Short answer. Synthetic content is information — text, image, audio or video — that has been generated or significantly modified by an algorithm; NIST uses the term in that broad sense. Whether an enterprise should use it is not a question about the technology but about what the output represents. A generated background in a training module and a realistic depiction of a named executive are the same technology and completely different decisions. The usable rule: risk rises with the degree to which a reasonable viewer could take the output as a record of something that actually happened, and falls to near zero where the output is plainly illustrative. Decide by representation, not by tool.
Most enterprise policies on this are written either as a blanket permission or a blanket prohibition, and both are wrong for most of what teams actually want to produce. This guide separates the cases, gives the tiering that scales, and states the five questions that settle a marginal one.
What counts as synthetic content?
The category is wider than "made by a generative model". It covers an AI-written paragraph, a generated product scene, a synthetic voice, a virtual presenter, a simulated dataset, and a heavily transformed piece of real footage. The last one catches people out: substantial algorithmic modification of a real recording lands in the same category as wholesale generation, which is why "we only edited it" is not a category exit.
What it does not determine is risk. The same generator produces a placeholder illustration and a fabricated depiction of a real person. Governance that keys on the tool has to treat both identically, which means it either blocks useful work or permits harmful work. Governance that keys on the representation does not have that problem.
Three questions define the representation:
- What does this content claim to be? An illustration, a depiction of a real thing, or a record of an event.
- Who could be misled, and how badly? A colleague reviewing a draft, or a customer making a financial decision.
- Where does it go? An internal deck, a controlled channel, or open distribution where context is stripped.
Which uses are straightforward?
These are low-risk because nothing in the output purports to be a record of anything:
- Ideation, mood boards and storyboard frames
- Internal prototypes and design exploration
- Synthetic environments and backgrounds
- Draft copy that a human will rewrite
- Training simulations of clearly hypothetical scenarios
- Placeholder assets ahead of final production
- Plainly fictional or diagrammatic illustration
Production use is also entirely workable once rights and review are settled: campaign assets, voiceover, localised variants of an approved master, catalogue imagery, educational media. What makes those safe is not that the content is low-stakes but that the pipeline around them is defined — the approval path exists, the source rights are clear, and a human is accountable for the factual content.
When does it become high risk?
Risk rises sharply on six triggers. Any one of them moves the asset out of the routine path:
| Trigger | Why it changes the calculation |
|---|---|
| Depicts an identifiable real person | Consent and likeness rights attach, independent of how the output was made |
| Carries a material factual claim | The output is now evidence, and a fluent error is a defensible-looking error |
| Could be taken as documentary | Photorealism plus a news, incident or record framing |
| Influences a financial, legal or health decision | Harm from error is direct rather than reputational |
| Uses copyrighted or confidential input | The rights problem is upstream of the output |
| Ships at volume without per-asset review | Scale converts a small error rate into a large number of errors |
The two that are most often underestimated are the second and the last. A confident sentence containing a wrong figure is more damaging than an obviously wrong one, because it survives review by anyone who is not checking. And a 2% defect rate is a curiosity at fifty assets and a serious problem at five thousand.
The tiering that actually scales
Applying one review process to everything guarantees the wrong outcome in both directions: it is too slow for the low-risk majority and too shallow for the high-risk minority. Three tiers is enough.
| Tier | Examples | Controls |
|---|---|---|
| Routine | Internal drafts, prototypes, backgrounds, non-public exploration | Approved tools; no confidential input; creator accountable; no external release |
| Reviewed | Public marketing assets, localised variants, educational media | Named human reviewer against a rubric; facts checked against a source pack; rights confirmed; provenance recorded |
| Escalated | Any high-risk trigger above | Subject-matter, legal or compliance sign-off; documented consent where a real person is depicted; full rather than sampled review; disclosure decided explicitly |
Two design rules make the tiering hold. Tier by trigger, not by team — a routine asset produced by an escalated team is still routine, and vice versa. And automate the cheap checks at the boundary: banned terms, missing disclaimers, unapproved logos and unsupported product claims can be blocked before a human sees the asset, which is what keeps the reviewed tier from becoming a bottleneck.
Track the exception rate per workflow. A workflow that repeatedly triggers escalation is a workflow that was scoped wrong, and fixing it is cheaper than reviewing its output forever.
The five questions for a marginal case
When an asset does not clearly fall into a tier, these settle it faster than a policy document:
- Does generating this create meaningful value? If the answer is "it is faster", weigh that against the review cost it adds; frequently the net is negative.
- Could a reasonable viewer be misled about what they are seeing? Not could an expert detect it — could an ordinary viewer, in the context where it appears.
- Are the source rights clear? Inputs, references, likenesses, and any material a model was conditioned on.
- Can a human verify the important claims? If nobody in the chain is qualified to check the substance, the asset is unverified regardless of how many people approved it.
- Is there a defensible answer if it is challenged? Six months later, can you say what made it, from what, reviewed by whom, on what date.
If the benefit is marginal and question two or five is uncomfortable, conventional production is the better answer. That is a legitimate outcome and a policy that never produces it is not being applied.
What has to be recorded, regardless of tier
Provenance is an internal requirement before it is a public one. Even where the audience never sees any metadata, the organisation should be able to answer, per asset: which model or process produced it, which source materials and references were used, who edited and approved it, what labels or disclosures were applied, and where it was published.
This record is what survives when the file does not. Metadata is stripped by ordinary operations — transcoding, resizing, most platform uploads — so an internal ledger independent of the file is the only thing that still substantiates a claim about an asset after it has been through a distribution pipeline. It is also what an audit actually asks for.
How Lifewood approaches this
Lifewood produces synthetic media inside a controlled workflow rather than as a tool output: an asset-level record covering model, inputs, reviewer and labels; a human review stage that is a required pipeline step rather than a final glance; and a tiering model of the kind above, so that high-volume routine work is not held to the pace of the escalated tier.
Where the work is multilingual, review is in-market rather than central — across 50+ languages and 40+ delivery centres across 30+ countries, with a dual-layer human-in-the-loop process held to a 95%+ accuracy threshold. The reason is narrow and practical: whether a depiction reads as illustrative or as a record is partly a cultural judgement, and it is not one that can be made from headquarters.
See AIGC services for how this is scoped.
Sources and further reading
- NIST, "Reducing Risks Posed by Synthetic Content" — the broad definition of synthetic content used throughout, and an overview of technical approaches to provenance and detection.
- NIST, AI Risk Management Framework — the risk-tiering vocabulary this policy structure follows.
- Google Search Central, guidance on generative AI content — on how generated content is treated where it is published for search audiences.
- Companion guides: AI Content Governance: Disclosure and Provenance and AI Content Labelling Law: EU, China and the US.