The timing is the whole discipline. Consent gathered after generation is consent gathered after the risk was taken, and if the answer had been no you have already done the thing.
A complete file holds the signed likeness and voice release including derivative training, the model licence confirmed for commercial use at the specific version, any claim substantiation the asset depends on, and the reverse image search result for a wholly synthetic identity.
Make it a gate rather than a checklist. A pipeline that will not start a render without the file present enforces the rule; a checklist somebody ticks does not.
When should the consent file be complete?
Before the first render. Consent obtained afterwards is consent obtained after the risk was taken.
What goes in it?
The likeness and voice release with derivative training named, the model licence for the specific version, claim substantiation, and the reverse image search result for any wholly synthetic identity.