Shanghai Observer commentary: After AI face-swapping breaks through facial verification, the governance bottleneck lies on the institutional side

According to media reports, after the actors Wu Yue and Wen Zhengrong were successively subjected to "face theft" livestreams, a public interest litigation case concerning personal information protection involving "AI face-swapping" publicly heard by the Hangzhou Intermediate People's Court this year shows that "AI face-swapping" can now break through facial verification. The related topic has trended on social media and attracted widespread attention. Facial recognition has been given a unique status over the past decade or more. For logging in, making payments, opening accounts, transferring ownership—almost every step that requires "proving you are you" has converged onto "face scanning." The reasons are sound: passwords can be forgotten, phones can be lost, but your face is on your head and can't run away. So "look left, look right, open your mouth, blink" became the core passcode of digital security. Now "AI face-swapping" has torn up this "last card." According to a Ministry of Public Security briefing, in the first nine months of 2026 alone, more than 300 AI face-swapping fraud cases were solved nationwide, with involved amounts exceeding 500 million yuan and the highest single case reaching 20 million. In one case in Fujian, the victim was defrauded of 4.3 million yuan in 10 minutes from receiving an AI video call to completing the transfer. Even more frustrating is the industry technician's remark that "there really seems to be no good solution." People often say that as the devil rises one foot, the dao rises ten. Now, can the "dao" still catch up with the rampaging "devil"? This topic has been raised repeatedly recently. Wu Yue and Wen Zhengrong had their faces stolen for livestreams, a man faked an AI video of his father being seriously ill to swindle money from friends, and "AI Xiaohai" raked in money from elderly people on a large scale... More and more cases remind us that this may no longer be merely a technical matter, but something that must be considered at the institutional and governance levels. Faced with AI scams, the instinctive governance response is to "issue regulations." Deep synthesis has its deep synthesis measures, generative AI has its generative AI regulations, content labeling has dedicated labeling measures, and anthropomorphic interactive services have a joint interim measure from five departments. It cannot be said that there are no rules. The problem is that these rules were patched together at different times, for different problems, and by different departments. Each governs one segment, but may not govern the whole chain. The default logic of current governance is that the relevant platforms have both the incentive and the ability to manage their own turf well. So labeling obligations are given to platforms, verification obligations are given to platforms, and review responsibilities are also given to platforms. And the result? Accounts like "AI Xiaohai" that are already labeled "content generated by AI" still harvest elderly people in bulk. Labeling did not stop fraud; instead, it was like a compliance pass. Why does this happen? Because for platforms, labeling is a "do it and you're done" action, while interception is more costly—and a choice that "may affect conversion rates if done." The same goes for security verification. Under the existing allocation of responsibilities, do banks, third-party payment institutions, and other entities have enough incentive to choose the "more troublesome but safer" option? You should know that for every notch security is raised, user experience and conversion rates may drop a notch. So we must first acknowledge one thing: the bottleneck of AI governance lies not only on the technical side, but more on the institutional side; not only in "whether there are rules," but more in whether the rules change the incentives and punishments of behavioral actors. The state is not unaware of this. The State Council's 2026 Legislative Work Plan explicitly proposes to "accelerate the advancement of comprehensive legislation for the healthy development of artificial intelligence," and the Standing Committee of the National People's Congress has also included it as a preparatory deliberation item. For comprehensive legislation to truly "work," it cannot be written as a compilation of existing sector-specific regulations; it must achieve substantive breakthroughs at key points. For example, the Supreme People's Court has made clear that people who develop and sell AI face-swapping and voice-cloning tools, or who knowingly provide technical support to others committing fraud, can be held accountable as joint offenders or under the crime of aiding information network criminal activities. The judicial attitude is clear, but the threshold for initiating criminal accountability and the difficulty of obtaining evidence mean that enforcement often can only hit "points" and cannot create "area-wide" deterrence. Comprehensive legislation should treat "providing AI generation tools or virtual injection tools used to bypass security verification" itself as an independent, punishable illegal act, rather than waiting each time until it is used for fraud and then going back to prove "knowing." Another example is the problem with the AI labeling system. The labeling requirement is not wrong; the problem is that labeling alone is useless. If a platform already knows that an account is using AI-generated content to carry out fraudulent marketing, labeling it "AI-generated" should not be a ground for exemption, but should be the starting point that triggers an obligation to actively intercept. Comprehensive legislation needs to establish a principle: governance of AI-generated content should center on "whether AI was used to commit acts prohibited by law," not on "whether labeling formalities were fulfilled." The same applies to platforms: labeling is only information disclosure; interception is the core responsibility. On the track of technological iteration, the defending side is often half a step slower; this is an objective law. Acknowledging this law is not resignation, but about directing the strength of institutions and governance to the right places. If there is always only patching, then this chase will never have an endpoint.