Editor’s Note: Deepfakes have moved from novelty to operational threat, and a standing-room session at the Dublin Tech Summit on Thursday made the stakes plain: the forensic test that has governed digital evidence for 30 years no longer settles the question. HaystackID’s John Wilson and Jeff Shapiro walked a packed room through the 2024 Arup fraud (about $25.6 million gone after a video call with AI-generated executives) and argued that proving integrity is no longer enough. Examiners now have to prove authenticity.
For cybersecurity, data privacy, compliance and eDiscovery professionals, the timing is hard to ignore. The EU AI Act’s Article 50 transparency rules land Aug. 2, 2026; NIS2, DORA and the U.K.’s failure-to-prevent-fraud offense already carry extraterritorial reach; and the proposed U.S. Federal Rule of Evidence 707 would put AI-generated evidence under Daubert-style scrutiny.
Watch the next 90 days. Teams that audit AI content against emerging evidence standards, map their chain of custody against the five-framework matrix, and rehearse a deepfake incident now will be the ones able to answer the only question that matters when the evidence itself is suspect: can you prove what was real?
Content Assessment: When you can’t trust the evidence: deepfakes force a forensic reckoning in Dublin
Information - 94%
Insight - 95%
Relevance - 93%
Objectivity - 93%
Authority - 94%
94%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "When you can’t trust the evidence: deepfakes force a forensic reckoning in Dublin."
Industry News – Artificial Intelligence Beat
When you can’t trust the evidence: deepfakes force a forensic reckoning in Dublin
ComplexDiscovery Staff
A finance worker joined a routine video call with his chief financial officer and several colleagues. Every face on the screen was a forgery. By the time he called head office to check, the equivalent of about $25.6 million had left the company.
The unsettling part, two HaystackID executives told a packed room at the Dublin Tech Summit on Thursday, was not that the video had been faked. It was that the recording of the call was, in a forensic sense, genuine, and that the question forensics has asked for 30 years no longer fits the evidence in front of it.
John Wilson, chief information security officer and president of forensics at HaystackID, and Jeff Shapiro, the firm’s managing director for Europe, took the Workshop Stage at the RDS from 11:15 to 11:40 a.m. for a talk billed as “When You Can’t Trust the Evidence: Deepfakes, AI Fraud, and the Collapse of Digital Trust.” Both work for HaystackID, which was demonstrating privacy and investigation tools at booth C7, and both leaned on a single, well-documented fraud to make a technical case rather than a sales one.
When the recording is real but the meeting never happened
The case was the 2024 theft from the Hong Kong office of Arup, the British engineering firm behind the Sydney Opera House. A finance employee received what looked like a phishing email from the company’s U.K.-based CFO seeking a confidential transaction, doubted it, then joined a video call to confirm. The CFO and other familiar executives were on the call. He authorized 15 transfers worth about $25.6 million, or roughly 200 million Hong Kong dollars, before learning that none of the people he had seen were real, according to reporting by CNN and others.
Wilson’s account pushed past the headline. The attackers, he said, had spent months inside Arup’s network learning how its executives discussed and approved transactions, then staged the call live, with AI generating the faces and voices in real time. His point was a careful one: because the synthetic media was generated during the call rather than edited in afterward, the recording could be authentic as a record of what happened on the platform, even though the people appearing in it were synthetic. “However, how do you prove what else wasn’t real that same day?” Wilson said.
What unsettled the room was the speed. The reconnaissance behind Arup took months in 2024. Wilson estimated that similar reconnaissance can now be compressed to about two weeks, and that an interactive deepfake avatar able to hold a conversation can be built in about 24 hours. He was clear this was an expert estimate, not a measured figure.
Two glasses of water and the wrong question
Wilson’s framing device was two identical glasses of water, one clean and one carrying something colorless and odorless. The instinct is to ask which glass is contaminated. Wrong question, he said. “The real question is, how do I prove that the clean one is safe?”
For three decades, he argued, digital forensics answered a question of integrity: the file is what it claims to be, the hash matches, the method is repeatable and survives a Daubert challenge. Synthetic media breaks that. Integrity is table stakes; examiners now have to establish authenticity: proof that the artifact is real, not generated or altered. Even an everyday act, like pushing a phone video into a messaging app, applies compression and AI filters that change the file on their own. The practical takeaway for any investigations team: assume the content needs an authenticity test, not only an integrity check.
Hashes still matter, Wilson said, but they have to sit inside an immutable chain that can be validated from the moment of creation forward. “These hashes are cryptographic fingerprints,” Shapiro added, cutting off the obvious joke. Wilson extended the point to the training data behind any AI system offered as evidence, a provenance problem he said almost no one is preparing for.
