AI Fashion Model Provenance & Digital-Replica Consent

Quick answer: cast the identity on paper before you cast it in production

AI fashion model provenance is the record of where each reusable on-model identity came from — fully synthetic, a digital twin of a real model, or a general-purpose face — plus the consent or license that says how far you may use it. Establish that record before a generation run, not after the identity is on thousands of product pages.

Catalog teams have mostly settled whether AI on-model imagery is good enough to publish. The question that stalls a rollout now sits earlier in the process, and it is not a creative question: who is the person in the image, and who said you could use them that way.

Three casting paths, three different counterparties. A synthetic identity, a real model's digital twin, and a vendor's general-purpose face each need different paperwork.
Provenance is a record, not a watermark. It tracks the origin of the identity, not what you tell shoppers about the image.
Consent has a shape. Markets, channels, duration, exclusivity, derivatives, and what happens at the end of the term.
Clear it before the run. Garments can be regenerated. A face that has shipped across a catalog cannot be quietly recalled.
Where it fits: casting is the stage before everything described on AI fashion catalog production at scale.

This is an operations checklist, not legal advice. The point of running it is to arrive at your counsel with a clear picture of what you are about to do, rather than a question.

Why unclear provenance surfaces late and costs more

Nothing about an uncleared identity fails at generation time. The images come back usable, the batch passes review, and the SKUs publish. The problem appears later, from outside:

A model or an agency recognizes a likeness in a catalog nobody told them about.
A vendor's terms turn out to exclude a market, a channel, or paid media — after the assets ran there.
An identity reaches its consent end date while the product pages using it stay live.
A supplier or agency delivered generated imagery whose identity source nobody on your side can name.
A marketplace or retail partner asks for the provenance of an image and there is no answer to give.

Scale is what converts each of these from an incident into a project. The reason to cast a reusable identity at all is reuse: the same face across categories, colorways, seasons, channel resizes, and the long tail. That reuse is the point, and it is also the blast radius. Withdrawing one identity means finding every SKU, every collection page, every channel export, and every ad variant that carries it — including the copies that left your systems.

Regenerating a garment is a batch job. Replacing a face is a catalog migration.

Three casting sources, in plain language

Before anything else, decide which of these each identity in your library is. Most teams discover they already have a mix and have never written it down.

1. Fully synthetic identity

An identity created to resemble no specific real person. There is no individual with rights in the likeness, which removes the talent consent question — and replaces it with vendor questions.

What to establish: how the vendor produced the identity and what it was built from; whether the identity is exclusive to you or shared across the vendor's customers; whether you may keep using it if you leave the vendor; whether a seed, reference set, or identity file travels with you; and what the vendor warrants if the identity turns out to resemble a real person closely enough that someone objects.

The quiet risk here is not consent, it is accidental resemblance and shared reuse. "Synthetic" is a claim about intent, not a guarantee about outcome.

2. Digital twin of a real model

A likeness of an identifiable person, built from their images or their participation. This is the path with the richest paperwork, because a real person is on the other side of it and their agreement is the whole basis for the use.

What to establish: a signed agreement from the model covering the creation of the replica and its use; the scope of that use; compensation for reuse rather than for the original session alone; whether the model's agency has to approve; what training or likeness basis you are allowed to retain; and the exact end-of-term behavior — stop generating, stop publishing, delete, or something in between.

Digital replicas of working models are the subject of active, changing rules in several markets. New York's Fashion Workers Act, which took effect in June 2025 and requires written consent for a model's digital replica, is one example; it is not the only one, and which rules apply to you depends on your talent, your agencies, and the markets you sell in. That mapping is counsel's call, not a production decision. Your job is to arrive with the facts: who, what likeness, which markets, which channels, how long.

3. General-purpose or stock-style face

An identity supplied by a vendor, library, or platform for general commercial use — whether it originates from a real person who licensed their likeness or from a synthetic set.

What to establish: the license terms in writing, read rather than assumed; whether paid media and marketplace syndication are included or carved out; territory and term; whether the identity is non-exclusive, which it usually is; and whether the license chain runs all the way back to a real person if one is involved.

