Generative AI may already be part of an art studio, gallery, museum, or publishing workflow before anyone has formally approved it. A staff member uses a personal chatbot to tighten a grant application. A freelancer uploads an unpublished manuscript for editing. A communications team tests several image tools with photographs that include artists, collectors, or private interiors. Each decision may feel small, but together they create what technology managers call “shadow AI”: work being carried out through systems the organization does not fully see or control.
A new legal-industry analysis published by Reuters on October 7 argues that the practical response is not a blanket ban. It is to assume that generative AI is already in use, identify where it appears, and replace invisible experimentation with usable rules, approved tools, and human oversight. For the creative sector, where unpublished images, licensing information, collector details, and authorship records are commercially and culturally sensitive, that starting point matters.
Why creative organizations have unusual exposure
An ordinary office document may be confidential. A creative file can carry several additional layers of risk: copyright, moral rights, model releases, location privacy, cultural sensitivity, embargoes, and contractual restrictions. A manuscript may reveal an artist’s ideas before publication. A high-resolution image may contain metadata or an unreleased work. A donor spreadsheet may expose relationships built over decades.
Uploading such material to an unapproved service can create uncertainty about storage, retention, model training, deletion, and access. Even when a tool promises not to train on customer data, that protection may depend on the account type, contract, or settings. The risk is therefore not simply “AI.” It is the mismatch between the value of the material and the organization’s knowledge of what happens to it.
The US National Institute of Standards and Technology’s Generative AI Profile offers a useful neutral framework. It identifies privacy, information integrity, information security, intellectual property, and harmful bias among the risks organizations should manage throughout the AI lifecycle. The framework is voluntary, but its core logic travels well: know the use, know the data, know the consequence of error, and document who remains accountable.
A workable studio policy starts with visibility
The first step is a short, non-punitive inventory. Ask staff and regular collaborators which tools they already use, what tasks they use them for, what information they enter, and which outputs they rely on. The purpose is not to catch people breaking a rule that may never have been clearly written. It is to discover the actual workflow.
Next, divide uses by risk. Low-risk tasks might include brainstorming public event titles or summarizing an organization’s own published text. Moderate-risk work could include drafting public-facing copy that still requires editorial review. High-risk uses include uploading unreleased artwork, contracts, personal data, rights records, donor information, or material that could affect a person’s reputation, livelihood, or legal position.
Clear red lines should be brief enough to remember. Unapproved tools should not receive private client data, unpublished creative work, confidential agreements, passwords, financial information, or sensitive identity material. Any AI-assisted factual claim, quotation, attribution, price, date, or legal statement should be checked against a reliable source before publication.
The responsible tool must also be the usable tool
People turn to unsanctioned services because they are fast and accessible. A policy that only prohibits will often push the same behavior further out of view. Creative organizations should pair restrictions with a practical approved option, clear account settings, and examples of permitted tasks. Vendor agreements should address data retention, training use, security, ownership, deletion, and liability rather than relying on marketing language.
For independent artists, the equivalent can be a one-page personal rule: keep unreleased work and client material out of consumer tools; use temporary or private modes where available; remove unnecessary identifying information; save source files and prompts when provenance matters; and retain the final human decision over what is published, sold, or submitted.
The lesson is not that artists should reject generative AI. It is that invisible use is the least defensible form of adoption. Once an organization can see where the tools are used, it can decide where they genuinely help, where they require supervision, and where the creative or legal stakes are too high.
ATIM approaches artificial intelligence with curiosity, independence, and balance. We explore its extraordinary potential to empower artists while examining the questions it raises around authorship, copyright, consent, creative identity, transparency, and human expression.
We are neither advocates for AI nor opponents of it. Our focus is how the technology is used—and what that means for artists.
Above all, our commitment is to artists. We look at every development through the lens of what can support, protect, and empower the creative community—identifying opportunities, examining potential risks, and providing artists with the information they need to make informed decisions about their work, their rights, and their future.