Get in touch
Method
AI and the law

Can we, should we ask, or must we not? GenAI on real productions: what the law, the unions and the distributors ask for.

We use generative AI next to classic VFX on commercials and films, and every job raises the same questions: who owns the result, who has to agree, what needs a label, and what the production will ask for at delivery. This is what we have learned, checked against the texts of laws, union contracts and distributor policies.

For VFX vendors, producers, agencies and brands. US and EU, from the bid to the release.

Checked on

01

What we’d heard, and what we found

Things producers and vendors told us, or we believed ourselves, checked against the texts. The verdicts are our reading, on the date at the top.

  • “A human in the loop makes GenAI output copyrightable.”

    Our reading: Partly true

    What counts is human authorship you can see in the final frame, not a human being present.

    Prompting, re-rolling and picking the best take do not make you the author: the US Copyright Office said so in January 2025, and courts in Prague (2023) and Munich (February 2026) agree. In March 2026 the US Supreme Court refused to hear Thaler, so in the US a human author is required.

    Protection comes from human expression that stays visible: the plate and the actor’s performance, your 3D and concept art used as guides, your comp and paint, and the creative selection and arrangement of the pieces. Even then, only the human parts and the work as a whole are protected, not the raw AI pixels. (The “man in the middle” you may have heard is a network-security term; the legal idea is human authorship.)

    Sources:US Copyright OfficeSupreme Court docketMunich ruling

  • “Distribution always asks, at the end of post, for tracking on every shot where GenAI was used.”

    Our reading: Partly true

    Common on streamer and studio work, but it’s not “always”, and it starts well before the end.

    Netflix wants GenAI use declared up front, and written approval before GenAI reaches final picture and sound or touches talent. End-of-post questions come from insurers, US copyright registration and awards bodies.

    In advertising there is usually no distributor: the questions come from the agency and the brand at the start, and from labelling rules at release.

    Sources:NetflixRegistration guidanceE&O underwriting

  • “That audit is US law, EU law or a worldwide rule.”

    Our reading: Not as stated

    No law asks for a per-shot AI log. Contracts and distributor policies do.

    But several rules can only be met if someone knows which shots used AI:

    • the EU deep-fake label (since 2 August 2026);
    • New York’s disclosure for synthetic performers in ads (since 9 June 2026), and California’s (signed in September 2026, reported to apply from 1 January 2027);
    • the US Copyright Office’s disclosure when a work is registered;
    • Italy’s film tax credit, which requires the credits to say where AI was used.

    Sources:EU Art. 50 guidelinesNY GBL §396-bCalifornia SB 1050Registration guidanceItaly, tax credit criteria

  • “There is an industry traffic light: green, yellow, red.”

    Our reading: Partly true

    We found no published colour code, but Netflix’s guidance has the same shape.

    Low-risk uses you just declare, uses that need written approval, and things you don’t do. The traffic light on this page is our own reading of the rules, with a source on every row.

    Sources:NetflixIPA/ISBA

  • “Anything that lets an actor’s image train an AI is red.”

    Our reading: Mostly true

    Training without specific consent is red. With it, a model for one job is yellow.

    The SAG-AFTRA Commercials contract bars using union footage to train GenAI without the union’s consent, and Netflix bars training on talent likeness or voice without clearance. A model of one performer for one job, with specific written consent, secure storage and deletion at the end, can be done. Training a general model, or reusing the model on another job, can’t.

    Sources:SAG-AFTRA CommercialsNetflixEDPB on AI models

  • “We’re covered if the contract says the production holds the actors’ written consent, the data leaves the EU to an aggregator, and the aggregator’s enterprise plan doesn’t train on it and deletes it.”

    Our reading: Right direction, not enough

    Good bones. Name the uses, name every hop, write the real retention.

    • Make the consent a warranty with an indemnity that names the AI uses, tools and territories.
    • List the aggregator and the model provider behind it as sub-processors, with where each one runs and the legal route for each transfer.
    • Write the real retention period: “deleted” is rarely immediate, and several tools keep data for up to 30 days.
    • An aggregator’s enterprise terms may not bind the model provider behind it.
    • No contract can pass on a deepfake crime: criminal liability may be personal.

    Sources:EDPB on processorsGDPRItaly, Law 132/2025

  • “A rule says a regenerated performance can’t stay in the final shot, so we mask the original face back in.”

    Our reading: Not a rule, a good practice

    The rule is consent, a specific description of the use, and pay. Not the original pixels.

    Under the SAG-AFTRA TV/Theatrical and Commercials contracts, altering a recorded performance needs the performer’s consent unless it stays “substantially as scripted, performed and/or recorded”, or is routine post (cosmetics, wardrobe, timing, continuity, VFX). The 2026 TV/Theatrical deal makes explicit that a replica built from the production’s own footage, with no scan, is still a digital replica: exactly the video-to-video “regenerated” actor.

    Masking the original face back in helps a shot stay “as performed”. But a consented, fully generated face is allowed, and a mask doesn’t fix an unconsented change to body, movement or voice. See the sketches.

    Sources:SAG-AFTRA TV/TheatricalSummary of the 2026 dealSAG-AFTRA Commercials

  • “It’s only about the face.”

    Our reading: Not as stated

    Voice, body and movement count too.

