Rights, safety, and deepfake risks

“Found online” is not a license. Before uploading a reference, identify its source and permission. Stock assets may allow ordinary publication but restrict training, derivative generation, or use as model input. Client assets may be confidential. Employee photos may be governed by workplace policy. Images of children, patients, students, or private spaces require especially careful handling.

Keep a rights record for production work:

• Source and creator.
• License or consent basis.
• Permitted purpose, territory, and duration.
• Restrictions on modification or sublicensing.
• Tool used and relevant account terms.
• Review and approval owner.

If that record cannot be established, use an original, licensed, or synthetic alternative. Do not remove a watermark and treat the image as free.

An output can unexpectedly contain a logo, recognizable character, signature-like mark, copied composition, private detail, or close resemblance to a real person. A negative prompt saying “no copyrighted content” is not proof. Inspect the actual pixels and the context in which the image will appear.

Commercial use deserves a stricter process than a private mood board. Search for confusing brand similarity, verify product claims, and preserve records of prompts, source references, edits, and approvals. Copyright status for generated works can depend on jurisdiction and the nature of human contribution. Do not promise ownership merely because your team typed the prompt.

A deepfake is synthetic or manipulated media that convincingly depicts a person saying, doing, or appearing in something that did not occur. Not every edit is malicious, but realism plus identity plus false context creates serious risk.

High-risk examples include:

• A public figure appearing to endorse a product or political position.
• A colleague shown committing misconduct.
• A person’s face placed in sexual or humiliating content.
• Fabricated evidence of a disaster, crime, protest, or military event.
• A fake medical before-and-after image.
• A synthetic executive announcement used for fraud.

Do not create deceptive identity-based media without explicit, informed authorization and a legitimate purpose. Some categories should not be produced even as a joke because the image can escape its original context. Consent must be specific: “you may use my headshot on the staff page” is not consent to generate fictional activities.

When synthetic imagery could be mistaken for documentary evidence, communicate its status at the point of use. Labels should be visible, plain, and durable enough for the context. Metadata and content credentials can support provenance, but they may be stripped by screenshots or platforms. Use layered signals:

• On-image or adjacent disclosure.
• Caption explaining the synthetic or composited nature.
• Preserved provenance metadata where available.
• Publication records linking source, prompt, edits, and approval.
• A policy against presenting synthetic scenes as evidence.

Do not label an image “AI” and assume all harm is solved. A disclosed fake can still defame, harass, exploit, or manipulate. The appropriate action may be not to create or publish it.

Generated images can reinforce stereotypes through occupation, age, disability, culture, body type, or socioeconomic cues. Review representation across a whole campaign, not only one frame. Avoid tokenistic diversity and decorative use of cultural or religious symbols. Consult people with relevant lived experience when portrayal matters.

Safety also includes factual depiction. A generated image of a medical procedure, emergency response, electrical repair, or laboratory setup may look authoritative while showing dangerous details. Have a qualified expert verify personal protective equipment, positioning, labels, tools, and sequence. If accuracy cannot be assured, use a clearly illustrative style and a disclaimer—or use verified photography and diagrams.

Protect your own team as well. Do not require reviewers to examine disturbing generated content without warning, access controls, support, and a clear business need. Limit retention and access for sensitive inputs and outputs.

Before publication, ask:

• Are every input and reference authorized for this use?
• Does the output resemble a real person, protected character, brand, or existing work?
• Could a reasonable viewer mistake it for evidence of a real event?
• Are disclosure and provenance appropriate and durable?
• Does it portray a person or group unfairly or expose private information?
• Are safety-critical details accurate?
• Has the right human approved the final asset?

If the answer is unknown, pause. Speed is not a reason to transfer unresolved risk to the subject or audience.