The last session is a drafting session
Sessions 1 to 5 gave you evidence. This one gives you a document. By the end of the page you should have four clauses written in your own words, each answering a question that every vendor in this market has left blank.
★ What you walk out with tonight. A correct, dated statement of what the law requires and from when, sourced to the instruments themselves. A working distinction between what your vendor owes and what you owe. And a four-clause policy draft that answers the questions the whole market has left open.
LiveWhy this course ends here and not with a video3 min▶
Making a synthetic presenter takes an afternoon. Being able to answer for one takes a written position, and nobody sells you that. Every vendor policy you read in this course was written to allocate the vendor's risk, not to settle yours.
So the deliverable is a policy, and the reason is legal as well as ethical. Since 2 August 2026, EU AI Act Article 50 has been in application, and paragraph 50(4) does not put the disclosure duty on the company that built the model. It puts it on the party deploying the system. In this room, that is you.
Four absences were verified across all three major vendors during research for this course: no consent expiry or re-consent cadence, no answer to what happens to published video after consent is withdrawn except Synthesia's answer that it stays up, no offboarding policy for leavers at two of the three, and no published takedown route at D-ID at all. Those are not gaps in the research. They are gaps in the market, and they land on your desk.
Self-studyHow to read a legal claim in this field without getting burned3 min▶
Most published summaries of AI likeness law are wrong in one of three specific ways, and once you can name them you can check any claim in about two minutes.
- A bill described as a law. The NO FAKES Act is the most quoted "federal likeness protection" in the market. It was introduced on 9 April 2025 and the latest recorded action is the day it was introduced. It has never had a floor vote in either chamber.
- A political agreement described as legislation. Denmark's widely reported deepfake likeness law is a June 2025 cross-party political agreement plus an announced legislative-programme item. A query of the Danish Parliament's own open-data API across five sessions found no tabled bill. Report it as an agreement.
- A commentator's label quoted as a statute name. "California Provenance, Authenticity and Watermarking Standards Act" appears nowhere in the bill text. The Legislature's own topic is simply "California AI Transparency Act".
The check in all three cases is the same: find the primary instrument, read its status line, and note the date you read it. That habit is worth more than any summary, this one included.
The duty is on the deployer, and the deployer is you
7 min liveArticle 50 splits the transparency obligations between two different parties, and almost every summary blurs them. Getting the split right is the difference between a policy that works and one that assumes your vendor has already handled it.
LiveThe two paragraphs, and what each one actually obliges5 min▶
Read them as two separate duties owed by two separate parties, because that is what they are.
The reduced obligation applies where the content is "evidently artistic, creative, satirical, fictional or analogous", and there the disclosure must not "hamper the display or enjoyment" of the work. That is a lighter form of disclosure, not an exemption from it, and a corporate explainer video is not going to qualify.
The date correction most summaries get wrong. The Digital Omnibus did not delay Article 50. It moved the high-risk deadlines. Article 50 applies from 2 August 2026, and systems already placed on the market before that date must comply with the 50(2) marking obligation from 2 December 2026. If somebody tells you transparency has been pushed to 2027, they have read a headline about a different part of the Act.
Practically: your vendor's marking may or may not be there, may or may not survive the platform you upload to, and is invisible to the viewer by design. Your disclosure is the one a human being actually sees, and it is the one you are named for.
Self-studyThe Code of Practice, and why voluntary matters here3 min▶
The Code of Practice on Transparency of AI-generated Content was published on 10 June 2026, with roughly 190 signatories by late July 2026. It is voluntary. Signing it does not create the obligation and not signing it does not remove one.
What a code of practice does give you is a defensible reference point: a documented, externally authored description of what good looks like, which is a more comfortable thing to cite in an internal paper than your own judgment alone. Use it that way and do not overstate it. If a vendor tells you they are compliant because they are a signatory, they have described an intention, not a control.
Self-studyUS law, primary-sourced, with the status of each stated honestly4 min▶
| Instrument | Status, and what it actually does |
|---|---|
| TAKE IT DOWN Act Public Law 119-12 | Platform notice-and-removal duty live since 19 May 2026. Removal "as soon as possible, but not later than 48 hours", enforced by the FTC. Its "digital forgery" definition explicitly covers content made "through the use of software, machine learning, artificial intelligence". Confined to non-consensual intimate imagery |
| California AI Transparency Act | Operative 2 August 2026 for generative systems with over 1,000,000 monthly users. Penalty $5,000 per violation, each day separate. A different threshold, 2,000,000 unique monthly users, picks up large online platforms from 1 January 2027 |
| NO FAKES Act | Still only a bill. Introduced 9 April 2025, no action since. Not law, and nothing in your policy should assume it |
| FTC Impersonation Rule 16 CFR Part 461 | Covers government and businesses only. The extension to impersonation of individuals was proposed in March 2024 and never finalised. Cloning a private individual's voice is not covered by this rule |
That last row surprises almost everyone, including people who cite the rule regularly. It is a good test of whether a source has read the instrument or a summary of it.