    The union contracts speak of “voice or likeness” and “voice, image and/or performance”, and US state laws cover voice. In commercials, changing physical traits (hair, eye colour, an accent) or nudity needs extra consent. The face appears in the commercials contract only to decide the performer’s pay category.

    Sources:SAG-AFTRA TV/TheatricalSAG-AFTRA CommercialsCal. Labor Code §927

  • “The audit will check that we kept the original face.”

    Our reading: Partly true

    Nobody checks masks. They ask for the consents and a list of AI shots.

    Whether a shot kept the original face and performance is exactly what your log should record: it’s your evidence that the shot stayed “as performed”. In the EU it also decides the label: real, unaltered actors in front of an AI background are not a deep fake; a replaced face is.

    Sources:NetflixEU Art. 50 guidelines

  • “We only need to track AI shots if the contract asks for it.”

    Our reading: Partly true

    A log as a deliverable is a contract matter. The risk of not keeping one is yours anyway.

    GDPR already asks a processor to keep records of its processing and to help the production with audits (by type of processing, not shot by shot). Without a per-shot log you can’t get labels right, prove consents and approvals, support a copyright registration, honour a consent withdrawal, answer an insurer, or claim a tool’s IP indemnity. What to log.

    Sources:GDPRE&O underwriting

02

The traffic light

What a vendor can just do, what needs the production’s written OK first, and what not to do at all. Open a row for the reason and the source.

Green

Usually low risk. Log it and declare it in the bid.

  • Moodboards, storyboards, previz and pitch frames, with no real person’s likeness, no named third-party IP and nothing confidential.

    Ideation is the low-risk end of Netflix’s guidance. Use paid tiers that don’t train on your inputs.

    Sources:NetflixIPA/ISBA

  • Assistive AI in post: roto, paint-out, clean-up, denoise, upres, retime, relight, removing passers-by.

    Routine post: no union consent while the performance stays as performed, and not a deep fake under the EU guidelines.

    Sources:SAG-AFTRA TV/TheatricalEU Art. 50 guidelines

  • Cosmetic, wardrobe and continuity fixes that keep the performance as performed.

    Carved out in the union contracts (a shirt colour change is their own example). Not for product results: see red.

    Sources:SAG-AFTRA TV/TheatricalSAG-AFTRA Commercials

  • An AI sky, environment or set extension behind real, unaltered actors.

    One of the EU guidelines’ own “not a deep fake” examples. On streamer titles, AI in final picture still needs approval.

    Sources:EU Art. 50 guidelinesNetflix

  • AI shots built on your own human inputs (plates, concept art, 3D layout, depth or pose passes), finished by hand.

    Human expression stays visible, so the human parts and the shot as a whole can be protected.

    Sources:US Copyright Office

  • Enterprise or API tiers with written no-training terms, a processing agreement and a known data location.

    Keeps the tool a processor of the footage, not a user of it for its own purposes.

    Sources:EDPB on processorsNetflix

Yellow

Get it in writing first, from the production, agency or brand.

  • Any GenAI pixels in the final picture or sound of a streamer or studio title, even a sign in the background.

    Netflix: escalation and written approval before delivery.

    Sources:Netflix

  • Main characters, creatures, hero props, key visuals, or brand assets the brand wants to own (logo, mascot, packshot).

    Purely generated material may not be protected by copyright (a Munich court refused AI logos in February 2026). Logos and mascots rely mainly on trademark registration, so plan the protection with the brand.

    Sources:Munich rulingUS Copyright Office

  • Face replacement, de-ageing, a digital double, visual ADR, a new expression, line reading or action.

    A digital replica or alteration: specific signed consent and pay. In the EU, a deep fake that needs a label.

    Sources:SAG-AFTRA TV/TheatricalSAG-AFTRA CommercialsEU Art. 50 guidelines

  • Changing physical traits: age, hair, eyes, skin colour, body shape, accent.

    Extra consent in SAG-AFTRA commercials. In France and Norway, ad images with an altered body can need a “retouched” label.

    Sources:SAG-AFTRA CommercialsFrance, retouched photosNorway, retouched ads

  • Voice cloning, AI dubbing, re-timing lips to a new language.

    Voice counts like the face. Under the 2026 SAG-AFTRA deal, a replica voice in another language needs consent (for pictures and contracts from 1 July 2027).

    Sources:SAG-AFTRA TV/Theatrical

  • A job-specific likeness model of a performer (a LoRA, an embedding, a digital double).

    The model is personal data: specific written consent, secure storage, deletion at the end, certified.

    Sources:EDPB on AI modelsSAG-AFTRA CommercialsNetflix

  • A fully synthetic human (not a real person) in an ad.

    New York requires a disclosure since 9 June 2026 when it’s prominent; California from 2027 (reported). SAG-AFTRA spots pay fees for it. The EU guidelines treat a realistic synthetic influencer testing a real product as a deep fake.

    Sources:NY GBL §396-bCalifornia SB 1050SAG-AFTRA CommercialsEU Art. 50 guidelines

  • Uploading identifiable cast or crew footage, or unreleased material, to any outside AI tool.

    The production authorises each tool in writing, and each transfer outside the EU needs a legal route.

    Sources:EDPB on processorsNetflixChannel 4

  • Realistic scenes of events that never happened, or realistic AI people, in an ad shown in the EU.