The practical cost of this path is sameness. A non-exclusive face is available to anyone, including the brands you compete with on the same marketplace. That is a brand decision before it is a legal one.

What "provenance" means for catalog ops

Provenance here is an internal record attached to an identity, carried forward onto every asset generated from it. Three things belong in it:

Source of identity. Which of the three paths, and specifically which vendor, model, agency, or library.
Likeness or training basis. What the identity was built from, and what you are permitted to keep.
License or consent chain. The documents, their scope, their dates, and who holds them.

Two things are deliberately not in that list. Provenance is not shopper-facing disclosure — what you tell a customer about an image is a separate decision with its own rules per market and channel. Provenance is also not content authenticity metadata or channel-level synthetic-media tagging; those travel with the file and answer a different question. Keep all three, but keep them separate, because they have different owners and different failure modes. An image can be correctly labeled for shoppers, correctly tagged for a marketplace, and still carry a face nobody cleared.

Attach the record to the identity, not to individual images. An identity library with provenance on each entry answers "can we use this face here?" in seconds. A pile of images with metadata answers it after an audit.

For any identity that is a likeness of a real person, write the scope down in these terms. Vague consent is the failure mode, not missing consent.

Who. The model, and the agency or representative whose approval is also required.
What. Creation of a digital replica, and generation of new imagery from it — stated separately, because agreeing to one is not agreeing to the other.
Where. Territories and markets, named.
Which channels. Owned PDP, marketplaces, retail partners, email, organic social, paid media, print. Check paid media and marketplace syndication explicitly; do not assume an owned-channel grant covers them.
How long. A term with an end date, and what happens to live assets on that date.
Exclusivity. Whether the identity may be used by anyone else, and whether category exclusivity applies.
Derivatives. Edits, retouching, restyling, pose and expression changes, video, and whether the likeness may be combined with other identities.
Categories and context. Any product types, claims, or contexts the model excludes — intimates, swim, medical, political, or anything else named.
Compensation for reuse. How generated volume is paid for, not only the original session.
Withdrawal. Whether the model may withdraw, on what notice, and what you must do when they do.
Retention. What you keep after the term — the replica, the reference set, the generated assets — and what you delete.
Sign-off. Named owners in creative and in legal, with a date. One signature from one side is not a cleared identity.

Every line in that list is a question production will ask later. Answering them at casting time is the entire saving.

The casting-to-publish workflow

Provenance work belongs in a fixed position in the pipeline — before generation, not beside it:

Choose the casting path. Synthetic, digital twin, or general-purpose, decided per identity and per use.
Clear the paperwork. Consent or license in hand, scope written down, counsel's confirmation on anything new.
Lock the identity library. Each entry carries its provenance record, its scope, and its dates. Only cleared entries are available to production.
Generate. Run SKUs against the cleared identity and the saved creative direction.
Review. Check each output against its source product — the garment-fidelity gate.
Publish. Approved assets go to PDP and channels, carrying a link back to the identity that produced them.
Re-check on change. New market, new channel, new product category, or an approaching end date sends the identity back to step two.

Step 6 is the one teams skip and regret. If a published asset cannot be traced back to its identity, you have provenance at casting and none at withdrawal, which is the moment you need it.

The stages after generation — intake standards, saved direction, batching, and review — are covered in how to produce on-model catalog photos at high-SKU scale, and the review gate itself in garment-fidelity QA before the PDP.

What this is not

Several adjacent problems get confused with this one. Keeping them apart is what makes each of them tractable.

Not shopper disclosure. Telling customers an image is AI-generated is a separate obligation with its own per-market and per-channel rules. It says nothing about whose face it is.
Not marketplace synthetic-performer tagging. Channel-level metadata requirements are something you comply with at publish time. They are downstream of casting, not a substitute for it.
Not brand consistency. Locking models, lighting, styling, and crop so a catalog reads as one brand is a creative-direction problem. A perfectly consistent identity can be an uncleared one.
Not diversity casting. Deciding which identities your catalog should represent is a brand and merchandising decision. Provenance applies to whichever identities you choose.
Not model swapping. Recasting an already-published set is a migration problem with its own sequencing. This checklist is what you run so that migration is a choice rather than a response.

