AI-Generated Images and Commercial Web Use

The campaign hero was generated in an afternoon. Legal blocked publish because the SOW required full commercial indemnification and the tool’s terms said otherwise. AI imagery is not CC0. Each platform defines what you may do with outputs, often varying by subscription tier, generation date, and whether outputs resemble third-party styles or recognizable people. Marketing velocity outran policy review. The asset sat in staging until counsel traced ownership, training data risk, and indemnification gaps.

This essay walks platform starting points, always check live terms, the questions legal teams ask, input-side intellectual property risk, and a workflow that reduces exposure without banning generative tools outright. Disclaimer: this is editorial commentary, not legal advice. Terms change. Archive the URL and version effective on the generation date.

Questions legal actually asks

Before a hero image ships on a commercial site, counsel typically maps four clusters. Ownership asks who holds copyright in the output, if anyone, and whether the client can grant sublicenses to agencies and CDN hosts. Commercial scope asks whether web deployment is allowed or only personal and non-commercial use, and whether paid ads, email, print, merchandise, or out-of-home are included or tier-gated. Indemnification asks whether the vendor defends the customer if a claimant alleges infringement. Enterprise tiers sometimes add indemnity caps. Free tiers often offer none. Input and training risk asks whether the prompt, reference upload, or style reference introduced trademark, copyrighted character, celebrity likeness, or competitor trade dress, and whether terms permit using outputs to train other models.

Color sampling for design tokens does not resolve any of the above. Licensing is the differentiator, not the CSS. A beautiful generated hero that fails indemnification review is still a blocked launch. Teams that treat generative output like stock photography without reading terms discover this gap at the worst moment, usually the day before a campaign goes live when marketing has already bought media.

Summaries below reflect common public positions as of early 2026. Check live terms at generation time. Vendors revise language with little notice. Treat platform summaries in blog posts, including this one, as orientation only.

Platform starting points and what diligence looks like

Midjourney publishes terms at docs.midjourney.com. Historically, commercial rights tied to paid subscription tier. Lower tiers carried more restrictions on company revenue thresholds. Higher tiers granted broader commercial use. Free or trial tiers often limit commercial deployment. Confirm your subscription tier on the generation date, not the publish date. Review whether outputs used style or character references that could increase likeness or trade dress risk. Check community content policies on restricted subject matter. Violations can void licenses. Archive account email, tier, invoice PDF, prompt, job ID, seed if visible, and terms URL screenshot.

OpenAI consolidates usage under openai.com/policies. Commercial use of outputs has generally been permitted for paid API and consumer subscribers subject to Usage Policy restrictions covering impersonation, certain regulated advice contexts, and exploitation. Distinguish API versus consumer ChatGPT terms. Enterprise agreements may differ. Usage Policies restrict categories beyond copyright. A technically owned image may still violate policy on deployment. Confirm whether input images for edits were rights-cleared. Do not rely on social media summaries from launch week. Terms post-date announcements.

Adobe positions Firefly for commercial creative workflows, with FAQ describing training on licensed and public domain content and offering indemnification for certain enterprise customers when using Firefly within covered products. Indemnification scope often ties to Creative Cloud for enterprise plans and Firefly within Adobe apps, not every individual Pro subscription. Verify whether output was created in commercially cleared Firefly versus community experimental features. Integration with Photoshop generative fill may bundle different warranty language than standalone web UI. Adobe’s claim structure is a selling point for risk-averse brands, but read caps, exclusions, and geographic limits.

Google’s terms span consumer Gemini, Workspace, and Vertex AI. Check live terms on ai.google.dev and Cloud enterprise agreements. Consumer and API licenses differ. Indemnification typically strengthens on Cloud enterprise contracts with counsel negotiation. API data handling affects regulated industries. Sync generated assets with your Cloud billing entity for audit trail.

