Safety Norms: Creative Business, Portfolio and Client Management

1Purpose, Scope, and Safety Principles

This document gives freelancers, studios and small creative teams a starting point for safe, lawful and truthful management of a creative business. It applies to designers, photographers, illustrators, writers, video makers, musicians and similar practitioners who pitch, price, contract, deliver and publish portfolio work. It covers the client relationship from first enquiry through final payment, dispute or archive.

• Priority order: protect people first, including clients, models, collaborators and audiences; then prevent legal and privacy harm; then protect income and reputation.
• Every norm names a responsible person and an action.
• Mandatory items are internal rules this business requires, or obligations identified as legally required in its jurisdiction. Recommended items are good practice that may be adjusted with documented reasons.

2Roles, Competence, and Accountability

The business owner is accountable for every norm in this document, even when work is delegated. In a one-person business the owner may hold every role below, but each role must be consciously assigned, written down and reviewed when the business changes. Unassigned roles lead to the common failure where everyone assumes someone else checked the release, the license or the backup.

Creative skill does not automatically include legal, tax, security or medical knowledge. Anyone who drafts contracts, advises on rights, handles personal data or works in hazardous settings needs appropriate training or access to qualified advice. Where a question involves money owed, ownership of work or data protection, stop and consult a qualified professional.

• Owner: approves all contracts, pricing exceptions and public statements about disputes. Mandatory.
• Contracts lead: confirms a signed agreement exists before paid work starts. Mandatory.
• Portfolio editor: checks credits, releases, licenses and client approval before publication. Mandatory.
• Data lead: maintains the access list, backup schedule and deletion schedule for client files. Mandatory.
• Field lead: plans and approves any location shoot or on-site visit, including a site risk review. Mandatory.
• Subcontractors and assistants: accept confidentiality terms and receive only the files they need. Mandatory.
• Review role assignments whenever a service, tool or team member is added. Recommended.

3Course-Specific Hazards and Risk Assessment

Creative business work combines activities, people, tools, environments, information and decisions. Typical activities include pitching, scoping, quoting, contracting, location shooting, studio production, delivering files, publishing portfolio pieces, posting on social media, invoicing and deciding which projects to accept. People involved include clients, end users, models, minors, subcontractors, collaborators and members of the public who comment on or appear in work. Tools include contracts, file-sharing platforms, customer records, generative AI tools, stock libraries, cameras, drones and vehicles.

Rate each hazard for likelihood and severity on a scale of 1 to 5 each, multiply the two, and require a documented control before work begins for any score of 12 or higher. This threshold is a Recommended internal method, not a legal standard.

• Physical injury on location, during set builds or in equipment transport: high where lifting, heights, water, traffic or unfamiliar sites are involved; medium for seated studio work. Control through a site survey and field lead approval.
• Harm to models, bystanders or minors shown in images or video: high. Control through signed releases, guardian consent where required, and privacy review before publication.
• Copyright infringement from unlicensed fonts, music, stock images, scraped material or unclear AI outputs: high. Control through a license register and source checks.
• Unclear scope, unsigned changes, late payment or unfair cancellation: high financial impact. Control through written contracts and change orders.
• Leaked client files, briefs or personal data through public links, personal devices or misdirected email: high. Control through access rules and secure sharing.
• Reputational harm from misleading claims, fake testimonials, undisclosed paid endorsements or public disputes: high. Control through claim review and a complaint protocol.
• Account suspension or takedown from platform policy breaches: medium to high. Control through platform rule checks before posting.
• Fraud, including fake client checks, overpayment scams and impersonation: high. Control through payment and identity verification.

4Preventive Controls and Safe Work Practices

Use a written agreement before paid work begins. It should state scope, deliverables, revision limits, deadlines, payment terms, kill fees, cancellation conditions, ownership, usage rights, confidentiality and how changes are approved. For very small jobs a clear written quote accepted in writing may suffice, but it must still state these terms.

Consent and rights come before publication. Identifiable people need a signed release covering the specific uses intended, such as portfolio, advertising or social media. Check whether private property, interiors or recognizable artwork by others needs permission. Minors require guardian consent and extra review, and the legal requirements vary by jurisdiction.

• Mandatory: every identifiable person signs a release before shooting or recording, or the material is not published. Responsible: portfolio editor.
• Mandatory: every third-party asset has a recorded license covering the intended commercial or portfolio use. Responsible: contracts lead.
• Mandatory: no scraped, pirated or leaked material is used. Responsible: owner.
• Mandatory: AI tool terms, including ownership and commercial-use conditions, are checked and recorded before generated or edited outputs are delivered or published. Disclose AI use where a client or platform requires it.
• Mandatory: portfolio descriptions state the creator's actual role, and collaborators are credited by agreed name and role.
• Mandatory: testimonials and case results are verified against project records and used only with client permission.
• Mandatory: sponsored posts and paid endorsements carry the disclosure required by platform and local advertising rules. Verify current rules with an adviser.
• Mandatory: confidential or unreleased work is not shown publicly until written client approval is held and any embargo period has ended.
• Recommended: remove location tags, street names and home details from shoot images and captions to protect people and the creator.
• Recommended: meet new clients in business settings, share your location with a trusted contact, and verify identity before accepting in-person work.
• Recommended: never refund money sent in excess of an invoice until the payment has cleared and the client has explained the overpayment.
• Recommended: use content warnings for distressing material, and avoid publishing graphic injury or medical content without consent and context.

