AI Image Generation: Risks, Limits and Governance Rules to Set First

Without rules, each designer or marketer decides alone. One person uses a tool whose terms do not permit commercial use, another generates a person who looks like a real celebrity, a third publishes a product shot with the wrong number of buttons. None of this is malicious; it is what happens when a fast tool arrives without guidance.

Rules also protect the work that follows. If a client, partner or platform later asks how an image was made, you can answer from a record instead of guessing.

Laws on AI-generated content are still developing and differ by country, so this is general information, not legal advice. Check with counsel in your markets.

Copyright in the output

In the United States, the Copyright Office has stated that material generated by AI without sufficient human authorship is not protected by copyright. That means a purely generated image may be hard to protect against copying. Other jurisdictions may treat it differently.

Training data and infringement claims

Several image model developers face lawsuits over training on copyrighted images. Some vendors, such as Adobe with Firefly, state that their models are trained on licensed and public domain content and offer indemnification for eligible enterprise customers. Read the current terms of any tool you approve.

Style and trademark

Prompting “in the style of” a living artist, or generating images that include logos and recognisable products of other companies, invites disputes. Ban these in your rules.

Generated people raise separate issues. An image that resembles a real person can breach rights of publicity or personality rights, and it can mislead audiences. Image models can also reproduce stereotypes, for example defaulting to certain genders or ethnicities for particular professions.

• Do not generate images of real, identifiable people without their written consent.
• Avoid prompts that name public figures.
• Review sets of generated people for diversity and stereotyping before use.
• Never use generated images to depict real events, testimonials or customers.

Image models are good at mood and composition and weak at precision. Common failures include extra fingers, garbled text, distorted product details, impossible physics and incorrect brand elements.

For product imagery, this is a serious limit. Consumer protection rules in many markets require that advertising does not mislead. A generated image showing a product larger, glossier or with features it lacks can breach those rules. Use AI for backgrounds, scenes and concepts, and composite real product photography into them, rather than generating the product itself.

Requirements vary. The EU AI Act includes transparency obligations for certain synthetic content, with provisions phasing in over time. Platforms set their own rules: Meta, TikTok and YouTube label or require disclosure of realistic AI-generated content in some cases, especially in political and social issue ads. Google requires disclosure for synthetic content in election ads.

Some tools add Content Credentials metadata based on the C2PA standard, which records that an image was AI-generated. Do not strip that metadata. A clear internal policy, for example labelling any realistic generated image of a person or scene, is simpler than deciding case by case.

A short written policy covers most of the risk. These are the rules worth agreeing before scaling.

• Approved tools list: only tools whose commercial terms, data handling and indemnity your team has reviewed.
• Account rules: company accounts only, so terms and outputs belong to the business.
• Prohibited content: real people without consent, other brands’ marks, named artists’ styles, misleading product depictions, sensitive categories.
• Input rules: no confidential images, unreleased products or customer photos uploaded to tools that may train on them.
• Review step: every image checked for errors, bias and brand fit by a named person before publishing.
• Disclosure: when and how AI images are labelled, aligned with platform rules.
• Record keeping: tool, prompt, date, reviewer and where the image was used.

Mistakes will happen even with good rules. Decide in advance what to do when one is found after publishing: who removes it, who informs the client or platform, and how the cause is recorded. A short incident note, covering the tool, prompt, what went wrong and what changes in the process, turns each error into an improvement. Over time, the log of incidents shows which kinds of images need extra checks, such as hands, packaging text or people in sensitive settings, and which can move through review faster.