Module 10 — Rights, provenance and acceptable use
Nine modules of pipeline and one meta-fact left: an image that works technically can still be illegal to publish, embarrassing to associate with the brand, or a lawsuit waiting to happen. This module is the one every technical course tries to skip and every serious project needs. It is not a substitute for legal counsel — nothing on the internet is — but it is a working checklist for the BoisClair project and for any similar catalog work.
Read the model license, not the vibes
Stable Diffusion 1.5 was released by CompVis and Runway under the CreativeML OpenRAIL-M license, which permits commercial use but forbids specific uses (illegal content, harassment, generating content about identified individuals without consent). SDXL is under a similar OpenRAIL variant with a small extension around downstream distribution. Both are permissive for a catalog project like BoisClair.
Two nuances that trip teams up.
"Open" is not "public domain". OpenRAIL is a license, and its use restrictions bind you. Producing deepfakes of political figures with an OpenRAIL model is a license breach on top of everything else.
Third-party fine-tunes have their own licenses. A LoRA downloaded from Civitai may forbid commercial use, or require attribution, or forbid resale of merged models. Read every artifact's own license — the model card, the README, the Civitai page — before shipping. "Open source" as a general vibe is not a legal position.
Log the exact model versions used per image (base model, LoRAs, ControlNets, VAE) in the same metadata store as the seed and prompt. Six months later, when a license changes or a fine-tune is retracted, that log is what tells you which images to reproduce clean.
Brand and personality rights
The model does not know that "a Coca-Cola bottle on a mid-century chair" involves a trademark. You do. Producing an image with a recognizable brand logo, a recognizable product silhouette, a recognizable public face, or an identifiable private individual is a rights problem regardless of whether the model generated it or a camera captured it. Three concrete rules for the BoisClair project.
No third-party logos in props. Books, wine bottles, laptops in ambience shots should have blank labels. The model is happy to invent generic ones; a negative prompt "brand logo, text, signature" reduces stray text on props.
No identifiable faces unless the person consented (or, for public-domain historical images used at training time, the specific license permits it). The safe move for lifestyle shots that need a person is stylized or partial: back view, cropped face, blurred face, or a person who is clearly rendered as an illustration.
No look-alikes of a specific product that a competitor owns. "Mid-century oak chair" is fine; a chair that is unmistakably an Eames DSW is a design-right problem, model-generated or not.
Watermarks: what they can and cannot do
Two families of watermarks show up in AI-generated image workflows.
Invisible statistical watermarks — the Stability AI reference implementation embeds a low-frequency pattern that can be detected by a matching decoder. They survive light compression and cropping; they do not survive heavy edits, screenshotting or intentional removal by a determined actor. Their value is provenance for honest publication, not forensics against fraud.
Visible watermarks — a small logo or text in a corner. Trivially removable by a competent user, but useful for casual attribution on social media.
For BoisClair, a visible corner mark is a marketing decision; an invisible watermark plus C2PA metadata (below) is the technical minimum for provenance.
C2PA content credentials
C2PA (the Coalition for Content Provenance and Authenticity) is an emerging standard that embeds signed provenance metadata inside the image file: what tool created it, when, from what inputs, with which subsequent edits. Adobe, Microsoft, OpenAI and several camera makers support it in 2026.
For a Stable Diffusion pipeline, the pragmatic move is to attach at export time a JSON manifest that records:
- Base model and version (
stable-diffusion-xl-base-1.0) - LoRAs, ControlNets, IP-Adapters and their versions
- Prompt, negative prompt, seed, steps, guidance, scheduler
- Every subsequent edit (inpaint, upscale, face restoration)
- A hash of the final image and a signature
Whether or not you use the official C2PA library, having that manifest in your own DAM (digital asset manager) is what lets a client ask "how was this made?" and receive a truthful answer. It is also what lets you comply with jurisdictions — the EU AI Act among them — that require disclosure of AI generation for certain use cases.
manifest = {
"creator": "boisclair-brand",
"created_at": "2026-11-14T10:32:00Z",
"model": {
"base": "stabilityai/stable-diffusion-xl-base-1.0",
"lora": [{"name": "boisclair-lora", "weight": 0.8}],
"controlnet": [{"name": "controlnet-depth-sdxl-1.0", "weight": 0.5}],
},
"generation": {
"prompt": prompt,
"negative_prompt": neg_prompt,
"seed": 20261007,
"steps": 30,
"guidance": 6.5,
"scheduler": "DPM++ 2M Karras",
},
"edits": [
{"type": "inpaint", "region": "armrest", "seed": 42},
{"type": "upscale", "method": "real-esrgan-x2"},
],
"image_sha256": image_hash,
}
An acceptable-use policy for the BoisClair project
Written down, signed off by the people who take the risk if it is broken.
- Only BoisClair-owned or clearly generic subjects. No competitor products, no third-party logos.
- No identifiable real people without a signed release. Stylized, cropped, or back-facing figures only for lifestyle shots.
- No claims that AI-generated images are photographs of physical products in contexts where that matters — regulated advertising, product-return policies, judicial evidence.
- Provenance manifest attached to every published image, stored in the DAM.
- Watermark, visible or invisible, on every image released to the public.
- Quarterly license audit: model, LoRAs, ControlNets, upscalers. Retire artifacts whose license has been withdrawn or whose provenance is unclear.
- A named human reviewer for every asset before publication. Automated generation is not automated publication.
Training data and its shadow
The models this course uses were trained on datasets scraped from the public web (LAION-5B for SD 1.5, private-plus-public compositions for SDXL). Ongoing lawsuits question whether some of that training was permissible. Consequences you can already act on today.
Do not generate in the explicit style of a living, named artist. "In the style of [artist name]" is a legal gray zone that is closing, and it is a reputational problem regardless of law.
Prefer LoRAs trained on your own images for a house style rather than a LoRA scraped from a stranger's fan art on Civitai. This is what BoisClair does in module 7 — and part of the reason is not aesthetic, it is provenance.
Track model version and origin. If a model is later retracted or its license tightened, you need to know which of your assets used it.
This module gives you a working technical checklist. It does not replace a conversation with a lawyer in your jurisdiction — copyright, personality rights, trademark and AI-specific regulation all vary substantially by country and are moving fast. For any commercial launch, read your latest local guidance and, when the risk is non-trivial, get formal advice.
In summary
- Read the license of the base model, every LoRA and every ControlNet; OpenRAIL is not public domain, third-party fine-tunes have their own restrictions.
- Brand and personality rights bind you regardless of whether a camera or a diffusion model produced the pixels; no third-party logos, no identifiable faces without consent, no look-alikes of competitor products.
- Provenance is a first-class output: a C2PA-style manifest per image, an invisible watermark, and a named human reviewer before publication.
- The training-data lawsuits are unresolved; prefer LoRAs trained on your own images, avoid living-artist name prompts, and track model versions so you can react to a retraction.
Next module: the course recap, the decision tree "which tool for which edit", and the 40-question exam that certifies you can run this whole pipeline in production without getting the brand in trouble.