Copyright, consent, attribution and likeness are four separate questions with four separate answers.
Do now: Take one recent project and answer all four for every asset in it.
Generating something does not grant you rights over what went into it.These are the issues that surface late — when a client asks, a platform flags something, or a person recognises themselves. Answering takes a minute if you logged it during production and can take weeks if you did not.
Four questions, kept apart
Copyright asks whether you have the right to use the material at all. It covers other people's writing, images, music, video, code and designs, and it applies to things found online exactly as it applies to things found in a shop. 'It was freely available' describes access, not permission.
Consent asks whether the people involved agreed. This is about the person, not the file. Someone can hold no copyright in a photograph of themselves and still have every right to object to how it is used.
Attribution asks whether you must credit someone. Many licences permit reuse only with credit, and academic and journalistic norms require it regardless of licence. Attribution is also often the cheapest thing you can offer a person whose work helped you.
Likeness asks whether a person's face, voice or identifiable characteristics appear, and whether they agreed to this particular use. This is the question that AI has changed most, because a likeness can now be produced without ever photographing anyone.
Answering three of four is not compliance. They fail independently.
What generation does and does not give you
Whether AI-generated output attracts copyright at all varies by country, and in many places purely machine-generated material has no human author and therefore no protection. That cuts both ways: you may not be able to stop others using your generated asset, which matters if it becomes a logo or a brand element.
Separately, the tool's own licence governs what you may do — free tiers commonly restrict commercial use, and some require attribution or forbid certain applications. Read it once for the tools you actually rely on.
And generation does not launder anything. If you supply someone else's image as a reference, or prompt closely toward a living artist's recognisable style, the rights questions attached to that input do not evaporate because a model sat in the middle.
Keep the log during production, not after
For every asset record: where it came from, what licence applies, whether commercial use is permitted, whether attribution is required, whether any identifiable person appears, and what they agreed to. One row, one minute, at the moment you make the asset.
Consent should be specific and written. What is being used, in what context, for how long, and whether it may be altered. Someone agreeing to appear in a video has not agreed to their face being placed in a different scene, or their voice being synthesised. Ask for what you actually intend to do.
In practice the log's value is not legal, it is operational. It turns 'we will have to look into that' into an answer, and it is the difference between a client relationship that continues and one that becomes cautious.
A rights log costs a minute per asset during production and a week per question afterwards.