    A deep-fake label at first exposure. Ads count as “evidently creative” only case by case: the EU guidelines exclude a teleshopping-style ad with simulated consumers.

    Sources:EU Art. 50 guidelines

  • Fully generated shots where the brand or the production expects exclusive copyright.

    They may not be protectable. Say so in the contract.

    Sources:US Copyright OfficeAICP

  • Footage of real people on a tool hosted in, or reachable from, China.

    China has no EU adequacy decision (Ireland fined TikTok €530m over access from China in 2025). It needs the production’s written approval of that sub-processor, a transfer route and a transfer impact assessment. Without them, it’s red.

    Sources:Irish DPC on TikTokGDPR

Red

Don’t, even if someone asks informally.

  • Training or fine-tuning any model on an actor’s face, voice or performance without specific written consent (and the union’s, where required).

    Barred by the SAG-AFTRA Commercials contract and by Netflix’s policy, and without a legal basis under GDPR.

    Sources:SAG-AFTRA CommercialsNetflixGDPR

  • Putting talent footage into tool tiers whose terms let the tool train on your inputs.

    Several standard web tiers do. Training can’t be undone, and some opt-outs only work going forward.

    Sources:EDPB on AI models

  • Prompting with a real person’s name or photo, or with named characters, artists or brands.

    The union contracts require consent and pay for name or image prompts, and studios are suing tools over look-alike characters.

    Sources:SAG-AFTRA TV/TheatricalSAG-AFTRA CommercialsDisney v. MiniMax

  • Look-alikes or sound-alikes of celebrities, public figures or the deceased without written clearance; fake endorsements or testimonials.

    Publicity rights (California, New York), deceased-performer laws, Italy’s deepfake crime, the FTC’s rule on fake testimonials and the ad codes.

    Sources:Cal. Civil Code §3344NY Civil Rights Law §50-fItaly, Law 132/2025FTC fake reviews ruleASA on deepfakes

  • Sexual or nude depictions of a real, identifiable person without explicit consent; anything sexual involving a minor’s likeness.

    Banned under the EU AI Act from 2 December 2026, and a crime in the UK, Italy, France and under the US TAKE IT DOWN Act.

    Sources:Reg. 2026/1744UK intimate imagesTAKE IT DOWN Act

  • AI product imagery that shows results the product can’t deliver.

    Misleading in the UK, the EU and the US, and a “made with AI” line doesn’t fix it. The world around the product can be AI; its performance must be real.

    Sources:ASA on AI disclosureFTC v. ColgateEU Art. 50 guidelines

  • Reusing a person-specific model or an AI-altered likeness on another job, in R&D or in your showreel without fresh consent.

    It goes beyond the agreed purpose, and publishing it can be a crime in Italy if it causes harm.

    Sources:GDPRItaly, Law 132/2025Garante decision

  • Feeding stock footage or images into tools that train on uploads or show outputs publicly.

    Stock licences now limit AI use: Getty’s bans it outside narrow cases; Artlist’s bans tools that claim rights in outputs or share them.

    Sources:Getty licenceArtlist licence

  • Deliberately removing watermarks or provenance data to hide that something is AI.

    Tools that signed the EU Code of Practice ban it in their terms, China and India ban it outright, and Google’s SynthID survives grading anyway. Routine loss in the pipeline (EXR, conform) is different: log it.

    Sources:EU Code of PracticeChina labellingSynthID

Our reading of the rules, not an industry standard. Context, the contract or the territory can move any row up a colour. Checked on 17 October 2026.

03

Same shot, two routes

One frame done two ways: one that needs consent and paperwork, one that carries less risk. Orange is generated, white is the original plate or human work. These are placeholder sketches; the real frames will be shot with consent.

The face
AI-generated face

Fully regenerated face and performance

A digital replica or alteration: it needs the performer’s specific written consent, replica terms and pay and, in the EU, a deep-fake label.

Real frame to come: The driver at night, with face and performance regenerated by a video-to-video model.

Original performance · AI environment

Original performance kept, AI on the world around it

Not a deep fake under the EU guidelines. Still log it, and on streamer titles get approval for AI in final picture.

Real frame to come: The same frame: face untouched from the plate, city lights and rain outside the windows generated.

The body
Original face · new action

Face kept, performance changed

Body and movement are part of the likeness: putting the real face on an action the actor never did still needs consent.

Real frame to come: The original face composited on an AI body leaning out of the window and waving.

Original performance · clean-up

Clean-up only

A stray hair removed, a reflection cleaned: routine post, usually within the standard union carve-outs.

Real frame to come: The original plate with only a cosmetic fix, marked.

Copyright
“an epic canyon at dusk, cinematic, 8k”Prompt only

Generated from a text prompt

In the US, and in European courts so far, likely not protected on its own.

Real frame to come: A wide hero environment generated from a prompt, with the prompt shown over it.

3DPAINTHuman inputs · finished by hand

Built on your 3D and concept art

The artist’s blockout and painting stay visible in the result: the human parts and the shot as a whole can be protected.

Real frame to come: The same shot, with the 3D blockout and the concept painting it was guided by as insets.

The product
AI improves the result

The product does better than it can

Likely misleading in the UK, the EU and the US, and a “made with AI” line doesn’t fix it.

Real frame to come: A skincare close-up where AI makes the skin flawless beyond what the product does.

