In January 2025 a UK employer ran a recruitment round with around 20,000 candidates. Roughly 30 of them used deepfake tooling at some point in the process. Not in the dramatic identity-theft sense – mostly to soften an accent, smooth out a face, polish a voice. The Guardian story was easy to miss because the numbers look unimpressive in absolute terms. The shape of the data is the interesting part: deepfake-augmented hiring is not exotic, and Gartner's projection that up to one in four global job candidates may be fake by 2028 is starting to feel like a forecast rather than a provocation.
Around the same time, US authorities arrested a man in Nashville who had been running an operation that placed North Korean IT workers into American and British companies under fabricated US identities. That one is more sci-fi. But it lives on a continuum with the accent-smoothing case, and the regulatory framework has to handle both ends.
I want to walk through what the law actually says about this in Poland and the EU, because there is a non-obvious gap between "we have rules about AI now" and "the employer who got tricked has somewhere to go."
What the AI Act considers AI
The starting point is Article 3(1) of Regulation 2024/1689, the AI Act, which defines an AI system – the wider concept. The short version: a machine-based system, with some level of autonomy, possibly adaptive after deployment, that infers from inputs how to generate outputs (predictions, content, recommendations, decisions) influencing physical or virtual environments. Three load-bearing words: it infers, it has autonomy, it can adapt. Ordinary deterministic software does none of these.
Generative AI fits comfortably inside the definition – the "content" output is right there in the text. The narrower computer-science framing, the one Emilio Ferrara reaches for, is more specific: the paradigm of attributing to computational systems the capacity to produce novel content displaying significant similarity to human-made material. The legal definition is broader and statute-relevant; the technical definition is sharper and disciplinarily useful. They overlap rather than coincide.
The Regulation itself barely engages with deepfakes. Article 50(4) is the main hook – it requires deployers of systems generating deepfakes to disclose that the content has been artificially generated or manipulated. Article 3(60) gives the definition: AI-generated or AI-manipulated images, audio, or video resembling real people, objects, places, entities, or events, where the viewer might mistakenly take the output for authentic. Audio explicitly counts, which matters for the accent case.
The more interesting question is whether a tool built specifically to help candidates deepfake themselves in interviews might fall under Article 5 – prohibited practices. The relevant provision targets systems deploying purposefully manipulative or deceptive techniques with the object or effect of materially distorting a person's behaviour by appreciably impairing their ability to make an informed decision. The hiring manager on the other end of the call is exactly that person, making exactly that kind of decision. I have not seen this litigated yet, but the elements line up.
What Polish labour law regulates about hiring
Almost nothing, is the short answer. Pre-employment conduct is largely outside the scope of the Polish Labour Code. There are three exceptions, and that is it.
Article 11 establishes that an employment relationship requires matching declarations of will from both parties. This is the freedom-of-contract principle in labour-law clothing. It cuts both ways – it bars compelled labour, and it grants the employer the right to choose their workforce. AI-augmented applications threaten the second half: the employer's choice is made on the basis of distorted inputs.
Article 11³ is the non-discrimination principle. Direct or indirect discrimination at any stage of employment, including pre-contractual, is prohibited. The catalogue of protected characteristics – age, sex, race, and so on – is open under Polish doctrine and international standards alike.
Article 22¹ § 1 enumerates what an employer is permitted to ask of a candidate. This is the data-protection backbone of the recruitment phase.
That is the entire regulatory perimeter. There is no general duty of honesty on the candidate, no specific prohibition on AI-assisted CV polishing, no statutory framework for verifying skills before signing the contract. The system assumes the parties are dealing roughly in good faith and patches the failure cases after the fact.
What an employer can actually do after being deceived
Suppose the contract is signed and the new hire's claimed Python expertise turns out to be a fluent-sounding hallucination. The employer has three avenues, with different levels of strength.
Avoiding the declaration of will. Via Article 300 of the Labour Code the employer can reach into the Civil Code and invoke either error (art. 84 k.c.) or deceit (art. 86 k.c.) to escape the contract. The Supreme Court in I PKN 251/97 held that for deceit it is enough that the error relates to the motivational sphere underlying the declaration – the reason the employer agreed to hire this person in the first place. A CV padded with fabricated AI-generated credentials sits comfortably inside this. The remedy unwinds the contract from the start, which is strong but procedurally demanding.
Termination with notice. The general justification requirement of Article 45 § 1 is not limited to events occurring during employment. Pre-employment misrepresentation that would have changed the hiring decision is a defensible ground. This is the easier path in most cases.
Termination without notice. This is where it stops working. Article 52 § 1(1) requires a breach of employee duties, and the Supreme Court in I PKN 647/98 made clear that pre-employment conduct cannot constitute such a breach – only an employee, post-hire, can violate the duties of an employee under Article 100 k.p. The narrow exception is when the absence of a represented qualification matures into an active problem during employment, but the trigger is the in-role failure, not the original lie.
Damages. Article 122 of the Labour Code allows full compensation where the employee caused the loss intentionally. If a candidate misrepresented skills, was assigned work on the strength of those skills, and the employer suffered direct loss plus foregone benefits, the claim is available. It is undertheorised in case law because most employers prefer the unwinding-or-termination route, but the doctrinal basis is solid.
Why this is structurally awkward
Polish labour law, like most labour codes, was drafted on an implicit model where the asymmetry of information in recruitment runs from employer to candidate. The protections – non-discrimination, the closed list of permissible questions, the limits on background checks – exist to constrain the employer's investigative reach. The candidate is the structurally weaker party, and the law is built around that.
Generative AI tilts the asymmetry in the other direction. A motivated candidate can now manufacture credentials, fluency, and presence at a scale that no individual employer can match in verification capacity. The remedies the Code provides – error, deceit, justified termination with notice, damages – all kick in after the harm. There is no equivalent of the candidate-protection apparatus operating in the employer's favour, and there probably should not be one built into labour law itself; the constraint really wants to live further upstream, on the tool side.
The AI Act is moving in that direction by imposing disclosure duties on deepfake systems themselves, which is one way to shift the equilibrium without rewriting decades of employment doctrine. Whether disclosure does enough work in the specific context of recruitment is a question the next few years will settle, partly through litigation that has not happened yet. For now the employer's position is: rely on labour-law remedies that were never designed for this, and hope you catch the fake CV before the probation period runs out.