AI model and digital twin contracts: what happens to the AI replica when the contract ends?
What is a model’s digital twin?
A digital twin (or digital replica) is a replica of a real model’s appearance that allows for the production of new images of the person without a new photoshoot. Several techniques coexist under this term.
Some providers train a LoRA—a small AI module fine-tuned on a few dozen photos of the model’s face—which plugs into an existing image generation model. Others do not train anything and simply provide the model’s photos to generative AI tools as reference images for each generation. Others still start from a 3D scan of the person.
A digital twin does not necessarily imply training an AI model on the model’s images. However, the result is the same, and it is this result that the contract must address. A clause that only mentions "training" overlooks a portion of market practices. It is better to define the digital replica neutrally, as any representation of the model’s appearance generated or modified by a computer or artificial intelligence process, regardless of the technique used.
The digital twin remains subject to the model’s image rights
Each image generated from the digital twin is a new exploitation of the model’s image. It must therefore be covered by their authorisation, based on Article 9 of the Civil Code.
The Court of Cassation holds that the assignment of image rights falls under contractual freedom and Article 9 of the Civil Code alone (Cass. 1st Civ., 11 December 2008, No. 07-19.494). In return, the courts require that the parties clearly define the scope of the authorisation regarding its duration, geographical area, the nature of the media, and the exclusion of certain contexts (Paris Judicial Court, 17th Chamber, 15 January 2025, No. 23/14724).
In practical terms, an authorisation given for a photo campaign does not cover the creation of a digital twin or the generation of new visuals, unless expressly stipulated. And after the expiry date, any new image generated becomes an infringement of image rights.
The risk is not only civil. Since the SREN Act of 21 May 2024, Article 226-8 of the Penal Code sanctions the dissemination of visual content generated by algorithmic processing representing a person’s image without their consent, if it is not obvious that it is generated content or if it is not expressly mentioned. Penalties include up to two years’ imprisonment and a €45,000 fine for online dissemination. The label "AI-generated" avoids this offence, but it does not replace the model’s authorisation under their image rights.
The question of remuneration also arises. For models, Article L. 7123-6 of the Labour Code already provides that remuneration due for the exploitation of the recording of their performance, when their physical presence is no longer required, is not considered a salary provided it is based on the proceeds of that exploitation. This logic naturally lends itself to the remuneration of a digital twin, even if its application to an AI-generated replica remains to be clarified.
The GDPR also applies to the digital twin
The image of an identifiable person is personal data. The source photos, the generated images, and, where applicable, the module trained on the model’s face are therefore subject to the GDPR.
On this last point, the European Data Protection Board (EDPB) is clear. An AI model specifically designed to output personal data relating to the individuals whose data was used to train it cannot be considered anonymous (Opinion 28/2024 of 17 December 2024, § 29). A LoRA trained on a model’s face to reproduce it is a prime example.
Several obligations follow from this. Data can only be kept for the time necessary for the intended purpose (Article 5.1.e of the GDPR). The model has a right of access and a right to erasure (Articles 15 and 17). The data controller must be able to demonstrate compliance (Article 5.2). Finally, the contract with each processor must provide for the deletion or return of data at the end of the service (Article 28.3.g).
The two blind spots in model contracts
1) Upstream: the choice of tools
If the model’s photos are processed by a generative AI service whose terms of use allow the reuse of content to train its own models, the face may end up in a general-purpose model. And we do not yet know how to properly remove a person from an already trained model. The CNIL itself acknowledges that the available solutions, such as retraining or applying filters, are currently either particularly costly and delicate, or imperfect.
This risk must be managed upstream, at the time of choosing and configuring the tools. Not at the expiry date.
2) Downstream: deletion at the expiry date
At the end of the contract, what needs to be deleted? The answer depends on the technique used, and it goes far beyond just the photos. It includes source photos and selections of reference images, the trained module or 3D scan, the "characters" saved in generation tools, non-distributed generated images, and copies held by processors, studios, and freelancers.
However, you need to be able to verify it. An AI module is a file that can be copied in seconds. Without written confirmation of deletion, a generation log, and audit rights, deletion cannot be monitored. The labelling of generated content, which Article 50 of the EU AI Act mandates for synthetic content, indicates that an image is AI-generated, but not whose face it is. It is not enough to verify that a replica is no longer being used.
What you need to include in your contracts
Whether you are a modelling agency, advertiser, advertising agency, or production studio, the same points must be present throughout the contractual chain, from the model's representation agreement to the contract with the final technical service provider.
- A neutral definition of the digital replica, which covers all techniques (trained module, reference images, 3D scan).
- Express authorisation or prohibition, including usage, duration, territory, media, and remuneration separate from the photoshoot fee.
- A list of authorised tools, with a prohibition on any reuse of photos by AI providers to train their models.
- Provisions for the end of the contract, including a list of items to be deleted, the timeframe, and written confirmation of deletion.
- Means of control, such as a generation log and audit rights.
- Passing on the same obligations to every service provider and subcontractor, in line with Article 28 of the GDPR.
- Conditions for any potential extension, which must be renegotiated with the model for a new duration and new remuneration.
What about internationally?
Some states are beginning to specifically regulate these practices. In New York, the Fashion Workers Act, in effect since 19 June 2025, requires modelling agencies and their clients to obtain the model's written consent before creating or using their digital replica, specifying the scope, purpose, remuneration, and duration of use. For agencies, this consent must be obtained separately from the representation agreement. However, the text says nothing about what happens to the replica once the contract expires. Once again, it is the contract that must address this.
Frequently asked questions
Does a digital twin require training an AI on the model?
Not necessarily. Some providers train a small module on facial photos, others provide the photos as references to generative AI tools for each generation, and others start from a 3D scan. The contract must cover all these techniques.
Can a model's digital twin continue to be used after their contract ends?
No, unless a new agreement is reached. Each generated image is a new use of the model's likeness, which must be covered by their authorisation. Once the contract expires, the use of the digital twin must be renegotiated with the model.
Does the GDPR apply to a model's digital twin?
Yes. The image of an identifiable person is personal data, and according to the EDPB, a model specifically designed to reproduce a person's data cannot be considered anonymous. Retention periods, the right to erasure, and data processing agreements all apply.
Who is responsible for deleting the digital twin at the end of the contract?
The party holding it, as well as all their service providers. This is why the list of items to be deleted, the timeframe, and the certificate of deletion must be stipulated at the time of signing and cascaded throughout the entire contractual chain.
As a lawyer, I assist modelling agencies, advertisers, agencies and studios in ensuring the legal compliance of their projects involving models, avatars and AI digital doubles.