Real result · AI set

Real result, AI on the set

The product does what the shot shows. Normally no EU label, as long as nothing misleads.

Real frame to come: The real result on the real model, with only the set and the light generated.

Generated Original plate or human-made Lower risk Needs consent or approval Don’t

04

Does this shot need an EU label?

Article 50 of the AI Act, as the Commission’s July 2026 guidelines read it. Since 2 August 2026, a deep fake shown in the EU needs a label.

  1. 1Does the shot use AI to generate or change picture or sound?

    NoNo label. Log it anyway.

  2. 2Does it resemble real people, objects, places or events, and could it falsely look authentic?

    NoNot a deep fake: no label. Colour, clean-up, removing passers-by and aesthetic set extensions usually aren’t.

  3. 3Was it generated before 2 August 2026?

    YesNo label needed after the fact.

  4. 4It’s a deep fake. What kind of work is it?

    Part of an evidently artistic, creative or fictional work

    Disclose it in a way that doesn’t spoil the work, for example in the credits. Trailers, clips and cut-downs are separate exposures and need their own.

    Anything else, most ads included

    A clear label or icon at the first exposure, “AI generated” or “AI modified”. Ads count as evidently creative only case by case.

05

Where the footage goes

Every hop a face or a voice takes, and the document that covers it. The production is often in the EU and so are we, in Malta; the aggregator and the model behind it usually aren’t.

  1. PerformerThe person on screenAnywhere
  2. From Performer to Production, agency or brand, covered by:
    • Talent contract with a specific AI consent
    • Image release
    • Union rider, where it applies
    • Privacy notice
  3. Production, agency or brandControllerEU, UK or US
  4. From Production, agency or brand to VFX vendor, covered by:
    • Statement of work naming the AI uses
    • Data processing agreement
    • Approved sub-processor list
    • Warranty and indemnity
  5. VFX vendorProcessorMalta, in our case
  6. From VFX vendor to Aggregator, covered by:
    • Enterprise terms: no training, retention, region
    • The aggregator’s processing agreement
    • Transfer route: Data Privacy Framework or standard contractual clauses
  7. AggregatorSub-processorUS or EU
  8. From Aggregator to Model provider, covered by:
    • The model provider’s own terms
    • Where it actually runs

    The hop people forget: the aggregator’s promise may not reach here.

  9. Model providerSub-processorUS, Singapore, China…

Output, with its watermark or Content Credentials

If a performer withdraws consent

  1. The performer withdraws consent.
  2. The production tells you.
  3. You stop, delete the sources and the likeness models, and re-do the shots affected (back to the plate).
  4. The production deals with what is already published.

Criminal liability for a deepfake may be personal: no contract passes it up the chain.

06

US and EU, side by side

The rules that matter most for GenAI in VFX and advertising: what kind of rule each one is, who it binds, and what the vendor does about it.

United States

  • CourtHuman authorship

    Settled: the Supreme Court refused Thaler on 2 March 2026.

    Binds
    Anyone claiming copyright.
    The vendor
    Keep human expression visible, log the human work, never promise rights in raw AI pixels.

    Thaler v. PerlmutterSupreme Court docketUS Copyright Office

  • AgencyCopyright registration disclosure

    Since March 2023.

    Binds
    Whoever registers: usually the production, studio or brand.
    The vendor
    Supply a short human-authorship statement and the list of AI material to exclude.

    Registration guidance

  • UnionSAG-AFTRA TV/Theatrical 2026

    1 July 2026 to 30 June 2030.

    Binds
    Signatory producers; vendors through their contracts.
    The vendor
    Consent with a reasonably specific description, plus pay, for replicas and alterations. A replica from the production’s own footage counts. Scanning needs an “articulable business reason”.

    SAG-AFTRA TV/TheatricalSummary of the 2026 deal

  • UnionSAG-AFTRA Commercials 2025

    Since 1 April 2025, three-year deal.

    Binds
    Signatory advertisers and producers.
    The vendor
    Ask for the signed Digital Replica Rider. Extra consent for physical-trait changes. No training on union footage without the union’s consent. Delete replicas and certify it within 90 days.

    SAG-AFTRA Commercials

  • LawDigital-replica contract laws (California Labor Code §927, New York GOL §5-302)

    In force since 2025.

    Binds
    Talent contracts.
    The vendor
    A vague replica clause is unenforceable unless the performer had a lawyer or a union. Check which consent covers each shot.

    Cal. Labor Code §927NY GOL §5-302

  • LawPublicity rights of living people (California §3344, New York §§50–51)

    In force; California added fast court orders in 2026.

    Binds
    Anyone using a name, likeness or voice in advertising.
    The vendor
    Look-alikes and sound-alikes in ads are actionable even with no real footage, and an AI voice clone can be. Clear them with the talent, or cut them.

    Cal. Civil Code §3344Lehrman v. Lovo

  • LawDeceased performers (California §3344.1, New York §50-f, Tennessee ELVIS Act)

    In force; New York tightened in December 2025.

    Binds
    Anyone who makes or uses the replica, which can include the vendor.
    The vendor
    Written consent from the estate before any replica.

    Cal. Civil Code §3344.1NY Civil Rights Law §50-f

  • LawSynthetic performers in ads (New York GBL §396-b, California SB 1050)

    New York since 9 June 2026; California signed 16 September 2026, from 1 January 2027 (reported).

