Picture a community health nonprofit. A volunteer who handles social media makes an AI image of a "patient," writes a recovery story to go with it, and posts it with no label. It looks great. Then a donor comments and asks if she is real.
There is no good answer to that question. The organization is about to lose something that took years to build, and it did not mean any harm. The volunteer was just trying to get a post out.
That story is the made-up case in one of my lessons (Riverbend Community Health), and it is the case I would show any team that has started using AI images and video. AI output is now good enough that viewers cannot tell. That is the business value, and it is also the risk.
I run Stepthrough, free hands-on AI and software training for white-collar workers. I built a course on Higgsfield (affiliate link: I may earn a commission, at no cost to you), and this is its last module. The rules apply to any AI image or video tool. This is not legal advice. Rules differ by country and state and change often, so have your counsel read your policy.
Not a ban: one page and three rules
A ban does not work, because people will use the tools anyway, just without telling you. A policy lets your team use them freely and tells them where the edges are. Three rules cover almost everything.
1. Disclose
If a reasonable viewer could think an AI image, video or voice is real, label it. Do it in two places:
- In the caption: "AI-generated" or "Made with AI."
-
In the platform's own setting:
- Instagram and Facebook: AI info
- TikTok: the AI-generated content toggle
- YouTube: the altered or synthetic content question in Studio
Obvious illustrations and cartoon mascots do not need a label, though they can carry one.
2. Get consent
A person's face, body and voice belong to them. Use them only with written consent for that specific use, and let them approve the final. That includes colleagues. "She works here" is not consent. Keep the form with the asset, and decide up front how fast you will take something down if someone withdraws consent.
3. Never deceive
A label does not fix this category, so it needs its own list:
- Fake testimonials, reviews, patients, customers or employees shown as real
- Real people, including public figures, shown doing or saying what they did not
- Fake events or "before and after" results
- Upscaled or edited images used as evidence of what something looked like
Go back to the opening story. Adding "AI-generated" to that post would not have saved it. A recovery story from a person who does not exist is a fake testimonial, and those are treated as deceptive advertising.
Read what your tool makes you responsible for
Most people never open the terms. I read Higgsfield's Terms of Use on October 29, 2026, and they put the responsibility on the user. Check the current version yourself, and do the same for any other tool you use:
| Section | What it says, in short |
|---|---|
| 4.2, 5.3 | You need the consents for any face, name or voice you upload |
| 5.2 | You may not impersonate anyone or pass AI output off as human-made |
| 5.5 | You disclose AI output where the law requires, and you keep provenance marks |
| 4.4 | Uploads, prompts and outputs may be used to train its models, unless you have a separate enterprise agreement |
The last row is the one marketing teams tend to miss. Do not upload client documents, unreleased products or private photos you would not want used that way.
Two more spots matter in practice:
- The upload agreement. The first time you upload a photo, Higgsfield asks you to agree that you own the media and that everyone visible in it has consented. Treat that checkbox as a real promise. Only tick it when it is true.
- Auto-publish new generations. In Settings, this puts every new image and video in the public Explore feed. Keep it off for client and unreleased work. Check this before your first client job, not after.
Add a check and a record
The three rules cover the big risks. Two small habits cover the rest.
Before publishing, read every word in the image or video. AI output gets prices, pay, dates and names wrong, and warps products and hands. Make sure what is shown is what you actually offer, and that no other company's logo has wandered in.
Keep a record for each AI asset you publish: the tool and model, the prompt, the input files, the consent form if a person appears, who approved it, and the date. When someone asks "where did this come from?" six months later, you can answer in a minute.
Name an owner
A policy nobody owns is a file nobody opens. Put one name on it, set a review date, and share it with everyone who posts for you. That includes the volunteer.
Try it, free
The module takes about 7 minutes and has 9 steps. You see the donor case, read the real terms, and sort four real outputs from the course into OK and not OK. One of them is not OK. There is a one-page policy template to download and fill in, with blanks for your owner, your record location and your review date.
Top comments (0)