Procurement will keep asking me the same question this quarter, with slight variations. If we let an AI agent into our content stack, what controls do we get from the platform, and what do we still have to decide ourselves? The honest answer is that the two are not interchangeable, and a buyer who confuses them pays for it later. The platform governance layer, the one WordPress VIP shipped as Secure MCP this summer, is a procurement item. The editorial governance layer is a staffing and policy question that no vendor can carry for you.
I keep seeing both treated as the same spend. The procurement team ticks the box next to agent access, governed, assumes the newsroom has caught up, and discovers six months later that nobody owns the question of who signs off on an AI-drafted paragraph. The reverse happens too: an editorial team writes a thoughtful AI policy, puts it on the intranet, and never asks whether the CMS can enforce any of it. Both failures end in the same place, which is a correction cycle run by hand on a Friday afternoon.
The useful move this autumn is to look at the organisations that have done the thinking in public, and to separate what they built from what their platform happens to ship. Three newsroom frameworks surfaced in the Reuters Institute’s August 2026 reporting on AI governance are the clearest I have read: the BBC’s three-pillar structure, JP/Politikens’ Values Compass, and Scroll’s News Atom. They are all public, all attributed, and they all describe the editorial layer that an enterprise CMS will not decide for you.
I will go through those three, then draw the line that separates them from the platform layer, and close with the build section: what this means inside a WordPress VIP install, or inside a self-managed enterprise WordPress estate without VIP, in terms a procurement owner can take to a conversation.
The BBC Treats Governance as Culture Backed by Policy, Not the Other Way Around
James Fletcher runs Responsible AI at the BBC. The structure he described to Ramaa Sharma at the Reuters Institute has three pillars under his function: governance and risk, principles and policy, and evaluation and data science. Editorial principles sit with a separate Editorial Policy Unit, not under Fletcher. The split is deliberate, and it is the first thing I would copy for an enterprise content operation of any size.
What they changed is less interesting than why. Fletcher told the Reuters Institute: “We think a lot about how we do that through culture as much as through compliance.” He added, on bias specifically, that “there are some things you can only spot at scale; certain types of bias are a clear example of that.” The second line is the part a buyer should underline. Human review scales down to roughly nothing on the volumes that an AI pipeline generates. Culture and tooling have to carry the long tail, and the policy layer is only the published summary of both.
- Governance and risk, principles and policy, and evaluation and data science as three co-equal pillars reporting into one function.
- Editorial principles kept outside that function, inside the Editorial Policy Unit, where they already lived before AI.
- A written acknowledgement that human-in-the-loop is a floor, not a ceiling, and that pattern-level problems need pattern-level detection.
The transferable lesson is that an AI governance function is not a replacement for your editorial standards unit. If a vendor pitches you the opposite, that is a signal they want to sell you policy you already have, repackaged.
JP/Politikens Starts Governance Before It Starts Technology
Kasper Lindskow is Head of AI at the JP/Politikens Group in Denmark. He runs a framework called the Values Compass. Governance work started there in 2019, in collaboration with four universities and Innovation Fund Denmark, and the sequence is the whole point. The Values Compass asks the publisher to define its societal role before any technology decision gets made. Not the website decision. Not the CMS decision. The question of what the publisher is for comes first.
Lindskow put it in one line to the Reuters Institute: “Developing an AI artifact starts with you defining your role in society as a publisher, independent of technology.” On human-in-the-loop oversight he was equally direct: “One thing is having a human-in-the-loop on an isolated case.”
- Values articulation preceded platform work by multiple years and shaped every subsequent build.
- Four university partners and public innovation funding mean the framework has been pressure-tested outside the organisation.
- Case-by-case oversight is treated as insufficient on its own, which is the honest reading of what human review can actually cover.
The transferable lesson is that a governance framework that starts from the question what are we for survives platform changes. One that starts from the question which tool do we buy does not. The second kind has to be rewritten every time a vendor renames a feature.
Scroll Writes Governance Into the Content Model Itself
Scroll, in India, took a different route under Sannuta Raghu, who runs AI there. The framework is called News Atom, and it does something the other two do not. It labels journalism at sentence level with metadata covering provenance, attribution, and editorial context. Governance is not a document that lives next to the content. It is a property of the content.