    Binds
    The advertiser, or whoever creates the ad (in New York: with actual knowledge).
    The vendor
    Flag every featured synthetic human, visual or voice, on the disclosure sheet. New York exempts audio-only ads, ads for films, series and games consistent with the work, and AI used only to translate.

    NY GBL §396-bCalifornia SB 1050

  • LawFTC: fake reviews and testimonials, endorsements

    Rule in force since October 2024.

    Binds
    Whoever creates or uses the testimonial.
    The vendor
    No AI “customers” describing results they never had, no cloned celebrities recommending. Virtual influencers count as endorsers.

    FTC fake reviews ruleFTC Endorsement Guides

  • LawBiometrics: Illinois BIPA

    In force; class actions continue in 2026.

    Binds
    Anyone who captures face geometry of Illinois residents.
    The vendor
    A written release before a face scan, and a published retention and deletion schedule.

    Illinois BIPA

  • BillNO FAKES Act

    On the Senate calendar since 24 June 2026. Not law.

    Binds
    Would bind anyone making or distributing unauthorised replicas.
    The vendor
    Watch it.

    NO FAKES Act

European Union

  • LawHuman authorship

    The EU “author’s own intellectual creation” test; Italy wrote “human” into its copyright law in October 2025. No EU Court ruling on AI output yet.

    Binds
    Anyone claiming copyright.
    The vendor
    As in the US. Also get written IP assignments from staff and freelancers: in Malta, for example, employees keep copyright in non-software work unless agreed otherwise.

    Italy, Law 132/2025Malta Copyright Act

  • LawAI Act Art. 50(4): deep-fake labels

    Applies since 2 August 2026, not delayed. Fines up to €15m or 3% of turnover.

    Binds
    Deployers: whoever decides whether and how AI is used.
    The vendor
    Agree who the deployer is, classify each shot, label at first exposure. The decision flow.

    AI ActEU Art. 50 guidelines

  • LawAI Act Art. 50(2): machine-readable marking

    Applies since 2 August 2026; tools already on the market have until 2 December 2026. Code of Practice final on 10 June 2026.

    Binds
    Tool providers, and you if you put your own generative tool into service under your name.
    The vendor
    Keep the markings. Check whether your tools signed the Code.

    AI ActEU Code of PracticeReg. 2026/1744

  • LawAI Act: new bans on intimate deepfakes

    Added in July 2026 (Reg. 2026/1744); applies from 2 December 2026. Fines up to €35m or 7%.

    Binds
    Providers and deployers.
    The vendor
    No AI intimate or sexual imagery of an identifiable person without explicit consent, and nothing that could depict a minor.

    Reg. 2026/1744

  • LawAI Act Art. 4: AI literacy

    Since 2 February 2025; reworded in July 2026. National regulators supervise from August 2026 (in Malta, the MDIA).

    Binds
    Every company that uses AI tools, for staff and freelancers working for it.
    The vendor
    A one-page AI tool policy, short training, and a note of who had it.

    AI literacy Q&AMalta AI authorities

  • LawGDPR: lawful basis and consent

    In force.

    Binds
    The controller: the production, agency or brand.
    The vendor
    Ask for a separate, specific AI consent. Consent can be withdrawn, so consider the contract for the core performance plus explicit consent. A DPIA is likely for likeness models and face replacement.

    GDPREDPB on consentEDPB on AI models

  • LawGDPR: processor duties and transfers

    In force. The EU–US Data Privacy Framework is valid; its appeal is pending.

    Binds
    You, as processor and exporter.
    The vendor
    Processing agreement, sub-processor list, records, security, deletion. Outside the EU: a certified US recipient or standard contractual clauses, and know where each model runs.

    GDPREDPB on processorsNote on the DPF

  • LawImage rights and deepfake crimes

    Italy art. 612-quater c.p. (since 10 October 2025: 1–5 years, usually on the victim’s complaint); France Code pénal 226-8; Germany KUG §22. Bills in Spain, Germany and Denmark.

    Binds
    Whoever publishes or spreads the content.
    The vendor
    Get an image release for commercial use as well as the GDPR consent.

    Italy, Law 132/2025Denmark bill

  • FundingPublic funding and tax credits

    Italy: GenAI criteria for the film tax credit since April 2025. France: the CNC announced in May 2026 it won’t fund works without a human author.

    Binds
    Producers claiming them, and their vendors by contract.
    The vendor
    Stay inside the performers’ written AI consents, and log AI use per shot so the producer can write the credits line Italy requires.

    Italy, tax credit criteriaCNC announcement

  • UnionCollective agreements (e.g. Germany’s KI-Tarifvertrag)

    Germany: since March 2025; its fixed term ended 30 June 2026, renewal unconfirmed.

    Binds
    Producers and actors bound by them.
    The vendor
    The same model as SAG-AFTRA: consent and pay for replicas and AI alterations.

    KI-Tarifvertrag

United Kingdom

  • UK copyright still protects “computer-generated works” with no human author (s9(3) CDPA). The government proposed removing that in March 2026; there is no bill yet.
  • No AI-labelling law, but the ASA and CAP rules apply in full however an ad is made, and the advertiser stays responsible.
  • Creating, or asking for, an intimate deepfake of an adult without consent is a crime since 6 February 2026.
  • Equity and Pact: an AI clause was reported close in September 2026. We found no ratified agreement yet.
  • Channel 4 wants AI use approved in advance and tools documented; BFI-funded projects must report AI use for the life of the project.

