A one-page AI creative tool policy for staff: age, likeness, data and sign-off

Most small agencies and studios do not need a 20 page AI policy. They need one page that every person can read in three minutes, sign, and actually follow. This article gives you that page: a table of what is allowed, what needs approval and what is never allowed, followed by the reasons behind each rule and text you can paste.

I wrote this for image and video tools, the kind that make a picture, a clip, a voice or a talking face. Rules for writing tools and chat assistants overlap, but the risks in likeness, consent and provenance (the record of how a file was made) are sharper for visual work.

Why a one-page rule beats a long policy for a small team

A long policy gets signed and then ignored. A short one gets used, because a designer who is about to upload a client photo can check it in ten seconds. Three design choices keep it short.

• Three buckets, not fifty rules. Allowed, ask first, never. Staff only have to decide which bucket a task is in.
• Rules tied to something real. Where possible, point at the vendor terms your staff already accept when they open an account. Then the rule is not your opinion, it is a condition of using the tool. I use Higgsfield's Terms of Use (last updated 23 October 2026) as the example below, but the same idea applies to any tool. Read the terms of the tool you actually use.
• One named person. A rule with no owner is a suggestion. Someone approves tools and signs off client work. In a team of five that can be the same person.

For a broader frame, the US National Institute of Standards and Technology (NIST) publishes a voluntary AI Risk Management Framework (version 1.0, January 2023) and a Generative AI Profile (NIST AI 600-1, July 2024). They are written for larger organisations. Treat them as background reading, not as something a five person studio has to implement.

Allowed, ask first, never: the table

Copy this table as the top of the page. Adjust the examples to your work.

Bucket	Examples	Rule
Allowed	Mood boards and concept art for internal use; backgrounds and textures; product scenes built from the client's own approved product shots; test drafts that never leave the team	Use an approved tool on a company account. Keep the prompt and the file.
Ask first	Anything that shows a real person; anything that uses a client's unpublished material; voice cloning; a new tool or a new plan; any output going into a paid ad or a regulated sector such as health, finance or property	Get the approver's yes in writing before you start, not after.
Never	Making someone appear to say or do something they did not; copying a living person's face or voice without their written agreement; pretending the work is human-made when it is not; putting personal data, health, financial or other sensitive details in a prompt; removing watermarks or provenance marks; using a tool the approver has not cleared	No exceptions. If a client asks, escalate to the approver.

Age and who may use the tools

Higgsfield's Terms say users must be 18 or the age of majority where they live (sections 1 and 2.1). That is typical for this category. It matters for a studio in three ways.

• No minors as tool users. An intern under 18, a work-experience student or a young freelancer should not be given a login to an AI image or video tool, whatever the tool's own terms say. Check the terms of each tool you use and assume the same.
• No minors in the content without a guardian. That one is a company rule, not a vendor rule. Do not generate, edit or animate images of a child unless the parent or guardian has agreed in writing and the approver has said yes. The simplest version of the rule is never, unless a named approver and a guardian agreement are both on file.
• Company accounts only. Staff use accounts the company pays for and controls. No personal accounts for client work, because you cannot see, export or delete what is in them. The same Terms also prohibit sharing one login between people (section 2.4), so give each person a seat. For the seat and billing side, see how to share an AI account across a team.

Freelancers and subcontractors should follow the same page. Put a line in their agreement that requires it, and have them sign the sheet.

People: likeness, voice, consent and impersonation

This is the part of the policy that protects you from your worst day. The Higgsfield Terms say that you confirm you hold all rights and consents for any name, likeness or voice in the material you upload (sections 4.2(b) and 5.3). They also ban impersonation (5.2(viii)), ban identifying people from their faces with biometric tools, and ban intimate images of a real person made without their consent (6.5). Other vendors have similar clauses. A staff member who uploads a stranger's photo is not just breaking your rule, they are breaking the contract you accepted.

Turn that into four plain rules.

1. Written consent for any real person's face or voice. Employee, model, client executive, customer. A short signed form that says what the image or voice will be used for, where, and for how long. For the agreement side, a signature service is the usual route.
2. No impersonation. Do not make a version of a client's chief executive, a competitor's founder, a celebrity or a politician, even as a joke or a draft.
3. No fake testimonials. A generated face saying a customer quote is not a customer. See when agencies should disclose AI use for the disclosure side, and note that in the US the FTC has a rule against fake reviews and testimonials.
4. Take it down fast. If a person asks you to remove an image or voice of them, the approver removes it the same day and tells the client.

Data: what never goes into a prompt or an upload

Two separate questions here. The first is what staff may paste into a prompt. Higgsfield's Terms (section 5.4) tell users not to submit sensitive personal data in prompts, and I would apply the same limit across every tool. Sensitive means health details, financial account numbers, government ID numbers, passwords, anything covered by a client's confidentiality agreement and any personal data of customers.

The second is whether the vendor may train its models on what you upload. That depends on the tool and the plan. Under the Higgsfield Terms (section 4.4), content may be used to train and improve its models, except for customers under an Enterprise agreement. I do not repeat the full comparison here. It is in does your AI tool train on client work, which also has a green, amber and red sorting table for uploads. Link that page in your policy and let staff use its levels.

One more point for team accounts: Higgsfield's Terms (section 2.5) say workspace administrators may access, monitor and manage members' content. Staff should know that what they make on a company workspace is visible to the admin. It is not a private diary.

