Artificial intelligence and advertising imagery: greater risks for businesses

The client’s responsibilities

The publication of images generated or manipulated using AI entails different obligations and risks compared to the production phase. When content incorporates deepfakes or synthetic material, it must be specifically labelled (Article 50 of Regulation (EU) 2024/1689). Responsibility for this disclosure lies with the publisher of the content and therefore, in the case of commercial photography, with the commissioning company.

Article 612-quater of the Criminal Code punishes anyone who, without the consent of the person concerned, distributes, publishes or disseminates images, videos or voices that have been falsified or altered by AI systems, which are likely to mislead as to their authenticity and are such as to cause unjust harm. Further risk factors will emerge from the implementing decrees (preliminary examination by the Council of Ministers on 10 June), which provide, amongst other things, for the new offence of failure to adopt security measures for high-risk AI systems and the extension of corporate liability pursuant to Legislative Decree 231/2001.

The publication of AI-generated images that mislead consumers as to the actual appearance or nature of the product – a phenomenon that is particularly prevalent in the food, cosmetics and fashion sectors – may also constitute an unfair commercial practice (Consumer Code, Legislative Decree 206/2005), resulting in exposure to proceedings by the Italian Competition and Market Authority and to procedures under the Advertising Self-Regulatory Body.

Italian standards updated in 2025

At present, it is not always clear who holds the commercial usage rights amongst the supplier-deployer, the client company and the provider of the AI software. Barring exceptional cases, works generated by AI are not protected by copyright; they may fall within the category of simple photographs, but only provided that all the necessary procedures for protection are put in place.

Italia was one of the first countries to adopt legislation on artificial intelligence: Law No. 132 of 23 September 2025 specifically sets out the definition of a protected work and the rules governing the extraction of data from the internet.

This definition is even more important than in the past, given that two aspects need to be assessed:

a) whether the images that the AI uses in the input phase are free of copyright;

(b) whether the works produced in-house or acquired from external suppliers are themselves protected or not.

It should be noted that the Copyright Act (Lda, Act 633/1941) distinguishes between creative works (Article 1), which enjoy full protection, and simple photographs (Article 87, paragraph 1), which are subject only to ‘related’ rights, which include, for example, typical product photos for e-commerce. The most significant difference between the two concerned the varying duration of copyright protection and was (almost) eliminated by Act 182/2025, which standardised the duration to 70 years (Article 92, Lda).

The new general definition of protected works (Article 1) now refers to ‘works of human creativity (…) even where created with the aid of artificial intelligence tools, provided that they constitute the result of the author’s intellectual labour’. The text added to the original provision is not without ambiguity and is likely to give rise to disputes and differing interpretations on various aspects:

(a) the aid, which appears to literally exclude images created exclusively by AI;

b) artificial intelligence tools, a concept to be fleshed out with technical details;

c) the result of the author’s intellectual work, which requires definition.

The use of AI necessarily involves a degree of direction from the photographer, which takes the form of analysis, formulation and, finally, application prompts to be provided to the various software programmes. Future debate will ultimately focus on this aspect: namely, to what extent can the creation of a prompt be considered, in itself, an authorial intervention.

Reduced protection for ‘simple’ photographs
In the most common scenario, the result produced with the aid of AI is not a work protected by copyright but could be considered a ‘simple photograph’, which is entitled to protection under ‘related rights’ (Article 88, Lda): the exclusive right to reproduce, distribute and sell the photograph.

Economic rights may only be invoked if the conditions set out in Article 90 of the Copyright Act are met; copies of the photograph must bear the following information:

1. the name of the photographer, or of the company for which the photographer works, or of the client;

2. the year in which the photograph was taken;

3. the name of the artist who created the photographed work of art.

However, the issues surrounding image ownership in connection with the use of tools based on artificial intelligence remain entirely unresolved.

The practical effectiveness of this protection system is limited in two respects. On the one hand, companies rarely publish images with the photographer’s name and, in the absence of such information related rights are not enforceable against third parties, unless the rights holder can prove the reproducer acted in bad faith. On the other hand, even images that originally contain all the information in their metadata are frequently reposted and uploaded to other websites and platforms which remove them: if the information is not permanently affixed to the photograph, the file circulates without it and the related rights are not enforceable against third parties.

Mining permitted within the limits of the law

Reproductions and extractions from works or other materials contained on the internet or in databases to which one has lawful access, for the purposes of text and data extraction using artificial intelligence models and systems, including generative AI, are permitted in accordance with the provisions of the Copyright Act.

Text and data extraction refers to any automated technique designed to analyse large quantities of text, audio, images, data or metadata in digital format with the aim of generating information, including patterns, trends and correlations.

Extraction is permitted where the use of the works and other materials has not been expressly reserved by the holders of copyright and related rights, or by the owners of databases.

For the lawful exercise of mining, it is therefore necessary for the third party to have lawful access to the content via licences or subscriptions, and for the rights holder not to have exercised their right of reservation. Furthermore, the legislation does not specifically regulate the procedures by which copyright holders should express their refusal to allow the use of images (the so-called opt-out).

Software does not always grant exclusive rights

In addition to copyright issues, it is important to bear in mind that the models used to create AI-generated images do not always grant commercial licences or exclusive rights of use. This means that a company might create images without being able to use them for promotional purposes, or that others (even competitors) may use identical or similar images even before the promotional campaign has begun.

Most systems that allow users to generate images using AI have default settings which, if not changed, grant the provider the right to use the uploaded images for training purposes: settings that users often do not change or that the system does not allow them to change. Thus, for example, a company might upload photos of a new prototype, and the service provider might use those very same images to build or expand its own datasets; consequently, the model might generate images for other users that reproduce, in whole or in part, components covered by trade secrets.

Further checks are therefore essential, not least because there are various software licence agreements, the terms of which are, moreover, constantly being amended. If the company uses external suppliers, the relevant contracts must include specific clauses and conditions, including a prohibition on the use of systems that lack the appropriate safeguards.

Disclosure and labelling requirements

The advent of AI necessitates a complete redefinition of all the technical conditions and, above all, the legal conditions governing the production, use and protection of images. Processes, internal policies, controls and safeguards must be rigorous and extended to include external suppliers (photographers, post-production specialists, communications agencies) with whom the company works, thereby mapping out and monitoring the entire production chain leading to the final image.

This is not merely a matter of best practice. From 2 February 2025, Regulation (EU) 2024/1689 requires developers and professional users to ensure that their staff and collaborators have adequate expertise in AI. From 2 August 2026, system providers will be required to label synthetic outputs in a machine-readable format, and users will, in certain cases, be required to state clearly and visibly, at the time of first public display, whether or not content has been generated using AI. These deadlines are not affected by the current version of the EU’s Digital Omnibus extension measure.

Please note that the obligation to disclosure lies with whoever publishes the content and not (or not only) with whoever produced it: the professional using the AI tool must inform the client, but it is the company disseminating the material that must ensure the public is notified where necessary.

Companies will therefore need to put in place processes, internal control systems and prevention models (Legislative Decree 231/2001), all the more so given the forthcoming introduction of new categories of offences.

Insurance cover should also be checked carefully, as some policies on the market may exclude the risk of AI. Furthermore, the compensation offered by providers only covers certain plans, includes exclusions and does not constitute full cover.