When to pause, and when counsel owns the call

Pause generation when any of these is true:

Nobody can name the source of an identity already in the library.
The plan covers markets, channels, or product categories the consent or license does not name.
A consent term ends inside the expected life of the assets about to be generated.
Imagery arrived from a supplier, agency, or partner with no provenance attached.
A synthetic identity is reported to resemble a real person.
A model or agency asks a question you cannot answer from the record.

Counsel owns the call on which rules apply to your talent and your markets, on the wording of any replica agreement, on what withdrawal and retention must mean in practice, and on anything involving a real person's likeness in a new market. Production owns bringing them a complete, specific picture: which identities, which path, which scope, which channels, which dates.

The failure pattern is not teams ignoring legal. It is teams reaching legal after the run, with a question that now has thousands of published answers attached to it.

Where Tolstoy fits

In Tolstoy AI Studio, the models, styling, lighting, and crop a brand uses are saved once as reusable direction, and every SKU is generated against that saved direction from an approved flat lay, packshot, or supplier photo. Because the direction is defined once and reused, the identities it carries are a short, reviewable list rather than something re-decided prompt by prompt — which is exactly what makes a provenance record practical to keep.

Every output is reviewed against its source product before it is approved, and nothing publishes on its own. Tolstoy does not provide talent clearance, consent documents, or legal review; those stay with your creative and legal owners. What the workflow gives you is a fixed place for the identity decision to live, upstream of thousands of generated assets.

Start with the identities you already have

Before casting anything new, list every on-model identity currently appearing in your live catalog and mark each one as synthetic, digital twin, general-purpose, or unknown. The unknown column is the work. For most teams it is shorter than expected and older than expected, and clearing it is the cheapest version of this exercise you will ever run.

See how the full pipeline runs from catalog to PDP on AI fashion catalog production at scale, or talk to our team about putting your catalog through it.

Frequently asked questions

How do we clear AI fashion model provenance before casting reusable identities for the catalog?

Decide the casting path for each identity first — fully synthetic, digital twin of a real model, or a general-purpose face from a vendor or stock library — then record where the identity came from, what it was built on, and what the license or consent actually permits. Clear that record before the first production run, because provenance is cheap to establish at casting time and expensive to reconstruct after thousands of SKUs carry the face.

What is the difference between a digital replica and a fully synthetic AI fashion model?

A digital replica is a likeness of an identifiable real person, so in many markets that person has rights in it, and the use usually needs their written consent. A fully synthetic identity is not built to resemble any specific person, so there is no individual to consent — but you still need the vendor's terms on how the identity was produced, whether it is exclusive to you, and whether it can be reused elsewhere. The paperwork differs because the counterparty differs.

Can we train or cast an AI model that looks like a real fashion model for PDP at scale?

Usually yes with the model's agreement, and that agreement has to be specific rather than general. Scope it: which markets, which channels, how long, whether it is exclusive, whether derivative or edited versions are allowed, what happens when the term ends, and how the model is compensated for reuse. Have counsel confirm which rules apply to your talent and your markets before a batch runs.

Synthetic, digital twin, or general-purpose face — which path should our on-model library use?

Pick per use, not once for the whole catalog. Synthetic identities suit high-volume long-tail catalog work where no real person's likeness is needed. Digital twins suit brands with existing talent relationships and a reason for continuity across seasons. General-purpose vendor faces suit fast, low-stakes coverage where exclusivity does not matter — and they carry the highest chance of appearing in a competitor's catalog too.

Is this the same as disclosing AI images to shoppers?

No. Shopper-facing disclosure and content labeling answer what you tell the customer about an image. Provenance and consent answer where the identity in that image came from and who agreed to it. A fully disclosed AI image can still carry an uncleared face, and a properly cleared face still has to meet whatever disclosure rules apply to the channels you publish on. Run them as two separate tracks.

When should we pause generation until the paperwork is clear?

Pause when you cannot name the source of an identity, when a consent term's end date is inside the life of the assets you are about to generate, when the territories or channels in the plan exceed what the consent covers, when an identity came from an unidentified vendor account, or when the identity resembles a real person without anyone intending it to. Pausing before a run costs a batch. Unwinding published SKUs costs the catalog.