Loading...
- Home
- Capabilities
- ACTIO® Hub
- About Us
- Connect with Us
- AP Library
June 3, 2026
Originally published in ACTIO E-Magazine Edition 29 (June 2026). Law as of June 2026.
Yes, in principle, but not against the AI system itself. Indonesia has no AI-specific criminal statute yet, so deepfake and other AI-enabled conduct is addressed through the Indonesian Criminal Code 2023 (KUHP 2023), the Electronic Information and Transactions Law (UU ITE), and the Personal Data Protection Law (UU PDP). Because AI has no consciousness, free will, or criminal intent, accountability must ultimately be attributed to a human legal subject or a legal entity that controls, deploys, or benefits from the system.
AI has increasingly become embedded in everyday life, shaping not only how people work but also how society interacts, and it has also been used to facilitate criminal activities, including the automation of fraud targeting social media users and AI-driven simulations designed to manipulate markets.
Deepfakes use artificial intelligence to alter or generate audio and video content, producing fabricated but highly realistic media that depict individuals engaging in actions or making statements that were never performed or expressed. That highlights why deepfakes pose systemic legal, social, and economic risks, ranging from fraud and fabricated evidence to non-consensual sexual exploitation.
In criminal law, the issues extend beyond whether a particular act may be classified as a criminal offence. They also concern the attribution of responsibility where content is generated by an AI system operating autonomously, without direct human intent or volition. Under Indonesian criminal law, fault or criminal intent (mens rea) is a fundamental element for the imposition of criminal accountability, but AI complicates the causal link between human conduct and the resulting harm.
Under Indonesian criminal law doctrine, an act must satisfy three essential elements. First, the principle of legality (nullum crimen sine lege, nulla poena sine lege): no act may be punished unless it is expressly criminalised under pre-existing statutory law. Second, an unlawful act (actus reus), namely a concrete conduct prohibited by statutory law. Third, fault or criminal intent (mens rea), the perpetrator’s culpable state of mind at the time the act was committed. The principle of legality is a cornerstone of Indonesian criminal law and a benchmark for legal certainty and the protection of human rights, as reflected in Article 1(1) of Law No. 1 of 2023 (KUHP 2023).
Challenges emerge when this principle is applied to highly autonomous AI systems, because the determination of actus reus and mens rea is no longer a straightforward assessment of a direct relationship between perpetrator and act. AI systems do not possess consciousness, free will, or criminal intent. Even where deepfake content is generated automatically, criminal accountability must ultimately be attributable to a human legal subject or a legal entity that exercises control over, deploys, or benefits from the operation of that system.
A relevant approach is the human-in-the-loop concept, focusing on the degree of human control and awareness in the deployment of AI systems. The threshold of mens rea may be satisfied where an individual knowingly utilises AI technology, understands its capacity to generate content that may be unlawful, and exercises effective control over its implementation or dissemination. The central inquiry is therefore not whether the AI system acted autonomously, but whether there was awareness, control, and intent on the part of a human actor in operating or directing the system.
In practice, deepfake content may constitute a criminal offence where manipulation is carried out with intent to mislead, cause harm, or violate legally protected interests. Although there is no specific statutory provision expressly criminalising deepfake offences, the existing legal framework provides a normative basis that may be relied upon.
Law No. 1 of 2024 on the Second Amendment to Law No. 11 of 2008 on Electronic Information and Transactions (UU ITE) may be invoked to address the distribution of electronic content that violates decency or infringes upon an individual’s honour or reputation; the source cites Article 27(1), Article 27A, and Article 35. Meanwhile, Law No. 27 of 2022 on Personal Data Protection (UU PDP) provides a legal basis for sanctioning the unlawful acquisition, use, processing, or manipulation of personal data without consent; the source cites Article 65(1) and (3) and Article 66. In addition, criminal accountability, including corporate criminal accountability, has been expressly recognised under the KUHP 2023.
In the corporate context, the issue becomes more complex. Under the KUHP 2023, a corporation acting as a platform provider may be held criminally liable where the offence is committed for the benefit or interest of the corporation, or where deficiencies in supervision, compliance, or corporate governance enable the commission of such an offence; the source cites Articles 45-50. In such circumstances, conduct technically generated by an AI system may be attributed to the corporation where it results from structural negligence or inadequate internal controls, and Article 48 of the KUHP 2023 is cited in the source in this context.
Although provisions under the KUHP 2023, UU ITE, and UU PDP may be invoked to prosecute conduct involving digital manipulation, addressing AI-related issues, particularly deepfakes, requires careful legal interpretation and complex evidentiary assessment. These challenges are compounded by limitations in digital forensic capacity, especially in convincingly distinguishing authentic content from AI-generated or manipulated material before a court of law.
The role of legal counsel becomes increasingly relevant, both in providing representation and advisory services, ensuring that lawful evidentiary standards are satisfied, and safeguarding the proper application of the KUHP 2023, UU ITE, and UU PDP. The enactment of the KUHP 2023 places advocates in a strategic position to deliver legal opinions, conduct legal compliance reviews concerning corporate use of AI systems, and promote technology governance practices aligned with prudence and the protection of human rights.
Is there a specific Indonesian law criminalising deepfakes?
No. The source states that there is no specific statutory provision expressly criminalising deepfake offences, but the KUHP 2023, the ITE Law, and the PDP Law together provide a normative basis for addressing them.
Can an AI system itself be criminally liable?
No. AI systems do not possess consciousness, free will, or criminal intent, so accountability must be attributed to a human legal subject or a legal entity that controls, deploys, or benefits from the system.
How is mens rea assessed when AI generates the content?
Through the degree of human control and awareness. Mens rea may be satisfied where a person knowingly uses AI, understands its capacity to generate unlawful content, and exercises effective control over its implementation or dissemination.
Can a platform company be criminally liable for AI-generated content?
Yes, potentially, under the KUHP 2023, where the offence is committed for the benefit or interest of the corporation, or where deficiencies in supervision, compliance, or corporate governance enable it.
What is the main practical obstacle to prosecution?
Establishing fault and tracing effective control in automated systems, compounded by limited digital forensic capacity to distinguish authentic content from AI-generated or manipulated material in court.
Ultimately, criminal accountability in the era of Human-AI Reality is shaped by the need for interpretative adaptability, consistent enforcement, and awareness of the pace of technological evolution. Indonesia’s readiness is reflected not only in the maturity of its legal provisions in the KUHP 2023, UU ITE, UU PDP, or other legislation, but also in its ability to safeguard legal certainty and justice within an increasingly complex digital environment.
