AI and Criminal Law in Spain: Deepfakes, Fraud and New Risks

Artificial intelligence has transformed the landscape of criminal conduct at extraordinary speed. Deepfakes, AI-generated fraud schemes, automated phishing, voice cloning for identity theft, and AI-assisted market manipulation are no longer theoretical risks — they are active criminal cases in Spain's courts today.

Deepfakes and Criminal Law

A deepfake — a hyper-realistic video or audio fabricated by AI — can constitute multiple simultaneous offenses under Spanish law: identity theft (Art. 401 CP), defamation or insults against honor (Arts. 205-208 CP), non-consensual image sharing (Art. 197.7 CP), and if used for fraud, criminal deception (Art. 249 CP). The challenge for prosecutors is proving authorship and intent. Each of these offenses has its own elements, so the same video may support some charges and not others: an effective defense forces the prosecution to analyse them separately instead of charging in bulk.

AI-Enhanced Fraud

Fraudsters now use AI to clone voices (impersonating bank managers), generate convincing correspondence, and automate phishing at industrial scale. Spanish courts are applying existing fraud provisions (Arts. 248-251 CP) to these new methods, but the technical complexity of proving the AI element creates significant defense opportunities.

Digital Evidence and Attribution

These cases stand or fall on digital evidence: device forensics, account records, metadata and the analysis of the manipulated files themselves. Two problems dominate. The first is attribution: proving that a specific person — and not simply a device, an account or someone with access to them — created or used the AI-generated content. The second is integrity: digital files are easy to alter, so the chain of custody and the way the evidence was collected and preserved must withstand scrutiny. Forensic expert reports are usually the decisive piece for both questions.

Defense Strategies in AI Cases

The defense lines follow from those weaknesses: challenging authorship when several people had access to the device or account; auditing how the digital evidence was obtained and whether its integrity can be guaranteed; commissioning an independent technical expert report to confront the prosecution's conclusions; and disputing intent, since using or sharing content is not the same as having fabricated it knowing it was false. The technical complexity that makes these schemes effective also makes them genuinely difficult to prove. None of this is theoretical: prosecutions often rest on the inference that the account holder must be the author, and dismantling that inference — shared devices, compromised credentials, remote access — is frequently where these cases are won or lost.

Practical Steps for Victims

If you have been targeted by a deepfake or an AI-driven scam, preserve everything before it disappears: screenshots, original files, URLs, account names and transfer receipts. Do not delete conversations, and have the material secured by a forensic expert where possible, because properly preserved evidence is what later allows both the criminal complaint and the recovery of losses within the same proceedings. The sooner a specialist lawyer reviews the preserved material, the more procedural options remain open — both for the criminal case and for any recovery.

Current Legal Gaps and Future Regulation

Spain and the EU are actively working to regulate AI-related criminal conduct. The EU AI Act (2024) establishes obligations for high-risk AI systems, and breaches of these obligations may create criminal liability through referral to national penal codes. Spanish criminal lawyers must stay ahead of this rapidly evolving landscape. For businesses deploying AI systems, this means that documenting how a system was designed, tested and supervised is becoming part of criminal-risk prevention, much like classic corporate compliance.