The fastest-moving topic in our industry right now is not the models, the prompts, or the platforms. It is the legal and policy ground shifting underneath everyone shipping generated creative. This post is the practical, non-paranoid summary we wish someone had handed us a year ago. Nothing here is legal advice — talk to your actual counsel — but everything here is a starting checklist.

The honest framing: the law and the platform policies are running months behind the technology, which means rules are being written in real time and reasonable people disagree about edge cases. The teams that will get blindsided are the ones operating as if the rules from 2023 still apply. The teams that will be fine are the ones running a small set of defensive practices that handle the foreseeable risks without paralyzing the workflow.

Question 1: Who owns the creative you generate?

This is the first question every legal team asks and it has a clearer answer than most people realize. Under current US and EU practice as of mid-2026, the human who directs the generation owns the output as far as commercial use goes. You can use it in ads. You can put it on your packaging. You can register the work as part of a broader copyrighted creative (a website, a video campaign, a commercial).

What you cannot do, in the US specifically, is register the AI-generated portion alone for copyright protection. The US Copyright Office has been consistent on this since the 2023 Thaler decision and the 2024 Allen ruling — there must be human authorship to register, and "prompt writing" alone is not (yet) considered sufficient authorship.

For ad campaigns this rarely matters. You are not registering your individual Instagram ads for copyright. Where it does matter: hero brand films, key visual assets you might want to defend against knockoffs, anything you would historically have hired a director to be the credited author of. For those, plan to add meaningful human editorial work after generation — color grading, sound design, sequencing, voice direction — to establish authorship clearly.

Question 2: Did your generation infringe someone else's IP?

This is the messier question. The major image and video models were trained on enormous corpora that included copyrighted material without explicit license. Several active lawsuits (Getty vs Stability AI, the NYT vs OpenAI suit, the visual-artist class actions) are working their way through courts and the outcomes will shape the next few years of practice.

What this means for you in practice: the risk is not that you are sued by the model vendor. The model vendor is the one defending the lawsuits. The risk is that your specific generated output happens to closely resemble an existing copyrighted work — a celebrity's face, a specific brand mascot, a well-known piece of art — and someone notices.

The defensive practice that handles this for 95% of cases: avoid prompting for known IP. Do not prompt "in the style of Studio Ghibli." Do not prompt for a "young Tom Cruise type." Do not prompt for "a Nike-style sneaker." These prompts produce outputs that are recognizable derivative work and they are the cases most likely to be enforced against you.

Generic prompts ("a young athletic woman holding a running shoe") produce generic outputs that nobody owns. Specific prompts to known IP produce risk. The bar is not "is this technically actionable" but "would a brand-protection lawyer at the IP holder look at this and reach for the phone." Mostly that bar is obvious in retrospect.

Question 3: Do you need to disclose that an ad is AI-generated?

This one is jurisdiction-specific and changing fast. As of mid-2026, the meaningful regulations are:

• EU AI Act — requires "clearly labeling" of AI-generated content that depicts real people or events in misleading ways. Pure product generation is not currently covered. Synthetic depictions of real people require labels.
• California AB-3211 — requires platforms to detect and label AI-generated content; advertiser-side disclosure obligations are still under rule-making.
• Meta and TikTok platform rules — require advertisers to self-disclose AI-generated content in any ad depicting real people, real events, or political content. Both platforms have expanded the scope twice in the past year.

The simple operational rule that handles the foreseeable rules: if the ad depicts a real person, a real event, or any politically sensitive subject, disclose. The disclosure can be as light as the platform's built-in "AI-generated content" toggle in the ad creation flow. The penalty for failing to disclose ranges from ad rejection to account-level enforcement, neither of which is worth saving the click of a checkbox.

Where you do not currently need to disclose (in most jurisdictions): product shots, abstract visuals, generic lifestyle scenes with non-real people, environmental shots. Most ad creative falls in this bucket and proceeds without disclosure friction.

Question 4: Did you use a real person's likeness?

This is the highest-risk area and the one we see the most accidents in. Generated images of "a smiling woman" sometimes happen to look strikingly like a specific real person, either by coincidence or because the training data over-represented that person. You can generate something that resembles a celebrity, an influencer, or an existing customer without ever intending to.

The defensive practice: do a reverse-image search on hero creative before it goes live in a campaign. Google Reverse Image Search, TinEye, and Yandex's image search are all free and take 30 seconds. If your generated face matches a real public figure with reasonable similarity, regenerate. This is a five-minute hygiene step that prevents the single most embarrassing failure mode in this space.

