Everyone in Marketing Is Using AI — So Why Can't Legal Sleep at Night?

A few days ago, a friend who works as in-house counsel at a consumer goods company forwarded me a message. It came from a colleague on the marketing team, word for word as sent:

"Hi, quick heads-up — our latest campaign is being made with generative AI now. Any legal issues we should watch out for? Probably not, right? Everyone's using it anyway. Can we grab ten minutes tomorrow to sync?"

My friend asked me: what do you make of this message?

I said: the message is short. The pitfalls in it are not.

"Everyone's using it anyway" is one of the most expensive sentences in business. Everybody was piling on leverage back then, too. How did that end?

I've taken the reply I sent him, pulled it apart, and turned it into this article. If you're in legal, take it as a review checklist; if you're in marketing, take it to sidestep trouble early.

Pitfall No. 1: The AI Made the Image, but the Blame May Land on You

Many people's first reaction: if an AI-generated image goes wrong, that's the AI vendor's problem — what does it have to do with me, the person who used it?

It has everything to do with you.

An example. The AI generates a poster for you, and it inadvertently recreates a scene from a copyrighted film. You put it into an ad and run it at scale. You made the copies, and you put them in front of the public. Both acts were yours. Even if you knew nothing about it, this may still constitute infringement.

Not knowing is no talisman.

There's a worse way to be caught: you knew — or should have known — that something was off. Say the prompt openly reads "make it in the style of so-and-so's work," and you then use the output commercially. That's no longer mere infringement; it's willful infringement, and the trouble doubles.

Trademarks work the same way. The AI output comes out carrying someone else's brand mark, you take it into advertising — trademark infringement, passing off, unfair competition, one after another. Celebrity faces are an even bigger circus: the AI draws a face that looks like a certain star, you use it in your marketing — in the UK, you could be looking at a "false endorsement" lawsuit; in many other countries, it's a straightforward violation of personality rights.

Oh, and the UK still doesn't have true "personality rights" in the strict sense. But the government has already said it will look into whether the UK should create one, specifically to govern "unacceptable imitation." That window will only narrow from here.

You might want to say: didn't these risks exist back when humans drew everything?

They did. The law doesn't ask what you drew it with; it only asks whether what you drew ran into someone else's rights. When AI-generated materials feature a recognizable third-party brand, a well-known fictional character, or a star's face, they get exactly the same treatment as human-made work: straight into the usual legal review process.

So where's the real change? In exposure.

What is exposure? It's the surface you leave exposed to risk.

In the past, a piece of marketing material went through several stages from idea to publication, and legal could keep an eye on all of it. Now, everyone has a printing press in their hands. Think about it: an intern generates fifty images in five minutes, and one of them skips the process entirely and goes live. Legal never even knew it existed.

The real risk has never been what AI can draw, but how much content bypasses your process.

So the entry point has to be locked down. Three moves.

Move one: in your prompts, don't touch unauthorized third-party IP. Don't tell the AI to "work in the style of some work" — deliberate imitation is the most indefensible position in law. There is one situation you can't dodge: comparative advertising, where you have to name the competitor's brand. In that case, walk it through manual legal review, honestly. And the intensity of review should be proportional to the reach of distribution: a flagship mass-market campaign and core brand assets are not in the same weight class as a mood board from an internal brainstorm.

Move two: write the process down. Prompts, version history, every iteration and revision — archive it all. If someone later claims you copied, you can produce the records: look, we never entered any unauthorized material; the resemblance is a coincidence. And if the designer made substantive modifications on top of the AI output, that's ironclad evidence: this was an independent creative process.

Move three: check whether the vendor will back you up. The leading AI vendors almost all offer some form of IP indemnity (a contractual promise to cover your losses if you're sued over infringement), but all with conditions: use the service under its terms of service, don't deliberately generate infringing material, don't feed in content you have no rights to. Before you sign, read the clauses word by word. Don't wait until something happens to discover that in front of the word "indemnity" stand seven "buts."

There's another kind of risk the naked eye can't see at all: AI-generated ad copy and packaging text may reproduce someone's written work in whole passages. A logo on an image you can recognize; whether a block of copy is plagiarism, nobody can tell. All the more reason to read the vendor's terms and guarantees carefully in advance.

Pitfall No. 2: The Thing Got Made, but It May Not Be Yours

The content is generated, and it doesn't collide with anything. The next question cuts deeper:

Is it yours?

You'd probably think: I paid the money, I gave the instructions — of course it's mine.

The law doesn't see it that way.

First, sort things into buckets. If your material is a film or a sound recording, then in the UK and the EU, copyright arises automatically — originality is not required; it just must not be copied. But AI-generated illustrations, ad taglines, and the melodies you pair with them fall into the categories of artistic, musical, and literary works — and every one of those categories requires originality.

What is originality? The standard: a work must be "the author's own intellectual creation." In plain terms: the author made free and personal creative choices, and expressed those choices in the work.

The keyword is choice.

German courts have decided a few cases that draw this line clearly. Someone gave the AI nothing but a one-sentence prompt; the court said, that's not creation. Someone else, not convinced, wrote a detailed prompt of a full 1,700 characters, even listing alternative design options. The court still shook its head: these words were either too generic, or simply handed the multiple-choice question back to the AI. The one actually making the choices was the machine.

Still not convinced? Then revise, over and over. The courts anticipated that too: if the so-called "modifications" are merely technical fine-tuning, that's not creation. The AI's contribution still outweighs yours.

It's like handing a Michelin chef an order slip of 1,700 characters, covering everything from flavor to plating. However detailed it is, the dish is still the chef's making. You can hardly hold up that slip and claim the dish is your invention.

No matter how long the prompt, it can't substitute for creation. What truly counts is the choices made by a human.

