Voice cloning: good compliance practices

Your voice is as personal as your face. It lets people recognise you, attribute words to you and, now, imitate you. With a few minutes of recording, a voice cloning tool can produce a synthetic voice that reads any text, in several languages, with the same timbre and intonation.

For a company, this is a considerable gain: training, product videos, tutorials and internal communications can be produced faster and translated without going back to a studio. But this power demands rigour. A voice cloned without agreement can be used to deceive, to usurp an identity or to make someone say something they never said.

A simple starting point: cloning your own voice raises no difficulty. The precautions concern every other situation, where the company handles another person's voice. Precise rules vary from country to country and change quickly, but the principles below hold everywhere.

When the voice is not yours, only two situations are safe: the person has given you explicit agreement, or you work under a clear contract with a professional.

Good consent is more than a "yes" said in a meeting. It must be clear, written and precise. Ideally, it specifies:

- the purpose: which content the voice will be used for (training, product videos, advertising…);

- the duration: for how long the clone may be used;

- the media and languages: internal or public use, website, social networks, and in which languages;

- the right to withdraw: can the person ask for the use to stop and their voice to be deleted, and how?

Particular care is needed with employees. The employer–employee relationship can undermine the real freedom to refuse. So provide a separate agreement, distinct from the employment contract, and give each person a genuine option to say no without consequences. Also think about what happens when an employee leaves the company: what becomes of their cloned voice? The answer should be in the agreement from the start.

As soon as a voice can identify a person, the recording containing it is personal data. This applies to the reference sample you upload, as well as to the voice model created from it. The GDPR therefore applies, with its usual principles:

- Clear purpose: use the voice only for the stated use.

- Minimisation: keep only what is necessary. A sample of a few minutes is enough; there is no need to archive hours of recordings.

- Informing people: they must know who processes their voice, why and for how long.

- Security: store samples and voice models in a protected space, with access limited to those who need it.

- Rights of individuals: access, rectification, erasure. If someone withdraws their agreement, you must be able to delete their reference voice and their clone.

One point deserves attention: depending on the use, a voice may be treated as biometric data, a category subject to stricter rules, particularly when it is used to uniquely identify a person. When in doubt, adopt the highest level of precaution and consult your data protection officer or a lawyer.

For actors, dubbing artists and voice-over professionals, the voice is a working tool. A contract authorising the recording of a voice-over does not automatically cover the creation of a clone that can be reused indefinitely.

If you work with a professional, state in writing that cloning is envisaged, within what framework, for how long and for what fee. This transparency protects both parties, avoids misunderstandings and paves the way for trust in future projects.

The European regulation on artificial intelligence (Regulation (EU) 2024/1689) sets transparency obligations for certain AI-generated or manipulated content. Its Article 50 covers in particular synthetic audio, image and video content, including deepfakes.

Two key ideas:

- providers of generative AI systems must provide technical means so that synthetic content can be identified in a machine-readable format;

- users who produce deepfakes are subject to disclosure obligations under the conditions set out in the regulation, with adjustments for certain artistic, satirical or fictional works.

In practice, make a habit of stating that a voice or video is AI-generated: a mention in the description, an on-screen banner, a sentence at the start of the video. To understand the technical marking methods, read our article on deepfakes and digital watermarking. The application timeline and guidelines keep evolving: check the European Commission's publications regularly.

- Clone a third party's voice without agreement: a former employee, a public figure, a relative of an executive.

- Imitate someone to deceive: a fake transfer request, a fake message from an executive, a phone scam.

- Make someone say what they never said, even "as a joke": depending on the country, this can engage your civil and even criminal liability.

- Conceal the synthetic nature of content when this could mislead the public.

- Keep voice samples indefinitely when you no longer need them.

For a company, compliance rests less on legal texts than on habits. A few measures are enough to structure the approach:

- Appoint a contact person to validate voice cloning requests.

- Use a single authorisation template, signed before any recording.

- Keep a register of the voices used: who, for what, until when.

- Limit access to reference voices to members who need them.

- Set up a withdrawal process: who to contact, and within what timeframe the voice is deleted.

- Train teams on the basic rules and prohibited uses.