AI images and video: rights, provenance, labels and quality checks

Learn in your browser · Chapter 01 of 06

Ownership depends on where you are and how much of the work is yours.

Copyright is the right to control copying of an original work. Ask two questions: is there copyright in the output, and does it copy someone else's work?

Scroll sideways to see every column.

Video and sound. UK law also protects films and sound recordings as recordings, whatever their creativity, and the report says this covers AI-generated ones.

Other people's rights. An output that reproduces a substantial part of an existing work can infringe, the UK report notes, so a lookalike character is risky whoever "owns" it. The more of the final work that is yours (photos, drawing, edits, arrangement), the stronger your position: keep evidence (chapter 6).

Learn in your browser · Chapter 02 of 06

Your right to use an output comes from the law and the contract you accepted. Five questions cover any terms.

Find the terms of use, usage policy and privacy policy. Note the version or date, save a copy because terms change, and check your plan: plans can carry different rights.

Scroll sideways to see every column.

An indemnity is a promise to cover your legal costs or losses if a claim arises; read its conditions. And a contract cannot create copyright: "you own the output" settles matters between you and the provider only.

Learn in your browser · Chapter 03 of 06

The riskiest AI media shows real people. Get consent first, and know the law.

The UK has no general "image right". The government's March 2026 report describes a patchwork instead (data protection, online safety rules, criminal offences, defamation, trade marks and passing off) and proposes to explore whether a new personality right is needed.

Scroll sideways to see every column.

In the US, most states recognise a "right of publicity" over identity, with rules that differ considerably, reports the Copyright Office. The TAKE IT DOWN Act (May 2025) makes knowingly publishing certain non-consensual intimate "digital forgeries" a federal crime, and since 19 May 2026 has required covered platforms to remove them within 48 hours of a valid request.

Consent that works is written and specific: which photo or recording, what AI will change, where it will appear and for how long. Let people withdraw. For children, follow your school's or club's policy; the ICO generally expects schools to offer parents an opt-out for promotional use.

Learn in your browser · Chapter 04 of 06

Provenance records where a file came from; a label tells people what they are seeing. You may need both.

Content Credentials, the open standard of the Coalition for Content Provenance and Authenticity (C2PA), are a signed record, in or linked to a file, of its origin and edits. They are tamper-evident: changes show up when checked. Generated media can be marked with the IPTC term trainedAlgorithmicMedia ("Created using Generative AI").

Scroll sideways to see every column.

Keep any credential your tool adds, and check it survives your edits. The open-source c2patool (c2patool yourfile.jpg) and the Content Authenticity Initiative's Verify site display credentials; neither was tested for this workbook.

The EU. Article 50 of the AI Act applies from 2 August 2026 (EUR-Lex, read 26 September 2026). Providers of generative tools must mark outputs machine-readably; the Digital Omnibus on AI (Regulation (EU) 2026/1744) gives those already on the market until 2 December 2026. Deployers (anyone using an AI system under their authority, except in a purely personal, non-professional activity; when staff use it for work, the employer is the deployer) must disclose a deepfake: image, audio or video resembling existing people, objects, places, entities or events that would falsely appear authentic. Evidently artistic, satirical or fictional work needs only a disclosure that does not spoil it. The Act also covers providers and deployers outside the EU whose output is used there.

In June 2026 the Commission published a voluntary code of practice and optional EU icons, and in July 2026 guidelines on Article 50; the icon guidance's examples include an empty flat "furnished" with AI. Guidance is still developing, so check its AI Act pages before a campaign.

The UK. The government's March 2026 report says there are no UK obligations to label AI content. The Advertising Standards Authority says its rules apply however an ad is made, and a disclosure is very unlikely to rescue a misleading ad, such as an AI image exaggerating a cosmetic's effect. Platforms set their own rules (see the YouTube workbook).

A good label is short, specific and visible where the content appears, such as "Background generated with AI" in the caption or on the image, not only in metadata.

Learn in your browser · Chapter 05 of 06

Check what an output shows, whether it is accurate and accessible, and what the file hides.

Scroll sideways to see every column.

Facts. Never let an image tool draw your data: check every number and label in a chart or infographic against its source, or build it from the data.

Accessibility. Per the W3C images tutorial, informative images need alt text giving their essential information, decorative ones empty alt text (alt=""), and graphs a full text version. Video needs captions of dialogue, speakers and meaningful sounds (WCAG 1.2.2); automatic captions are not enough, the W3C says, unless checked as fully accurate.

File hygiene. Files carry hidden metadata: EXIF fields (author, software, GPS location), PNG text, video tags. Keep what you want (a colour profile, a Content Credential); remove what you never meant to publish (a name, a place, a prompt).