Five frameworks, one chain of custody
Shapiro turned the forensic problem into a compliance clock. The EU AI Act’s Article 50 transparency obligations take effect Aug. 2, 2026, about two months out. Providers of generative systems will have to mark AI output in a machine-readable format; deployers will have to disclose when content is a deepfake (or, as Shapiro preferred to call it, synthetic media). Penalties run to 15 million euros or 3 percent of global annual turnover, a tier he compared to GDPR.
The reach is what European startups tend to miss. Article 50, NIS2 and DORA all carry extraterritorial effect, as does the U.K.’s “failure to prevent fraud” offense under the Economic Crime and Corporate Transparency Act, which took effect Sept. 1, 2025. Serve customers in those jurisdictions, Shapiro said, and the rules reach you wherever the company sits.
His shorthand for the matrix: NIS2 covers cybersecurity and requires a 24-hour early warning when an incident hits; DORA covers financial services and the technology providers that feed them; the fraud offense asks whether an organization took reasonable steps to stop fraud by the people associated with it. Stack Article 50 and the proposed U.S. Federal Rule of Evidence 707 on top (the latter would hold AI-generated evidence to the same reliability test as expert testimony and is now expected to take effect no earlier than December 2027), and five regimes end up reading the same chain of custody five different ways.
Shapiro offered one trap worth keeping in mind. A company builds an innocent chatbot to answer questions about an e-book. If that book carries special-category data (on sexual orientation or political affiliation, say), the deployer can become a GDPR controller of sensitive data the instant a user starts asking. The lesson he drew: map the downstream data effects of an AI feature before shipping it, not after.

A 90-day plan and five questions
The session closed on a checklist. Over the next quarter, Shapiro said, organizations should do three things: audit their AI-generated content against the Rule 707 forensic standard, inventory their chain-of-custody methods against the five-framework matrix to find exposures, and run a deepfake tabletop exercise with people who understand how the attacks are actually built.
Wilson added the five questions a team should be able to answer in the first 48 hours of an incident: Is the media authentic? Were any identities compromised? What data was accessed? What is the regulatory exposure? And can the timeline be proved from the start, with provenance intact? Most companies, he said, can answer one, maybe two.
Compliance as a growth story
Shapiro’s last turn reframed the whole pitch. Treated as cost centers, these frameworks read as a tax on building. Built in by design, he argued, they become a selling point: walk into a bank for funding able to show DORA-grade operational resilience already wired into the business, and the capital comes easier.
The line both men kept returning to was the one HaystackID has been sharing as part of its European launch: pairing AI-driven investigation with disciplined information governance lets organizations move faster and defend the result when the evidence can’t be taken at face value. That leaves every security and legal leader who filled the room with a single, uncomfortable question. If a convincing forgery can be built in a day, and the recording of the fraud is itself genuine, how will your organization prove what was real?
News sources
- HaystackID Advances AI-Enabled Privacy, Security and Legal Discovery Across European Market (PR Newswire)
- Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee (CNN Business)
- Transparency obligations for providers and deployers of certain AI systems (Article 50) (EU Artificial Intelligence Act)
- Code of Practice on marking and labelling of AI-generated content (European Commission)
- Federal Rules of Evidence & AI-Generated Materials (Purdue Global Law School)
- The UK Failure to Prevent Fraud regime takes effect on 1 September (Travers Smith)
- DORA vs NIS2: Key Differences for Financial Entities (Legiscope)
- Dublin Tech Summit | May 27 & 28, 2026 | RDS Dublin (Dublin Tech Summit)
Assisted by GAI and LLM Technologies
Additional Reading
- Ireland’s AI regulator role gets a hard look at Dublin Tech Summit
- HaystackID brings AI privacy and discovery stack to Dublin as European compliance pressure mounts
- Latitude59 final day in Tallinn: AI sovereignty, a driverless permit and €450,000 to three startups
- Bold Stage opens Latitude59 2026 with AI, missiles and the New Nordics bet
- Estonia opens Latitude59 with sandbox framework for legal exemptions
- Seven startups from four nations compete for Latitude59’s nearly half-million-euro investment prize
- Big tech, defense and climate to share the main stage at Latitude59 2026
- Latitude59 pitch competition draws 465 startups from 53 countries as prize pool grows to €400,000
- Baltic and Nordic Angel Networks Pool €300,000 for Latitude59 Pitch Competition as Cross-Border Startup Investing Deepens
- Latitude59 Opens Pitch Applications as Investors Raise the Bar on Operational Readiness
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

































