Permission to generate an image is not the same as a complete commercial-rights clearance. A usable review separates at least seven questions: may the account use the output commercially; were the inputs authorized; does the image depict a protected person, character, logo, product, or place; what human authorship exists; what provenance survives export; what does the client or platform require; and what evidence will remain if the tool or terms change.

This checklist is an operational intake tool. Copyright, trademark, publicity, privacy, contract, consumer-protection, and advertising rules vary by country and use. Escalate consequential campaigns, packaging, political content, realistic people, children, health claims, and brand imitation to qualified counsel.

Create one rights ledger per final asset

Assign an asset ID before generation. Record the tool, feature, model if shown, account owner, plan, generation date, terms URL, terms version or archived copy, prompt, seed or job ID if available, every uploaded input, editor, transformations, export path, intended territories, channels, duration, client, and approver. Store the final file and an untouched original export.

Do not rely on a screenshot of a pricing page. Commercial permissions may differ for beta features, enterprise terms, API use, stock integrations, indemnity-eligible features, or prohibited uses. Record the exact feature and account agreement that produced the chosen image.

Gate 1: verify tool and account terms

Answer four separate questions: does the provider permit the intended commercial use; who receives rights in the output; are outputs unique; and does any indemnity apply to this plan, feature, region, and workflow? A provider allowing commercial projects does not promise that an output is exclusive, registrable, or free of third-party claims.

Adobe's current Firefly FAQ says outputs from features without a beta label may be used commercially and describes its training sources and Content Credentials. Its legal product description separately defines eligible features and export events for certain contractual indemnity. Those statements should not be collapsed into “all Adobe AI images are insured.” Check the customer agreement.

Gate 2: clear every input

InputEvidence to retainStop condition
Text promptPrompt and authorRequests a living artist, protected character, logo, or deceptive replica without approval
Reference imageLicense, creator permission, source URL, receiptNo right to create derivatives or upload to the service
Person or voiceModel release and permitted usesNo consent or use exceeds the release
Brand assetBrand-owner approval and usage guideUnapproved mark, trade dress, or product depiction
Client materialContract permission and confidentiality classificationAgreement forbids AI processing or subprocessers

Owning a copy of an image is not automatically permission to upload it, transform it, or use the result commercially. Keep a license record tied to the asset ID.

Gate 3: inspect the output for third-party elements

Review at full resolution. Look for logos, product shapes, packaging, characters, artwork, signatures, watermarks, uniforms, recognizable locations, celebrity likenesses, private individuals, personal data, misleading text, and unsafe or discriminatory imagery. Use reverse-image search as an investigation aid, not proof of clearance. Similarity can require expert analysis even when no exact match appears.

For realistic people, record whether the person exists, whether a release covers the use, and whether the context implies endorsement or a real event. Do not use an AI label as a substitute for consent.

Gate 4: document human authorship and editing

The U.S. Copyright Office's AI report explains that copyrightability depends on human authorship and is assessed case by case. Its report distinguishes merely prompting from human-authored expression, selection, arrangement, and modification. It does not create a rule that a certain number of prompts or minutes guarantees copyright.

Preserve an edit log showing human choices: original photography or drawing, compositing plan, masking, retouching, typography, color decisions, layout, selection and arrangement, rejected alternatives, and final rationale. Keep layered working files. This evidence helps counsel or a registration professional assess which human-authored portions may be claimed; it does not itself guarantee protection.

Gate 5: preserve provenance without confusing it with rights

OpenAI documents that images from its tools include C2PA metadata and warns that screenshots or other processing can remove it. Adobe says Firefly applies Content Credentials to fully generated assets and may store a recoverable copy in its credential cloud. Google describes SynthID and Content Credentials, while warning that failure to detect a Google watermark does not prove that media is not AI-generated.

These signals document origin or editing history. They do not prove that the prompt, input, person, trademark, or commercial use was authorized. Preserve the original file, inspect credentials before and after editing, and add a separate internal rights ledger. If a platform strips metadata, keep the original and publish any disclosure required by law, contract, platform, or editorial policy.

Gate 6: match the intended channel

Review the final use, not an abstract “commercial use” label. Packaging, paid advertising, editorial illustration, marketplace listings, book covers, app-store assets, stock submissions, political ads, and client deliverables have different representations and disclosure rules. Record dimensions, territories, audience, duration, modification rights, sublicensing, and whether the client expects exclusive artwork.

If the asset will support a factual claim, confirm that the image does not imply photographic evidence. A generated medical, disaster, product, or news image can mislead even when technically licensed.

Use a red-amber-green release decision

  • Green: terms checked; inputs documented; no recognizable third-party element; intended channel approved; provenance and edit evidence retained.
  • Amber: unclear similarity, realistic person, brand element, beta feature, exclusivity request, lost provenance, or cross-border campaign. Hold for specialist review.
  • Red: missing input rights, unconsented replica, deceptive context, prohibited use, unknown account, or client restriction. Do not publish.

The approver should sign the ledger with a date and scope. Re-review when the asset is reused in a new country, channel, or message.

Package evidence for the commercial handoff

Deliver the final asset with a compact evidence folder: untouched generation export, final file, layered edit file, input licenses and releases, terms snapshot, prompt or job record, provenance inspection, human-edit log, channel checklist, and signed decision. Do not send prompts containing confidential client strategy to people who do not need them; use access controls and a redacted summary where appropriate. Define who keeps the packet and for how long.

If the client later requests a new crop, language, product label, or territory, create a new ledger version. A prior approval covers only the recorded asset and use, not every derivative campaign.

Original worksheet

Download the AI image rights ledger (CSV). It includes the seven gates, input evidence, person and brand checks, human edit log, provenance status, intended-use scope, terms snapshot, legal-review flag, and final decision.

Source map

Limitations

This checklist was source-reviewed on July 17, 2026 and is not legal advice. It does not analyze a particular image, jurisdiction, contract, registration, or dispute. Vendor terms, beta labels, indemnity, provenance technology, and platform rules can change. C2PA or SynthID presence is not rights clearance, and absence is not proof of human creation. Obtain professional review when the legal or commercial consequence is material.