Four dates, and three of them have already passed
5 min liveThe most common posture in this market is treating all of this as something arriving next year. Put the dates on a line and that posture stops being available.
LiveTwo corrections that teach you how to check a claim4 min▶
These matter less as facts than as method. Both were caught by reading the statute text rather than the commentary about it, and both are repeated confidently in material you will be sent.
C2PA is the obvious practical implementation. It is not a statutory citation. If your policy says "we comply with California by using C2PA", you have written a technology choice as though it were a legal requirement, and when the technology changes your policy will be wrong.
The habit worth taking from this session. Before any legal claim goes into your policy, find the instrument, search it for the words you are about to attribute to it, and write down the date you checked. Two minutes of that would have caught both of these, and it will catch the next one too.
Self-studyDenmark, and how to report something that has not happened yet3 min▶
Denmark's deepfake likeness protection has been reported worldwide as a law. It is a June 2025 cross-party political agreement plus an announced legislative-programme item. A query of the Danish Parliament's own open-data API across five sessions found no tabled bill.
That is not a criticism of the policy, which may well be excellent and may well be enacted. It is a point about how you write. "Denmark has agreed to legislate" is accurate and still interesting. "Denmark has passed a law giving people copyright in their own likeness" is not accurate, and if it appears in your board paper somebody will eventually check it.
Provenance is not the control you think you have
6 min liveThere is a comfortable version of this session where you buy provenance technology and the disclosure problem goes away. It is worth closing that door properly, using C2PA's own words rather than its critics'.
LiveMembership is not implementation, and this is the sharpest vendor fact in the course4 min▶
| Vendor | On the C2PA member list | Documented signing of outputs |
|---|---|---|
| HeyGen | Yes, Contributor tier | None findable anywhere |
| Synthesia | No | Yes, per its own docs: videos "carry C2PA-based provenance signals embedded in the file" |
| D-ID | No | No, and C2PA is never mentioned. Visible watermarks instead, tiered by plan |
The vendor on the membership list is the one with no documented signing, and the vendor doing it is not a member. That is the whole lesson about how to read a trust badge. A logo on a members page is a subscription, not a behaviour, and the only way to tell the difference is to go and look for the artefact.
What to actually do with this in procurement. Never ask "are you a member of X". Ask "show me an output file from your product with the signature in it, and tell me which of your plans produce one". A vendor who can do that in a day is telling you something real. A vendor who sends you their ethics page is not.
Self-studyC2PA's own stated limits, quoted from C2PA3 min▶
Both of these come from C2PA's own documentation, which is to their credit and makes them impossible to argue with.
Put those two together and you have the shape of the problem. A credential can be stripped, and its absence proves nothing, which means provenance cannot be the mechanism your audience relies on to know what they are watching. Your disclosure can be, because you control it and it survives the file being re-encoded.
Self-studyThe independent security analysis, with its sourcing stated3 min▶
In April 2026, UMBC Cyber Defense Lab, Hacker Factor and the NSA published the first independent security analysis of C2PA. Their conclusion was that "the current C2PA specifications fail to achieve their claimed security goals", and that it "should not yet be relied upon for high-stakes uses such as financial disclosures, journalism, or legal evidence".
Documented failures included timestamps that can be replaced without detection and certification "based largely on self-reported compliance".
Sourcing note, and this course holds itself to the standard it teaches. This is an arXiv whitepaper with no peer-reviewed venue identified. Attribute it as such. It is a serious document by serious institutions, and it is also not a peer-reviewed finding, and both of those things are true at once. Cite it as "an independent whitepaper concluded", never as "research has proven".
Four blanks, and filling them in is the policy
★ 18 min · everyone writesThis is the part nobody can do for you. Every question below was verified as an absence across all three major vendors. There is no market answer to copy, which means whatever you write tonight is, for your organisation, the answer.
Clause 1, expiry. Pick a number of months and write it down. D-ID states its consent recording "can be reused for future avatars", which means one recording and unlimited future avatars with no re-affirmation. If you find that uncomfortable, the fix is a date in your own policy, not a conversation with the vendor.