Running checkpoints locally shifts liability to your organization. The tool is open. The model license is not automatically commercial. CreativeML Open RAIL-M permits commercial use with use restrictions. SDXL and vendor-specific fine-tunes may ship their own LICENSE file. Read the model card LICENSE bundled with the exact checkpoint hash you deployed. LoRA and DreamBooth fine-tunes trained on third-party IP may taint outputs. No vendor indemnification means legal review internal.

Wrappers including Canva and Figma plugins embed third-party models. Terms are stacked: the app’s terms of service, the underlying model provider, and your subscription tier. A commercial license badge in UI does not override a base model’s non-commercial clause. Identify which model generated the asset in metadata or export logs and trace to that model’s license.

Dimension	Typical enterprise SaaS (Firefly enterprise)	Typical consumer gen (varies by tier)	Self-hosted SD
Commercial web use	Often explicitly in scope with plan	Tier-dependent; verify	Model-card-dependent
Indemnification	Sometimes offered with caps	Rare on free/low tiers	None from vendor
Audit trail	Account + enterprise logging	Prompt history in account	Your infrastructure
Policy restrictions	Content policy + brand guidelines	Broader usage policy	Your use policy

Use this framing in intake meetings, not as substitute for counsel review.

Input-side risk and the provenance packet

Outputs are only half the file. Legal questions focus on inputs: trademarked logos in prompts or style references, copyrighted characters referenced as style of a franchise, celebrity names and likeness, competitor UI screenshots fed as reference, and stock photos uploaded without license to derive derivatives. Terms may assign infringement liability to the user regardless of output ownership claims. A workflow that archives prompts protects the organization in disputes. It does not guarantee immunity.

Until terms are cleared for the specific use case covering paid social, global web, or regulated industry, keep generations in private boards. No CDN URLs. No staging links indexed by Google. For each production candidate, store in DAM alongside the image the prompt text and negative prompt, model name and version, seed or job ID or API request ID, reference images with their licenses noted, subscription tier and account owner, terms URL and PDF snapshot dated generation day, and reviewer sign-off fields for legal and brand. Future claims ask what you knew when you generated this.

Route by exposure tier. Blog illustration and low traffic placements may use tier-cleared AI or stock with documented license. Homepage hero and paid campaigns favor enterprise-indemnified source, commissioned photo, or rights-managed stock. Regulated industries including finance, health, and children often require counsel review and frequently exclude consumer AI heroes. Merchandise and out-of-home require merchandise clauses verified explicitly. Many AI terms are silent or restrictive on physical goods. Prefer licensed stock or commissioned photography when indemnification is non-negotiable, and vet every stock source license-first before it enters the pipeline.

Once legal releases the asset, sample dominant hues with the image color picker and build tokens the same way as photography. Licensing gates publication. Color gates brand consistency. Terms change retroactively for new generations. Older assets may be grandfathered or not. Read transition notices. Quarterly, spot-check staging assets against current policies before campaign renewals.

If an agency delivers AI assets, the MSA should require disclosure that assets are AI-generated, provenance packet delivery, representation that inputs were cleared, and indemnity flow aligned with your risk tolerance. Sourced online is not a license.

What AI does not exempt and a practical stance

Generative tools do not exempt trademark complaints on confusingly similar logos in outputs, right of publicity claims on recognizable faces, platform ad policies on synthetic media disclosure requirements in some jurisdictions, or sector rules including FDA and FINRA on implied claims in imagery. Color systems built from approved finals remain the same whether pixels came from a lens or a latent space. The difference is who will defend you when someone claims they own those pixels.

Generative tools are legitimate for exploration and low-exposure publish when terms, tier, and provenance are documented. They are poor drop-in replacements for high-exposure commercial heroes without enterprise-grade indemnification or counsel sign-off. Check live terms at generation time, archive the snapshot, and route high-risk placements to sources your legal team already trusts.