UK reportASA on deepfakesUK intimate imagesChannel 4

Rest of the world

  • China: since 1 September 2025, AI content carries a label and metadata naming the provider, and nobody may strip them. Domestic Chinese tools write that metadata into your files.
  • South Korea: the AI Basic Act applies since 22 January 2026. Deep fakes need a visible label, and a company selling AI services such as de-ageing can itself be a regulated operator.
  • India: since 20 February 2026, platforms must label synthetic content and act on takedown orders within three hours.
  • Japan: the famous training exception does not cover fine-tuning on one artist’s works to output their expression.

China labellingKorea AI Basic ActJapan

07

Phase by phase

What to do and what to collect, from the bid to the release.

  1. Pre-production and bid

    Do

    • Ask first: is anyone in the cast union? Is the production or advertiser a signatory? Where will it run (EU, New York, California, UK)? Does the distributor, agency or brand have an AI policy? Is there a tax credit or public funding with AI rules? Will anyone register the copyright in the US?
    • List the planned AI uses per sequence in the bid, with the tool and tier for each.
    • Agree who the EU deployer is and who applies labels.
    • Flag the brand assets the brand wants to own, and plan their protection.

    Collect

    • The AI policy and the AI clauses of the delivery schedule.
    • A statement of work naming the AI uses.
    • The data processing agreement, with the approved sub-processor list.
    • A dated copy of each tool’s terms.
    • Written approval for any GenAI planned for final picture or for talent work.

  2. Shoot

    Do

    • Shoot clean plates and good reference: keeping the real performance keeps your options open.
    • Scan performers only with consent and a stated reason.
    • Keep extras and passers-by out of anything that goes into AI tools, or make sure they’re released.

    Collect

    • Talent contracts with a separate, specific AI consent: uses, tools, territory, term, processing outside the EU.
    • The union Digital Replica Rider, where it applies.
    • Image releases for commercial use; extras and location releases.
    • The privacy notice given to the cast.

  3. Post-production

    Do

    • Approved tools only. Upload the minimum: crops, the frames you need.
    • Keep human-made inputs visible and finish by hand.
    • Log every AI shot as you go.
    • Check outputs for look-alike characters, logos, artworks and watermarks. Never prompt with real names or named IP.
    • If a change goes beyond the consent (a new expression, a new action, a new trait), stop and ask.

    Collect

    • A written approval for each change outside the agreed scope.
    • Log entries with before and after frames.
    • Records of deleted temporary uploads.

  4. Delivery

    Do

    • Hand over an AI disclosure sheet with the deliverables: for each shot, the tier (assistive, AI element, deep fake), the recommended label and where it goes, synthetic performers (visual or voice), and the provenance status.
    • For a US registration, a short human-authorship statement and the list of AI material to exclude.
    • Delete or hand over the person-specific models, and certify it.

    Collect

    • Delivery acceptance.
    • Deletion certificates.
    • The final log and the approval references.

  5. Distribution and release

    Do

    • The production, agency or brand: the EU label at first exposure (for fiction, in an appropriate way, such as the credits); the New York and California disclosures; platform labels (YouTube, TikTok and Meta ask for or detect realistic AI content); the insurer’s, registration and awards questions.
    • You: keep the log for the agreed period, act on consent withdrawals and takedowns, and don’t post AI-altered likenesses in your showreel without consent.

    Collect

    • Confirmation of who applied which label.
    • Written permission for any showreel use.

Film and series: the questions come mostly at approvals and delivery (streamer policy, insurance, distributor warranties, guild consent). Advertising: at the start, in the agency and brand contracts, and at publication, with labels and disclosures. The same per-shot log answers both.

08

The per-shot AI log

Keep it as extra columns in the shot tracker you already have, not as a separate bureaucracy. Store references and hashes, not copies of faces.

Download the template (CSV)

  • Shot

    • Project, shot, version
    • Generation date
    • Artist

  • Tool

    • Platform and route (direct, or aggregator → model provider)
    • Model and exact version
    • Plan or tier, and the date of its terms
    • Data region and retention setting

  • Inputs

    • Plates and references used
    • Whose likeness or voice is in them (an ID, not a name)
    • Human-made inputs and who made them
    • Likeness model, its training set and its consent
    • Prompt and seed (or a link to them)

  • Output

    • File hash
    • Watermark or Content Credentials present

  • Human work

    • Comp, paint, roto, grade; the key decisions
    • Before and after frames

  • Final frame

    • Face: original, AI-altered, fully generated or masked back
    • Body, movement, voice or physical traits changed?
    • Real people, products, logos or places shown

  • Approvals

    • Consent reference, scope and expiry
    • Written approval from the production, agency or brand

  • Disclosure

    • EU deep fake? Label and placement
    • Synthetic performer? Visual or voice
    • AI material to exclude from a US registration
    • Look-alike check done

  • Retention

    • Where it’s stored
    • Deletion date for personal data and likeness models
    • Deletion certificate

