Generative AI lets a five-person marketing team produce images, videos, voices and music at a volume that used to require an agency. It also raises three questions that every one of those assets must answer before publication: Who owns it? Whose face, voice or work is in it? And does it need a label? In 2026 the answers have become much clearer, because courts, regulators and platforms have all moved. This guide summarizes the rules in the US and the EU, the platform policies that enforce them in practice, and a checklist your team can apply to every asset.
This article is an overview for business owners, not legal advice. For specific campaigns, especially in regulated industries, involve a lawyer.
Who owns AI-generated content
The United States: human authorship is required
On 2 March 2026 the US Supreme Court declined to hear Thaler v. Perlmutter, leaving intact the rule that copyright requires a human author (Finnegan). The US Copyright Office’s report on AI (Part 2, January 2025) adds the practical detail: prompts alone are not enough to make you an author. What can be protected is the human contribution — selecting, arranging and modifying AI-generated material (US Copyright Office).
What this means in practice:
- A purely generated image or clip can be copied by a competitor, and you may have little recourse.
- A commercial assembled by an editor from dozens of selected shots, with a human-written script, voice-over and edit, has protectable human elements.
- Keeping records of your creative process — storyboards, selections, edits, versions — is no longer bureaucracy. It is your evidence.
The EU: the same logic, different routes
EU copyright law protects works that are the author’s own intellectual creation, which points in the same direction: protection follows human creative choices. The bigger change in Europe is not ownership but transparency, covered below.
Your contract matters as much as the law
When an agency or studio produces AI content for you, the contract should state who owns the deliverables, which tools and licenses were used, and how long AI characters or digital twins may be used. European AI studios now write commercial licenses and usage terms for AI characters, for example 24 months, directly into their contracts (Mai Dreams Lab).
Training data and tool risk
Many popular models are the subject of litigation over the data they were trained on. That does not make every output illegal, but it affects risk, especially when outputs resemble known characters or works.
| Tool or model | Status (October 2026) |
|---|---|
| Midjourney | Lawsuits by Disney, Universal and Warner Bros. Discovery consolidated; summary judgment motions due by 23 November 2026 (Wikipedia, AI Lawsuit Tracker) |
| MiniMax (Hailuo) | Sued by Disney, Universal and WBD in September 2025 (Wikipedia) |
| Seedance (ByteDance) | Cease-and-desist letters from Disney and Netflix; criticized by the MPA and SAG-AFTRA (Wikipedia) |
| Suno | Sued by UMG and Sony; second lawsuit over 60,202 recordings filed 18 September 2026; lost to GEMA in Munich on 31 July 2026 (Wikipedia) |
| Udio | Settled with UMG in October 2025 and moved to a “walled garden”; users had 48 hours to download their tracks (Wikipedia) |
| Adobe Firefly, Moonvalley Marey | Positioned as commercially safe or trained on licensed data (Adobe, BetaKit) |
Two practical rules follow. First, never put recognizable characters, celebrities or other brands’ assets into prompts or references for commercial work. Second, for high-visibility campaigns, prefer tools positioned as commercially safe and services that check outputs for similarity to existing likenesses and brands — Higgsfield, for example, offers similarity scoring for this purpose (Higgsfield).
The licenses of the tools themselves
Even when the law is clear, the tool’s own terms can block commercial use. Free tiers are the usual trap.
| Tool | What the terms say |
|---|---|
| Recraft | Free plan: Recraft owns the images and commercial use is prohibited. Paid plan: full ownership, retained after cancellation (Recraft) |
| FLUX.2 (Black Forest Labs) | API outputs may be used commercially without extra fees; self-hosting some weights requires a commercial license (BFL) |
| Midjourney | Commercial use on paid plans |
| ElevenLabs | Commercial license from the Starter plan at $6 per month (ElevenLabs) |
| Meshy (3D) | Free plan under CC BY 4.0 with attribution; paid plans keep assets private (Meshy) |
| Tripo (3D) | Free plan non-commercial only |
Likeness and voice: consent comes first
A realistic face or voice of a real person is the most sensitive element of any AI asset.
- United States. The federal NO FAKES Act (S.4591) cleared the Senate Judiciary Committee in June 2026, but on 30 September 2026 an attempt to pass it quickly through the full Senate was blocked, so it is not law (Holland & Knight, GovTrack). State laws already apply, such as Tennessee’s ELVIS Act, in force since 1 July 2024 (Sirency).
- European Union. Realistic synthetic depictions of real people are deepfakes under the AI Act and must be disclosed (see below), and a person’s image and voice are personal data under the GDPR.
- Kazakhstan. The AI law No. 230-VIII, in force since 18 January 2026, requires synthetic content to be labeled and users to be told when a service uses AI (EY).
A solid release for a digital twin or voice clone names the channels, languages, territories, duration of use and what happens when the person leaves the company or withdraws consent. Store it with the asset.
Labeling: EU AI Act Article 50
Article 50 of the AI Act is the rule that changes daily marketing work in Europe.
- Since 2 August 2026, whoever publishes a deepfake (the “deployer”) must disclose it clearly at the first exposure, for example with an “AI” icon (“KI” in German, “IA” in French and other languages). Evidently artistic, satirical or fictional works have a lighter regime (TechPolicy.Press).