Case study: the hero that legal blocked forty-eight hours before launch

A direct-to-consumer wellness brand planned a spring campaign around a hero image showing a sunlit kitchen scene with product packaging on a marble counter. The creative team generated the image in Midjourney over a Tuesday afternoon. The prompt specified warm morning light, minimal styling, and no recognizable faces. Marketing loved the output. Design dropped it into the homepage mockup by Wednesday lunch. Engineering pushed the asset to staging CDN Thursday morning. Paid social media was scheduled to start Saturday at midnight. Legal review was on the calendar for Friday afternoon.

Counsel opened the terms of service archived nowhere. The generation had run on a trial-tier account created for experimentation two months earlier. The trial tier prohibited commercial deployment above a revenue threshold the company had exceeded eighteen months prior. The account owner was a freelance designer, not an employee. The invoice trail was incomplete. Legal requested subscription tier confirmation on the generation date. The designer could not produce it. The job ID existed in a personal Discord DM thread, not in the DAM.

While tracing ownership, counsel found the prompt included a style reference uploaded from a competitor’s Instagram campaign. The reference was not rights-cleared. Terms assigned input liability to the user regardless of output ownership claims. Indemnification on the trial tier was zero. The SOW with the media agency required full commercial indemnification for all hero assets. The generated image failed on three independent grounds: tier, input, and contract.

Marketing proposed a twenty-four-hour rush to regenerate on a paid tier. Legal noted that regeneration would not cure the competitor reference already used in the first generation’s provenance. The reference upload was logged in the platform history. A second image with a clean prompt would ship, but the first image’s existence in campaign drafts and Slack attachments remained discoverable. Brand proposed blurring the packaging label in Photoshop. Legal noted that retouching does not fix unauthorized generation and that the label blur introduced implied health claims the FDA context required counsel to review separately.

The team pulled the AI hero Friday at 4pm. Forty-eight hours before launch. A stock search with color filtering, described in the companion photography workflow article, produced three finalists with documented extended licenses by Friday 9pm. A contractor graded the best finalist for shadow temperature alignment with the brand’s surface tokens. Legal signed the stock license chain Saturday morning. The campaign launched with a photograph, not a generation. The total cost of the stock asset plus grading was less than one percent of the media buy already committed.

The post-mortem produced a generative intake policy, not a ban. Internal concept exploration could continue on any tier in private boards with no CDN exposure. Production candidates required paid tier confirmation on generation date, provenance packet in DAM before staging upload, counsel sign-off for any placement above blog illustration traffic, and explicit prohibition on style references from third-party campaigns without documented clearance. High-exposure heroes routed to enterprise-indemnified sources, rights-managed stock, or commissioned photography.

Six months later, the company adopted Adobe Firefly within an enterprise Creative Cloud agreement with indemnification language counsel could file in procurement questionnaires. They still archived terms snapshots per asset. They still sampled approved finals for color tokens only after legal release. The lesson was not that generative tools failed. The lesson was that velocity without provenance creates a staging asset that looks approved in a mockup and remains legally radioactive in production. Ownership, tier, indemnification, and input clearance are the gate. Color work begins after the gate opens.

The policy change also affected agency relationships. The next MSA renewal required disclosure of AI-generated deliverables, mandatory provenance packet handoff, and representation that reference uploads were cleared. Two boutique agencies declined the clause and exited the roster. A third adopted the packet template and won a larger share of work because legal could approve their submissions in one review instead of three escalation rounds. Procurement questionnaires that had blocked the wellness campaign began receiving attached provenance samples with terms PDFs, tier confirmations, and reviewer sign-off fields pre-filled. Sales reported fewer deal delays on enterprise accounts asking about synthetic media governance.

Marketing still uses generative tools for internal mood boards and low-traffic blog illustrations where counsel has pre-cleared the tier and use class. The spring campaign hero that failed would have been appropriate as a private concept image never staged to CDN. The failure was placement without paperwork, not generation itself. Teams that confuse the two ban tools outright and lose exploration velocity. Teams that confuse them the other direction ship heroes without indemnification and lose launches outright. The workable middle is exposure-tier routing with archived terms and no staging upload without a packet.