Labels, provenance and disclosure

Provenance means the marks and metadata that show a file was made or edited by AI. A common standard is C2PA (Coalition for Content Provenance and Authenticity), also called Content Credentials. Higgsfield's Terms say it may embed machine-readable markers such as C2PA signals and that users must not remove or hide them (sections 6.4 and 5.5). The Terms do not promise a marker is always added or always survives, so do not tell a client that your files are guaranteed to carry one.

Policy rules for this section:

• Never strip a watermark or provenance mark. Never crop it out of a paid-plan or free-plan file.
• Do not describe AI output as human-made. The Terms bar representing output as human-generated (section 5.2(xi)), and several platforms now ask for labels.
• Label where a law or platform rule requires it. The rules are moving. The EU AI Act, Article 50, applies from 2 August 2026 and requires people who deploy deepfake-type image, audio or video to disclose that it was artificially generated or manipulated. YouTube asks creators to disclose realistic altered or synthetic content. Check the current rule for each place you publish. Do not copy a rule from this page without checking it is still in force.
• Do not claim AI outputs are unique or that you own them outright. Higgsfield's Terms say outputs may not be unique across users and give no guarantee of uniqueness or originality.

The full disclosure policy (what to tell clients, in contracts and on the work) belongs in its own document. Use should agencies disclose AI use for that, and keep this sheet to conduct.

Review and sign-off

Nothing AI-made reaches a client without a named human looking at it. Make the check specific, or it becomes a glance.

1. Who made it, with which tool and plan. Written on the file or in the project note.
2. Faces, hands, text and logos checked. Zoom to 100 percent. AI tools still produce wrong fingers, garbled text and altered logos.
3. Look-alike check. Does any face look like a real person who has not agreed to it?
4. Claims check. Does the image show a result, a product feature or a before and after that is not true?
5. Label check. Does this channel or this client need an AI label?
6. Approver name and date on the deliverable record.

Keep the prompt, the settings and the final file together. If a client or a platform asks how something was made, you can answer in a minute. A shared place to keep them is covered in where to keep AI images, videos and prompts.

Connectors, plug-ins and shared accounts

Newer tools can connect to other services. A connector is a link that lets an AI assistant read or act in another system, often through a standard called the Model Context Protocol (MCP). Anthropic's support page for custom connectors in its Claude assistant warns that custom connectors are not verified by Anthropic, advises connecting only to servers you trust and notes that on Team plans only the owners add them. The rule I would take from that: only the approver adds connectors, plug-ins or API keys. Staff do not connect random servers to a company account.

Two related rules. Do not share one login. Do not give an automation tool a key that can spend credits without a limit. If your plan has spend controls, use them. For tracking cost by client, see how to track AI spend by client.

Incident route

Add one line that says who to tell and how fast. Example: "If you think you uploaded something you should not have, or a tool made something that looks like a real person, stop, do not delete anything, and message the approver within one hour." Deleting hides evidence and may not remove the file from the vendor anyway. Higgsfield's help center, for instance, describes a 30-day recovery period after an account is deleted, so deleting does not remove a file at once.

Copy-paste policy text

Paste this into a document, replace the words in square brackets, and have each person sign and date it.

AI CREATIVE TOOL RULES, [Company name]. Version [date]. Approver: [name].

1. Tools. Use only tools the approver has cleared, on company accounts, one login per person.
2. Age. Only people aged 18 or over use these tools. No content showing a minor without a signed guardian agreement and approver sign-off.
3. People. No real person's face or voice without their written consent. No impersonation of any real person. No fake testimonials.
4. Data. No sensitive personal data, client secrets or passwords in prompts or uploads. Follow the upload levels in [link to data levels].
5. Provenance. Do not remove watermarks or provenance marks. Do not describe AI output as human-made.
6. Labels. Label AI content where the law, the platform or the client contract requires it.
7. Review. Every AI-made deliverable is checked by a named person before it goes to a client. Prompt, settings and file are kept together.
8. Connectors. Only the approver adds connectors, plug-ins or API keys.
9. Problems. Tell the approver within one hour. Do not delete.
10. Review date. This sheet is reviewed every quarter and when a tool's terms change.
11. Consequences. Breaking rules 3 to 5 is handled under [our existing disciplinary or contractor terms].

Signed: [name]   Date: [date]

A rule with no consequence is only advice, so tie the sheet to the disciplinary terms or contractor agreement you already have rather than inventing a new process. Say plainly that rules 3 to 5 (people, data, provenance) are the serious ones.

Keep it alive with a 15 minute review

Terms change. Higgsfield's say "Last updated: October 23, 2026" at the top, which gives you an easy trigger. Once a quarter, the approver opens the terms of each tool in use, checks the date, and reads anything new. Fifteen minutes. If a clause changed in a way that affects the table, update the table and have people re-sign.

Who can skip this

A one-person studio that only uses AI for private mood boards may not need a signed sheet. Even then, keep rules 3 to 5 in your head. A business with regulated clients, such as health, finance, property or children's products, needs more than one page and should have a lawyer read the final version. A page like this is a start, not a substitute for advice.

How I'd approach this

I would start with the table and the ten lines above, sign it with the team in a 20 minute meeting, and run the first real client job through the sign-off list so people see how short it is. Then pair it with a training week so the rules turn into habits: how to train an agency team on AI creative tools covers that. Revisit the sheet after the first quarter and cut any rule nobody used.

If you want the sign-off, asset library and approvals to live in one place instead of a shared folder and a chat thread, Blur Studio builds repeatable approval workflows and shared asset libraries around the tools a team already uses.