Clause 2, revocation. Decide what withdrawal actually reaches. Synthesia's published answer for retired avatars is that existing videos "remain accessible and functional in your library". Opting out stops future generation. It does not retract what exists. Your clause has to say whether yours does.
Clause 3, leavers. Synthesia is the only one of the three that publishes an answer, and the answer is that the person's avatar does not transfer to the employer but every video already made with their face does, with share links and embeds continuing to work. Write what happens on someone's last day, and write who signs it off.
Clause 4, takedown. Name a person, not a team. Name a route that works from outside your organisation, because the person who needs it may not have your intranet. HeyGen writes the removal right down and D-ID publishes no route at all, so this clause has to stand on its own.
Now add the disclosure line, and choose the wording deliberately. Article 50(4) tells you that you must disclose. It does not tell you what to say. The research from session 4 does: nobody finds a trust benefit from disclosure, and "AI-generated" fares worse than "AI-assisted, human-reviewed". Write the exact sentence that will appear on screen, once, and then use it everywhere.
The reason a four-clause policy beats a forty-page one. Every clause above answers a question somebody will actually ask you: the person whose face it is, the person who left, the stranger who found themselves in your advert, and the regulator. A policy that answers those four in plain language is defensible. A policy that recites the AI Act back at itself is not, because it never says what your organisation will do.
Draft the policy
60 min- Write the four clauses properly, one page total. Expiry, revocation, leavers, takedown. Plain sentences, real numbers, a named owner. If a clause runs past four lines, you are describing a process rather than deciding something.
- Write the disclosure sentence that will appear on screen. One sentence, chosen wording, used identically everywhere. Then write one line underneath explaining why you chose those words rather than "AI-generated", because someone will ask.
- Add a scope line at the top. Which avatar types this covers, which vendor and plan, and which content types are out of bounds entirely. A policy without a scope line gets applied to things it was never meant for.
- Add a dated sources footer. For every legal claim in the document, the instrument and the date you checked it. This is what makes the policy survivable a year from now, when three of the dates in this session have been superseded.
- Send it to the person whose face it is, before you send it to legal. If they read it and are still comfortable, you have something. If they read it and go quiet, you have learned the thing the vendor policies were never going to tell you.
Three questions
Clear all three and session 6 gets stamped in your passport, which completes the course.
1 · Your organisation publishes a marketing video featuring a synthetic presenter of a real employee. Under EU AI Act Article 50, who owes the duty to disclose that the content is artificially generated?
Article 50 splits the duties. 50(2) obliges the provider to mark outputs in a machine-readable format, which is invisible to the viewer and frequently stripped in distribution. 50(4) obliges the deployer to disclose that the content has been artificially generated or manipulated. The Digital Omnibus moved the high-risk deadlines only; Article 50 has applied since 2 August 2026.
2 · A vendor tells you their product satisfies the California AI Transparency Act because it writes C2PA Content Credentials. What is wrong with that sentence?
A text search of the enacted and introduced versions returns zero hits for "C2PA", "Content Credential" or "Coalition for Content". C2PA is the obvious practical implementation and is not a statutory citation. The longer name in option B is a commentator label that appears nowhere in the bill text; the Legislature's own topic is simply "California AI Transparency Act".
3 · Of the three vendors in this course, which is on the C2PA member list, and which one actually documents signing its outputs?
Membership is not implementation. HeyGen holds Contributor tier membership with no findable documentation of signing; Synthesia is absent from the member list and describes embedded provenance signals in its own documentation; D-ID is neither a member nor a signer and uses visible, plan-tiered watermarks instead. Ask a vendor for a signed output file, never for a logo.
What this session teaches, and where it came from
Every fact on this page, and its verification tier, is recorded in the course's source map., including a dated list of what is deliberately not stated.
The position you now hold
Six sessions, and the deliverable was never a video. Score this one honestly, because it is the whole course rather than tonight. Anything scoring zero is a specific piece of work with a specific session behind it.
★ What you are actually holding now. Not a list of rules, which would be out of date by December. A defensible written position: who decided, on what evidence, under which duty, with named owners and real numbers in the four places the market left blank. That is a document you can hand to a lawyer, a works council, or the person whose face it is, and stand behind while they read it.
Session 6 cheat sheet · pin this
You started six sessions ago being asked whether you should do this at all. You finish holding a written, dated, defensible position on whether, how, on what terms, under which duty, and who takes it down when someone asks. That is a rarer thing in this market than any video, and it does not expire the moment the next model ships. Keep the sources footer current and the position keeps working. If you want the next one, the sibling course runs the same discipline over AI in media production: Learn AI Media with Phoebe ↗