- Advertising usually does not qualify for the lighter regime, according to the Commission’s final guidelines of 20 July 2026, and the obligation can arise with any publication on the open internet (Faegre Drinker, Reed Smith).
- Visible means visible. A line in the end credits is not enough for realistic deepfakes; AI avatars and digital twins in ads must be disclosed (European Commission FAQ).
- Providers of generators must mark outputs in a machine-readable way — at least two marks, such as signed metadata plus an invisible watermark. The Digital Omnibus gives a delay to 2 December 2026 only to providers of systems placed on the market before August 2026 (CSA).
- Fines reach up to €15 million or 3% of global turnover; for SMEs the lower of the two applies (ActuIA).
Article 50 also requires chatbots and voice agents to tell people they are talking to an AI. For the full picture, read our guides to Article 50 transparency and the EU AI Act for small and mid-sized businesses.
Outside the EU, California’s SB 942 and AB 853 require labeling and disclosure tools from generative AI providers with more than one million users from 2 August 2026 (GC AI).
Platform rules: the de facto enforcement
Regulators move slowly; platforms label content today.
| Platform | Rule |
|---|---|
| YouTube | Disclose realistic AI content and AI music when it is central to the video; automatic labels via C2PA metadata and detectors; systematic non-disclosure can lead to removal and exclusion from the Partner Program (YouTube Help) |
| Meta | Since 1 June 2026 AI in ads is detected automatically and an “AI info” label appears under “About this ad”; political ads must self-disclose (Meta) |
| TikTok | Realistic AI content must be labeled; automatic C2PA labels cannot be removed; ads need an AIGC label or disclaimer (Common Thread Collective) |
| Steam | Disclosure of AI content that players see (PC Gamer) |
Because many generators embed provenance data — Google’s Veo and Nano Banana outputs all carry a SynthID watermark, for example (CloudZero) — assume platforms will know when content is AI-made. Disclosing it yourself is cheaper than being flagged.
One more rule that catches marketers: the US Federal Trade Commission bans fake reviews and testimonials, including AI-generated ones (FTC). AI “customers” praising your product are not a gray area.
Music: the most toxic zone
Music deserves its own warning. Beyond the litigation, Suno’s paid plans cap downloads at 20 tracks per month on Pro and 60 on Premier (Wikipedia), even after the v6 release that, according to the company, was developed with WMG, BMG and Believe (Music Business Worldwide). A partnership with some labels does not settle the claims of others. For ads, use licensed stock or services built together with labels, such as Eleven Music, which is cleared for commercial use (Wikipedia).
Who is responsible: the brand, the agency or the tool?
Responsibilities are split along the supply chain, and it helps to know who carries which part:
- The tool provider (the company behind the generator) must build in machine-readable marking of outputs under Article 50 and set the license terms for what you may do with the results.
- The deployer — whoever publishes the content — carries the duty to disclose deepfakes. For a campaign, that is usually the brand, even if an agency produced it.
- The agency or studio is responsible for what it delivers under the contract: licensed tools, cleared music, signed releases, preserved metadata and documented human contribution.
In practice, the brand cannot outsource the risk by outsourcing the production. Put the duties into the contract: the producer warrants that tools and plans allow commercial use, that all people depicted have signed releases, that metadata is preserved and that a production log is handed over with the files. The brand decides on labeling per channel and market and keeps the records.
A compliance checklist for every AI asset
- Tool and plan: Is commercial use allowed on the plan used? Record tool, model version and date.
- Inputs: No celebrities, third-party characters, logos or artworks in prompts or references without permission.
- People: Signed release for any real face or voice, covering channels, languages and duration.
- Music: Licensed for every channel and market where the asset runs.
- Human contribution: Keep storyboards, selections and edit history.
- Labeling: Visible AI disclosure where Article 50 or platform rules require it; keep C2PA metadata intact.
- Claims: No AI-generated reviews, testimonials or fake “customer” content.
- Log: Store all of the above with the asset so you can answer a platform, client or regulator within minutes.
Typical mistakes
- Assuming you own whatever you generate. In the US, purely generated output is not protected.
- Using free-tier tools for client work, then discovering the terms forbid it.
- “Inspired by” prompts naming living artists, celebrities or famous characters.
- Cloning a voice “just for the demo” without consent, then using the demo in production.
- Hiding AI disclosure in end credits or the video description.
- Stripping metadata to avoid labels, which conflicts with platform rules and undermines trust.
- AI music in paid campaigns without a clear commercial license.
- No log, so nobody can reconstruct how an asset was made when questions arrive.
Conclusion
The rules for AI-generated content have matured. In the US, protection follows human authorship, and likeness is protected by state laws. In the EU, Article 50 makes visible disclosure of deepfakes mandatory, and advertising rarely qualifies for exceptions. Platforms detect and label AI content whether or not you disclose it. None of this makes AI content risky to use — it makes undocumented AI content risky. Teams that keep a simple log, use paid plans with clear licenses, get written consent and label by default can produce at AI speed without legal surprises.
If you want a production process where licensing, consent and labeling are built into every asset, book a free 15-minute audit. Our Studio team produces AI media with C2PA metadata, labels and release management by default, and our Growth team applies the same rules to performance creatives. For production specifics, see our guide to AI video commercials.