What goes wrong without it

  1. You can’t tell which shots need an EU label, or prove a shot was generated before 2 August 2026.
  2. The advertiser can’t meet New York’s disclosure, which turns on “actual knowledge”, and will ask you who knew what.
  3. You can’t answer a GDPR audit, find every asset when an actor withdraws consent, or delete a likeness model on time.
  4. The production can’t file an accurate US copyright registration or defend its chain of title.
  5. You can’t claim a tool’s IP indemnity: some cover only unmodified output, and you must show which output it was.
  6. If a model is later found to infringe, or a performer says their likeness was misused, you can’t scope the damage.
  7. You can’t answer the insurer, the awards body or the streamer. The tools won’t keep the history for you: zero-retention plans delete it.
09

Contracts and AI tools

What we put in our contracts, or ask for, and what we ask every AI tool before footage goes in. “Commissioning party” is the production, agency or brand that hires the vendor.

In the contract

  1. AI use statement. The planned AI uses, tools and tiers in the bid or statement of work; any change needs written approval.
  2. Approval gate. No GenAI in final picture, and no work on a likeness or voice, without written approval for that shot or sequence.
  3. Consent warranty. The commissioning party warrants the consents for the AI uses described, keeps them in force, tells you at once of a withdrawal and indemnifies you. See the example below.
  4. Data processing agreement. Subject, duration, data, instructions, security, deletion; a sub-processor list naming the aggregator and the model provider behind it, with country and transfer route; notice of changes with a right to object.
  5. Deployer and labels. Who decides AI use, who applies the EU label and the US disclosures. You supply the disclosure sheet and keep the tools’ markings.
  6. Ownership. “All right, title and interest, if any” on full payment. Under US law, a signed work-for-hire clause with a back-up assignment (work for hire means nothing under Maltese law). You keep your tools, prompts, workflows and know-how.
  7. AI acknowledgement. Parts made with GenAI may not be protected by copyright and may not be entirely original; for those, you warrant only that you followed the agreed process with approved tools and that your log is accurate. The AICP published a model in August 2025.
  8. Indemnity and cap. An indemnity for material the commissioning party supplies or asks for, mirroring what the AI tools make you warrant; a liability cap, to the extent the law allows.
  9. Assets and training. The production’s assets for this job only. No training or fine-tuning without a separate written consent. Job-specific models deleted at the end, certified on request.
  10. Withdrawal and takedown. If a consent is withdrawn or a claim arrives: you stop, delete the sources and models, and re-do the shots affected at the commissioning party’s cost; it deals with what’s published.
  11. AI log as a deliverable. Its scope, its price if it’s extra, and how long you keep it.
  12. Your own side. Written IP assignments from staff and freelancers in every country you work from, and your broker told about your AI use.

Example consent warranty · illustrative only

The commissioning party warrants that it has obtained, and will keep in force for the agreed term of use, all rights, licences, releases and consents (including any union digital-replica consent, and a valid lawful basis under data protection law with the required information) from every person whose image, likeness, voice or performance it supplies or approves, covering the AI processing described in the statement of work, including the named tools, the purposes and processing outside the EEA. It will tell the vendor at once if any consent is withdrawn, and will indemnify the vendor against third-party claims arising from those materials.

Have your lawyer adapt it to the governing law.

Ask every AI tool

  1. Does this plan train on our inputs or outputs? Can we opt out, and does the opt-out cover what we already uploaded?
  2. How long are inputs and outputs kept, and by whom, sub-processors included?
  3. Where does generation actually run, and where is the data stored?
  4. Is there a processing agreement, a sub-processor list and a transfer mechanism?
  5. For an aggregator: which model provider gets the data, and on which terms?
  6. Who owns the outputs? Does the tool take a licence over our content?
  7. Are outputs private, or on public links or a community feed?
  8. Is commercial use allowed on this plan?
  9. Is there an IP indemnity, and what does it exclude (our inputs, likeness, modified output)?
  10. Does it mark outputs? Did the provider sign the EU Code of Practice and publish a training-data summary?

What we found reading the public terms in October 2026: enterprise and API tiers generally don’t train on your inputs; several standard web tiers do. “Deleted” often means kept for up to 30 days. Some aggregators keep outputs on public links for days by default and disclaim the models they resell. Indemnities are narrow and exclude what you upload. Terms change every few weeks: re-read them before each job.

10

Also worth knowing

Rules we came across while checking the rest, that a vendor or a producer should know about.

  • Global

    The pixels can tell

    Google’s SynthID watermark in Veo and Imagen output survives grading and encoding, and its public detector opened to everyone in October 2026; OpenAI adopted it for images. Disclose AI elements up front, and never promise a deliverable is AI-free.

    SynthID

  • US, spreading

    Insurance is narrowing

    Optional GenAI exclusions for general liability policies arrived in January 2026, and production E&O underwriters now ask how AI is used and who reviews it. Check both your liability and your media or E&O policies at renewal.

    GenAI exclusionsE&O underwriting

  • Global

    Awards ask too

    The Academy announced in May 2026 that acting awards are for roles performed by humans with their consent, and it can ask about AI use. Cannes Lions requires AI disclosure on entries and can withdraw a Lion and ban the entrant for up to three years.

