or the creation of a reusable synthetic likeness.
What should we do if a suspected deepfake appears during a transaction?
Do not forward it widely or confront the suspected sender through the same channel. Preserve the original file and surrounding messages, verify the claim independently, alert legal and security teams, and pause any payment or disclosure decision. Record the timeline and seek technical advice before deleting or altering evidence.
