Relevance. The article analyzes the legal gaps in the regulation of AI-enhanced phishing and social engineering. The process of globalization and the accompanying digitalization have fundamentally changed the landscape of transnational crime. The development of generative artificial intelligence (AI) has taken the issue of cybersecurity to a new level, creating unprecedented threats. The paper examines the risks caused by generative AI, including deepfake attacks and personalized scam campaigns, as well as the current regulatory framework in the EU (AI Act), the USA (TAKE IT DOWN Act, state laws), and Russia (experimental regulation and ethical code). Special attention is paid to the distribution of responsibility between AI system providers, operators (deployers), and digital platforms. The paper identifies key challenges, such as the lack of clear attribution of blame in cases of foreseeable misuse, the fragmented nature of regulations, and the lag between legislation and technology. Harmonization measures proposed: mandatory labeling of synthetic content, strengthening of platforms’ responsibilities for moderation, and introduction of strict liability for high-risk AI tools.