5Equipment, Environment, Information, and Protective Safeguards

Lighting rigs, stands, heavy cases, ladders and power distribution create physical hazards. Test electrical equipment and cables before use and follow manufacturer instructions. Do not overload power strips or run cables across walkways without protection. Loads beyond a safe manual lift are moved with a trolley or a second person. Work at height is performed only by people with appropriate training or a qualified rigger. Drone use is governed by aviation rules that vary by jurisdiction, so verify and obtain any required authorization before flying.

Printing inks, adhesives, solvents and some cleaners can cause harm. Keep current safety data sheets, store chemicals as their labels direct, ventilate work areas and keep food and drink away from materials. Recommended: set a workstation with screen height at eye level, schedule regular breaks and review strain when deadlines tighten.

• Mandatory: client files are kept only on approved storage, never in personal messaging apps.
• Mandatory: shared links have expiry dates and access limited to named people.
• Recommended: use a password manager and two-factor authentication for email, cloud storage and project platforms.
• Recommended: encrypt laptops and phones, keep encrypted backups, and test restoration periodically.
• Recommended: avoid client work on public Wi-Fi unless a trusted VPN is used.
• Collect only the personal data a project needs, publish a short privacy notice where personal data is collected, and follow local data protection law.
• Insurance such as professional liability or general liability may be required by clients, venues or law. Confirm requirements with an insurance adviser.
• Use watermarked previews for early client review and sign NDAs before sharing unreleased concepts.

6Incident Reporting, Emergency Response, and Escalation

Incidents include injuries, near misses on location, data exposure, unauthorized publication, takedown notices, copyright claims, harassment, fraud attempts and serious client complaints. Mandatory: report any incident to the responsible person the same working day, or as soon as safely possible. Log near misses even when no harm occurred, because they reveal weak controls.

Emergencies come first. For injury, fire, electrical hazards, threats or immediate danger, call local emergency services without delay. Only people trained in first aid give first aid. The field lead keeps the emergency contact list for each location. Do not attempt rescue from heights, water or confined spaces unless trained and equipped.

• Contain: unpublish the file, revoke shared links, disable compromised accounts and pause payments if fraud is suspected. Responsible: data lead or portfolio editor.
• Preserve: keep emails, screenshots, logs and original files. Do not delete evidence during an investigation.
• Notify: inform affected people promptly and clearly, and notify the client as the contract requires. Verify any regulator or individual breach notification deadline and method with a qualified adviser, since these vary by jurisdiction.
• Report: use platform tools for harassment, impersonation and copyright claims, and respond to valid takedown notices following platform process and legal advice.
• Escalate: inform the owner, insurer and a qualified lawyer when injury, liability, a legal claim or significant data loss is possible.
• Public response: do not argue publicly. Acknowledge the concern, correct factual errors, and move detailed discussion to a private channel after legal advice.

7Records, Training, Inspection, and Review

Keep records that show the business acted responsibly. Mandatory records include signed contracts and change orders, model and property releases, guardian consents where relevant, license and source records for third-party assets, AI tool terms records, access lists, backup logs, incident logs and deletion records. Retention periods vary by jurisdiction and must be confirmed with a qualified adviser.

Train everyone on this document, the tools in use and current platform rules before they start work. Refresh training when tools change, after an incident or when a new service is offered. Recommended: keep a short training record for each person.

• Mandatory: release and license registers are reviewed before every portfolio update.
• Recommended: audit the portfolio regularly, checking releases, credits, links, licenses and claims.
• Recommended: review access lists quarterly and remove inactive accounts.
• Recommended: track complaints, disputes, late payments, takedowns, data incidents and near misses, and review this document after every serious incident.

8Conclusion and Starting Point

Use this document as a foundation, not a finished policy. Adapt the roles, thresholds and norms to your business, then have a qualified lawyer, accountant, insurer or data protection adviser review any contract template, privacy notice or consent form before use. This is educational guidance and does not replace professional advice, formal training or approved procedures. The aim is simple: clients, models, audiences and the creator should be able to trust that work is made, shared and managed safely.

Implementation checklist

• Confirm a signed scope and payment agreement exists before paid work starts.
• Obtain signed releases before publishing any identifiable person.
• Record a license for every third-party font, image, music track and asset.
• Check AI tool terms before delivering or publishing generated material.
• Verify testimonials and credit collaborators accurately.
• Remove location details and private information from public captions.
• Use access-limited, expiring links for client files and enable two-factor authentication.
• Report incidents to the responsible person the same working day and preserve evidence.
• Verify payments and identity before meeting new clients or sending refunds.
• Review the portfolio, records and this document on a regular schedule.