And even if the prompt itself were ever so creative, between the prompt and the final image stands a layer of machine. That layer, the law doesn't yet recognize.

So if you want AI-generated material to hold copyright securely, there is exactly one way: have designers and copywriters make substantive modifications and additions on top of the AI output. The part a human reworked — that's what's yours.

The UK, for its part, has a special regime called "computer-generated works": the author is deemed to be "the person who made the arrangements necessary for creating the work." Sounds lovely, but who counts as that person? The one who developed the AI? The one who typed the prompt? The company that paid for the commission? Nobody can say. Worse, in its Copyright and AI report, the UK government has already proposed simply abolishing the regime. The timetable isn't set, but the direction is already clear.

The EU is more blunt: it doesn't recognize "computer-generated works" at all. If you want copyright in the EU, prove human originality, plain and simple.

And there's the most easily overlooked link of all: contracts.

A vendor's terms of service can't determine whether you have copyright, but they can determine who owns it once it exists. Many terms default to rights staying with the vendor, or grant you a license on heavily one-sided terms. So make sure the contract says it plainly: any copyright that may arise from AI output is assigned to the company.

Copyright isn't yours by default; it's yours only once it's written into the contract.

Pitfall No. 3: Before It Goes Out, Say It Out Loud

The third thing costs almost nothing, yet many teams never do it: AI-generated content must be labeled wherever a label is required.

In the EU, this is already a hard obligation.

Article 50 of the EU AI Act governs exactly this. The relevant obligations have been in full effect since August 2 this year. Note one detail: even if your company isn't in the EU, as long as the content is targeted at EU consumers, the Act reaches you.

In the EU, the law reaches whoever your content reaches.

What counts as mandatory labeling? The Act has a term for it: deepfake — AI-generated or manipulated image, audio, or video content that looks like real people, objects, places, or events, convincingly enough to pass as genuine. As long as it's used in a business context — and marketing communication certainly qualifies — you must tell consumers plainly, the first time they come across it: this was made by a machine.

How, specifically, to label? The companion draft published by the European Commission in March went into remarkable detail. On June 10, the final Code of Practice on Transparency of AI-Generated Content landed; on July 20, the accompanying guidelines for Article 50 followed. The rules sketched in the draft look roughly like this:

Short videos: the marking must be prominent and stay on screen from start to finish. If the entire clip is AI-generated, it must be labeled throughout.

Pure audio ads, 30 seconds or under: the very opening needs one spoken declaration, in the same language as the content: "This content was generated by AI."

Longer audio and video: marked at the start, and repeated through the middle. Audio gets one more at the end.

Icons have their own rules: under the draft's design, the main visual must be the two capital letters "AI," clear and prominent, never tucked where the viewer can't see them.

A few companion requirements, highlights for marketing:

One: labeling can't be left entirely to automatic machine flagging; a human must be watching. Keep records of every generation and modification step, ready to inspect at any time.

Two: training. What must be disclosed, how to embed it into the workflow, how to fix a wrong label — all of it must be taught to staff.

Three: artistic works get leeway: fictional and artistic works may be labeled in ways that don't spoil the viewing experience — say, in a corner of the ad or beneath the image, as long as it's visible at first glance. Marketing materials can basically follow the same approach.

Four: if your AI tool has built-in labeling, turn it on and use it. That's also the direction regulators encourage.

Friends in the UK may ask: what about us?

The UK has no dedicated AI legislation yet. The House of Lords Communications and Digital Committee's report of March 6 this year recommended legislation to compel AI developers into transparency disclosures; the government's Copyright and AI report of March 18 was vague about when labeling duties would land, promising only to watch how other countries' approaches play out and to work out best practices together with industry.

But don't breathe easy just yet.

The advertising industry's old rules are still in force. The UK's CAP Code requires that ads must not mislead, must not cause harm, and must be responsibly prepared; guided by the government's 2023 AI white paper, the Advertising Standards Authority is also advancing non-binding principles of transparency, explainability, and accountability. And on February 5, the Advertising Association released a voluntary guide: clearly fictional, clearly impossible content generally doesn't need a dedicated AI label; but the ordinary advertising disclosure rules still apply as ever. There's exactly one touchstone: would an ordinary consumer be misled about the nature or provenance of the content?

What happens if you label wrong? At the light end, the ad regulator comes knocking; at the heavy end, the AI regulator and the ad regulator settle the whole bill at once.

Five Steps, One Process

That's a lot of pitfalls. Turned into action, it comes down to five steps.

1. Run due diligence on your AI vendors. Whether their IP compliance policy holds up, how much the indemnity covers, whether they've ever been sued over IP — check all of it.
2. Put the labeling obligations into the publishing workflow. For content aimed at EU consumers, follow Article 50 and the Code of Practice: labeling, training, record-keeping — all of it, no exceptions.
3. Archive all prompts and process. It's evidence for copyright protection, and defense material for future infringement complaints.
4. Approval before publishing. Route AI material into the existing human review process — similarity checks where needed, rights clearance where needed. And set rules at the same time: who may use which tools, and what they may do with them.
5. Follow the news. Legislation and policy in this territory change month by month. What was right last month may not be enough this month.

When in doubt, don't guess. Against the cost of launching one big campaign, a lawyer's fee is a rounding error.

Back to That Message

Remember the message at the start?

"Probably not, right? Everyone's using it anyway."

Now, here's how you can reply:

Yes, use it — you can. But keep prompts clear of other people's IP, keep a record of the process, run review before publishing, remember to label anything going to EU consumers, and write clearly into the contract who owns the copyright.

Five steps, one morning to set up the process. Compared with a lawyer's letter, this deal is a steal.

And may you never have to explain to a judge where a single image came from.