For ads that intentionally feature a real spokesperson: you need explicit written consent for the use of their likeness, the same as you would for a traditional photo shoot. AI generation does not change the consent requirement. It changes the technical means of production, not the legal nature of using someone's image.

Question 5: Are your claims still substantiated?

This is the area where AI generation creates a new failure mode that old creative review processes do not catch. When you generate an ad with the prompt "a serum that visibly tightens skin in 7 days," the model will happily produce an image showing dramatic skin tightening. If your product cannot deliver that result, you have just generated an FTC-actionable false advertising claim.

The model has no idea what your product actually does. It will visualize whatever you describe. The substantiation responsibility — making sure visual claims match what your product can deliver — sits entirely with you, and the speed of generation means you can produce dozens of unsubstantiated-claim ads before anyone notices.

Practical rule: every claim visible in a generated ad needs the same substantiation as a claim in a traditional ad. Before-and-afters need clinical backing. Numeric claims need study citations. "Doctor recommended" needs survey data. Generating these claims is fast. Substantiating them takes the same months as it always did. Plan the substantiation before the generation, not after.

Question 6: Are you respecting your training-data opt-outs?

This is a newer concern that most teams have not yet thought about. Many models now offer customers an opt-out from having uploaded reference images used to train future model versions. The default varies by vendor. The teams that handle this thoughtfully have a policy: all reference images uploaded for production generation are flagged opt-out by default.

Why this matters: your competitive moat as a brand is partly built on your reference image library. If those images leak into training data, future model versions can generate ads in your visual style for anyone willing to prompt for it. The opt-out is a small operational cost that protects a meaningful asset.

Question 7: Are your platform terms current?

The major ad platforms have updated their generative-AI policies multiple times in the past year. The policies that were in force when you set up your account are not the ones in force today. A short, low-effort defensive practice: have someone on the team subscribe to the policy update RSS feeds (or Twitter accounts) for Meta Business, TikTok Business, and Google Ads. Updates are typically announced with 30-60 days of lead time.

Pay particular attention to policies on: synthetic depiction disclosure, political and social-issue advertising rules, alcohol and gaming category rules, and any "sensitive industry" categories your business falls under. These are the areas where policy changes hit hardest.

Question 8: Are you logging what you generated and how?

This is the boring-but-critical operational practice. For every ad that ships, you should be able to produce — within an hour — the model that generated it, the prompt that was used, the reference images that were attached, the date and time, and the human who initiated the generation. This is your audit trail if anyone ever questions the provenance of a piece of creative.

Most platforms now log this automatically. Check that yours does, and check that the logs are retained for at least 24 months. The questions that will demand these logs are not predictable — they range from copyright disputes to platform policy disputes to internal brand-safety reviews — but having them ready makes the questions five-minute conversations instead of two-week investigations.

The 20-minute weekly habit that handles 90% of this

This sounds like a lot. In practice, the operational overhead reduces to a 20-minute weekly habit:

1. Reverse-image-search this week's hero creatives (5 minutes).
2. Confirm any claims-bearing ads have substantiation on file (5 minutes).
3. Confirm the platform's disclosure toggles match the content type (2 minutes).
4. Skim the platform policy update inboxes (3 minutes).
5. Spot-check that the generation logs are intact (5 minutes).

That is the whole compliance regime for normal-risk ad creative. Run it every Friday before the next week's ads launch and you are ahead of 95% of teams in this space.

When to escalate to actual lawyers

The 20-minute weekly habit is the floor. The escalation triggers — call your counsel before launching — are:

• Any ad depicting a real, identifiable person who has not signed a release.
• Any ad making a numeric performance claim about a regulated product (health, finance, supplements).
• Any ad targeting children or running in a market with strict children-advertising rules (UK, Sweden, Quebec).
• Any ad in a category where you have received a prior platform warning.
• Any ad you yourself feel uncertain about — the cost of a 30-minute counsel review is enormously less than the cost of an enforcement action.

None of this is meant to scare anyone off generative ad creative. The risks are real but they are also manageable with light, deliberate practice. The teams that are doing this well right now are not the ones who hired a "head of AI compliance." They are the ones who built five-minute habits into the existing creative workflow and stayed curious about the policy landscape. That is the bar, and it is reachable.