Deepfakes in the office: the law already requires investigating harassment even when the evidence may be fake

By Zendoric · September 9, 2026.

An artificial intelligence (AI)-generated sexual image has already landed US companies in court for failing to investigate it in time. A television meteorologist in Tennessee sued her employer because, as she alleged in her complaint, management did not investigate the sexual images fabricated with her face using AI. A Washington state trooper filed another lawsuit after, according to his account, several colleagues distributed an AI-generated video showing him kissing another officer. The cases are reported by Tracey Diamond, a partner at the law firm Troutman Pepper Locke specializing in employment law, in an analysis published in HR Dive on September 8.

The legal framework requiring action is Title VII of the Civil Rights Act of 1964, which prohibits harassment on the basis of sex and other protected categories. Since 1998, the US Supreme Court has allowed companies to defend themselves against a harassment claim through the so-called Faragher-Ellerth defense, but only if they show they exercised reasonable diligence to prevent and correct the conduct and that the employee failed to use the available complaint channels. In practice, that requires investigating every harassment complaint promptly and thoroughly. The problem, Diamond explains, is that deepfakes have made it far harder to separate fact from fiction within that investigation.

Suppose, the author proposes, that an employee submits a voice message with sexual comments and a nude photo of a coworker as evidence of harassment. If the evidence is genuine and the company does not act, it exposes itself to harassment liability under Title VII, with dismissal of the harasser as the likely measure. But if the evidence was fabricated by the complainant, acting against the accused without verifying it exposes the company to a different lawsuit, brought by the unfairly accused coworker. HR can no longer simply take the complainant at their word: it has to begin every harassment investigation by also being suspicious of the evidence itself.

The regulatory backing for this tightening is recent. The Take It Down Act, in force since May 2025, makes it a federal crime to publish an AI-generated intimate visual depiction of an identifiable person that, to a reasonable person, is indistinguishable from an authentic image. In addition, the Defiance Act is advancing in Congress, which would give victims the right to sue directly whoever fabricates such pornographic content using their likeness. The Equal Employment Opportunity Commission (EEOC) already includes the circulation of sexually degrading AI-generated videos and images among the examples of conduct that constitutes unlawful harassment. What remains unresolved, Diamond notes, is whether a company would bear vicarious liability for the act of an employee who fabricates the deepfake under either of these two laws.

Diamond recommends updating harassment policies as soon as possible to explicitly name the misuse of generative AI, to make clear that distributing fabricated images of coworkers can lead to dismissal, and to warn equally that a false complaint also carries disciplinary consequences. To build the case, she proposes a forensic analysis of the devices involved —though she cautions that the absence of a message on a phone proves nothing, because it could have been deleted— and lists the typical signs of a fake: unnatural blinking, inconsistent lighting, artifacts around the mouth or face, audio with a robotic timbre. She also advises checking whether the company's own AI tools were used to create the content.

Here is the underlying problem, and it is more structural than legal: those forensic signals have an expiration date. Each new generation of video and image models reduces these flaws, so the catalog of clues that works today to detect a fake will become less and less reliable within a year or two. It is an arms race between generation quality and detection capability, and for now generation is gaining ground faster. That turns any "how to spot a deepfake" list into a document that ages badly almost from the day it is published.

Broadly speaking, this is one of the most uncomfortable and least discussed transition costs of generative AI: it does not destroy jobs directly, but it forces the creation of an entire layer of new work —digital forensics, regulatory compliance, internal policies— just to keep trusting the documentary evidence we took for granted for decades. HR departments, courts and insurers will have to learn to operate with a level of uncertainty about the authenticity of evidence that did not exist five years ago. In the medium term, it is reasonable to expect the solution will not depend on examining the blinking of a face, but on content provenance infrastructure —origin signatures in cameras and models, authenticity certification standards— that makes guessing whether an image is real unnecessary. Until that infrastructure matures and is widely adopted, the burden falls on each company, case by case, with the still rudimentary tools Diamond describes.