These scripts need Python 3 and the free Pillow library (python -m pip install --upgrade Pillow, or python3 on macOS and Linux). Use a new, empty folder. The first makes two test images with invented metadata and refuses to overwrite.

# make_samples.py: two test images with invented metadata
import sys
from pathlib import Path
from PIL import Image, ImageDraw
from PIL.ExifTags import IFD
from PIL.PngImagePlugin import PngInfo

JPG, PNG = Path("sample.jpg"), Path("sample.png")
if JPG.exists() or PNG.exists():
    sys.exit("Sample files already exist here. Use an empty folder.")

img = Image.new("RGB", (320, 200), "white")
ImageDraw.Draw(img).rectangle((110, 50, 210, 150), fill="red")

exif = Image.Exif()
exif[0x013B] = "A. Example"  # Artist
exif[0x010E] = "prompt: a red square on white"  # ImageDescription
exif.get_ifd(IFD.GPSInfo).update({1: "N", 2: (51.0, 30.0, 0.0)})  # invented
img.save(JPG, exif=exif)

info = PngInfo()
info.add_text("prompt", "a red square on white")
img.save(PNG, pnginfo=info)
print("Made", JPG, "and", PNG)

The second lists EXIF fields and PNG text (it does not look for XMP or other metadata) and changes nothing unless you add --clean. Then it writes a new clean- copy, never overwriting, rebuilt from the pixels (the right way up, keeping only the colour profile), and prints its SHA-256 fingerprint (yours may differ with another Pillow version).

# check_meta.py: report hidden metadata; with --clean, save clean copies
import hashlib
import sys
from pathlib import Path
from PIL import Image, ImageOps
from PIL.ExifTags import TAGS


def report(path):
    with Image.open(path) as im:
        found = [TAGS.get(tag, hex(tag)) for tag in im.getexif()]
        found += [f"text:{key}" for key in getattr(im, "text", {})]
    print(f"{path.name}: {', '.join(found) or 'no EXIF or text found'}")


def clean_copy(path):
    out = path.with_name("clean-" + path.name)
    if out.exists():
        print(f"Skipped {out.name}: it already exists")
        return
    with Image.open(path) as im:
        icc = im.info.get("icc_profile")  # keep the colour profile
        im = ImageOps.exif_transpose(im)  # keep it the right way up
        im = im.convert("RGBA" if im.has_transparency_data else "RGB")
        clean = Image.frombytes(im.mode, im.size, im.tobytes())
    clean.save(out, quality=95, icc_profile=icc)
    report(out)
    print("SHA-256:", hashlib.sha256(out.read_bytes()).hexdigest())


for path in [Path(a) for a in sys.argv[1:] if a != "--clean"]:
    report(path)
    if "--clean" in sys.argv:
        clean_copy(path)

python make_samples.py
Made sample.jpg and sample.png
python check_meta.py sample.jpg sample.png --clean
sample.jpg: Artist, GPSInfo, ImageDescription
clean-sample.jpg: no EXIF or text found
SHA-256: 92ecf780af1f216ee426cd94bf5821500945e545526c4ff1f336a98fedeb7a8f
sample.png: text:prompt
clean-sample.png: no EXIF or text found
SHA-256: d22b80096c6a0502089a3e5b1cc0f1d55404f31f4778bde45693547d11764af7

Video. FFmpeg is free (see its download page). -n refuses to overwrite, -map_metadata -1 stops metadata being copied and -c copy leaves the pictures untouched.

ffmpeg -v error -n -f lavfi -i testsrc=d=2 -metadata title="Test clip" -metadata comment="prompt: a test pattern" sample.mp4
ffprobe -v error -show_entries "format_tags=title,comment,encoder" -of default=nw=1 sample.mp4
TAG:title=Test clip
TAG:encoder=Lavf62.12.101
TAG:comment=prompt: a test pattern
ffmpeg -v error -n -i sample.mp4 -map_metadata -1 -c copy clean-sample.mp4
ffprobe -v error -show_entries "format_tags=title,comment,encoder" -of default=nw=1 clean-sample.mp4
TAG:encoder=Lavf62.12.101

The title and comment are gone; encoder is FFmpeg's own name and version.

Learn in your browser · Chapter 06 of 06

A short record for each published file shows what you made, how, and on what terms.

The US Copyright Office asks applicants to describe the human contribution and exclude AI-generated material that is more than trivial. A record also helps you answer complaints and shows which terms applied.

Scroll sideways to see every column.

Keep it beside the file or in a spreadsheet. Consent forms and names are personal data: store them securely and delete what you no longer need.