    Academy rulesCannes Lions

  • UK, US, EU

    Product demos stay real

    The ASA judges the overall impression, not whether AI was used: it ruled against AI puppy footage for a robot toy in March 2026, and against an AI-generated man who looked under 25 in a gambling ad in September. In the US, faked demonstrations have been deceptive since 1965.

    ASA on AI disclosureASA rulingFTC v. Colgate

  • France, Norway

    Body-image labels

    France requires “photographie retouchée” on commercial photos where a model’s body was reshaped (print and online, not TV). Norway requires a label on ads with an altered body or skin, for the whole film, and holds the people who make the ad liable too.

    France, retouched photosNorway, retouched ads

  • New York

    Models in New York

    Since June 2025, the Fashion Workers Act requires a model’s separate written consent, with scope, purpose, term and pay, before anyone creates or uses their digital replica. Blanket “all uses in perpetuity” releases don’t count.

    NY Fashion Workers Act

  • US

    Tools under fire

    Disney, Universal and Warner Bros. Discovery’s suit against MiniMax (Hailuo) got past dismissal in May 2026; studios also sued Midjourney and sent ByteDance cease-and-desist letters over Seedance 2.0. Expect studio and network jobs to ban specific models.

    Disney v. MiniMax

  • Global

    Stock licences

    Getty’s licence (April 2026) bans AI and machine-learning use beyond narrow editing; Artlist’s (January 2026) allows assets as AI inputs but not for training, not in tools that claim rights or share outputs, and not to make avatars of the people in them.

    Getty licenceArtlist licence

  • Germany, EU

    AI music

    In July 2026 a Munich court largely upheld GEMA’s claims against Suno, after a similar ruling against OpenAI over lyrics in 2025. For ads, prefer licensed libraries, composers or licensed models with written commercial terms.

    GEMA v Suno

  • UK, Italy

    Tax credits and AI

    The UK’s 39% VFX credit counts AI tools, but only for work done in the UK, and lists every VFX vendor. Italy’s film tax credit requires AI-refusal clauses in actor contracts and a credits line saying where AI was used.

    HMRC, VFX creditItaly, tax credit criteria

  • Brand policy

    Brands’ own rules

    Some brands go further than the law: Unilever bans digital alteration of body shape, size, proportion or skin colour in its ads, and Dove pledged in 2024 never to use AI to represent real women. Ask for the brand’s AI and retouching policy at the briefing.

    Unilever / Dove

  • EU, UK, Japan

    Training your own models

    In the EU, commercial text and data mining is allowed unless rights are reserved in a machine-readable way (Hamburg, December 2025); the UK has no commercial exception at all. Train on material the production owns or has licensed.

    Kneschke v LAIONUK reportJapan

11

Key dates

What already applies, and what’s coming. Dates after the day we checked are scheduled, reported or targets.

  1. Mar 2023USCopyright Office: disclose AI material when registering
  2. Jul 2024USTennessee ELVIS Act: voice and likeness
  3. Aug 2024EUAI Act enters into force, in phases
  4. Jan 2025USCalifornia: replica contract clauses (AB 2602), deceased performers (AB 1836)
  5. Jan 2025USCopyright Office report on copyrightability
  6. Feb 2025EUAI Act: AI literacy duty applies
  7. Apr 2025USSAG-AFTRA Commercials contracts, with AI terms
  8. Aug 2025GlobalNetflix guidance on GenAI for production partners
  9. Sep 2025GlobalChina: AI labelling rules apply
  10. Oct 2025EUItaly: AI law, human authorship and the deepfake crime
  11. Feb 2026UKCreating or requesting intimate deepfakes becomes a crime
  12. Mar 2026USSupreme Court refuses Thaler: human authorship settled
  13. Jun 2026USNew York: synthetic performers in ads must be disclosed
  14. Jun 2026EUCode of Practice on marking and labelling AI content, final
  15. Jul 2026USSAG-AFTRA TV/Theatrical 2026 applies
  16. Jul 2026EUDigital Omnibus on AI in force
  17. Aug 2026EUAI Act Art. 50: deep-fake labels and marking apply
  18. 17 October 2026We checked everything on this page
  19. Dec 2026EUBan on non-consensual intimate deepfakes; marking deadline for existing tools
  20. Jan 2027USCalifornia: synthetic performers in ads (reported)
  21. Jan 2027EUDenmark: likeness and voice law, if passed (target)
  22. Jul 2027USSAG-AFTRA: consent for a replica voice in another language
  23. Aug 2027EUAI Act: older general-purpose models must comply

Sources

Primary texts first: laws, court decisions, union contracts, regulator guidance and the policies themselves. Where one couldn’t be read directly, a law firm’s or a trade note. All checked on 17 October 2026.

EU and Europe (24)
United States (23)
United Kingdom (7)
Industry and platforms (11)
Rest of the world (3)

This page shares our experience as a VFX studio. It is general information, not a lawyer’s opinion: it creates no lawyer–client relationship, it does not cover every country or every case, and we accept no liability for decisions based on it. Before you act, talk to a qualified lawyer in the country concerned.

Not sure about a shot?

Ask before the shoot, not after.

Send the brief, the script or the shot list on WhatsApp. We’ll tell you which shots we’d treat as green, yellow or red, what we’d ask the production for and how we’d document it. If you need a legal opinion, we can introduce you to lawyers we’ve worked with on these questions: independent, and they advise you directly.

Let's talkConnect on LinkedIn