Raghu’s line on this, again from the Reuters Institute piece, is the one I would frame: “That infrastructure-level restructuring is sort of a governance directive in itself.” Scroll also introduced caps on how much AI-assisted output staff must review in a day, after fatigue became the actual limiting factor. “Because there is this burden of AI on it,” Raghu said, “we have to now look at it with this fine-tooth comb.”
- Sentence-level metadata for provenance, attribution, and editorial context, embedded in the content model rather than tracked alongside it.
- Output volume caps on AI-assisted work staff must review, acknowledging human review as a scarce resource rather than a free one.
- Infrastructure read as a governance tool in its own right, not as neutral plumbing underneath the real work.
The transferable lesson, and the one closest to our own work, is that your content model is already carrying governance decisions whether you have made them explicitly or not. The teams that make them explicit do not need to hunt them down later during an audit.
The Pattern All Three Share Is That Governance Is Architecture
What the BBC, JP/Politikens and Scroll have in common is that none of them treats AI governance as a document to publish. The BBC puts it in reporting lines. JP/Politikens puts it in a prior values exercise that constrains later technology choices. Scroll puts it in the content schema. The guidelines read like outputs rather than inputs, which is the opposite of how most organisations draft them.
The macro backdrop is not kind to late starters. The Future Newsrooms Study 2026 from FT Strategies and WAN-IFRA surveyed 448 newsroom leaders across 86 countries. Lack of internal technical skills or AI expertise was named by 61% of respondents, cultural resistance or scepticism by 52%, and unclear use cases or strategic direction by 45%. The study’s own text, as Press Gazette reported on July 20, 2026, warned that focusing AI adoption on efficiency alone “risks orienting newsrooms toward doing the same work, just faster and with fewer people.” That is the trajectory an organisation lands on when the governance work is skipped.
Consumer behaviour is already selecting for publishers that do the work. WordPress VIP’s own Future of the Web 2026 report, based on a survey of 1,200 US adults and 800 enterprise decision-makers, found that 86% of consumers always or sometimes check the original source after they read an AI-generated summary. The reader has not stopped caring about where a claim came from. They have stopped assuming the summary carried it faithfully.
What This Looks Like Inside a WordPress VIP or Enterprise WordPress Install
Here is the build section, which is the part a buyer takes to a meeting. There are two layers to think about, and they are not interchangeable.
The platform governance layer is what the CMS carries. WordPress VIP shipped Secure MCP to all customers on July 2, 2026. It is a single endpoint at api.wpvip.com/mcp that any MCP-compatible client, including Claude Code, Claude Desktop, Cursor and Codex, can call to reach your site. The relevant mechanics for a buyer are the controls, not the toolset. Access is deny-by-default. Mutating actions are logged and attributed to a named user. Org admins hold a kill switch that disables MCP across the organisation in one click. Sensitive writes trigger step-up authentication. Production write permissions stay off until an org admin opts in per application. The toolset covers 57 infrastructure tools plus WordPress content tools. That is a procurement bar, measurable at demo time.
If you are not on VIP, the equivalent on a self-managed enterprise WordPress estate is a combination you will have to assemble: an OAuth 2.0 broker in front of any agent endpoint, server-side action logs tied to WordPress user IDs rather than application tokens, a feature flag that disables agent writes without a deploy, and permission scopes mapped to WordPress capabilities rather than invented alongside them. None of that is impossible. All of it is work you will do once and own forever, which is one of the arguments for an enterprise managed platform in the first place.
The editorial governance layer is what no CMS can decide for you, and it maps onto a WordPress estate like this:
- Model provenance as a first-class field, not as a free-text note. A custom taxonomy with values such as human, ai-drafted-human-edited, ai-generated-reviewed, with the taxonomy term required at publish. Rejecting a post that has no provenance set is one filter hook.
- Hold sign-off in post meta, not in a workflow plugin’s internal state. A
human_signoff_user_idfield on every post, with a visible block in the editor and a REST read endpoint. If signoff is empty, the post does not publish. If it changes after publish, the post is flagged for review. - Put the disclosure where the reader sees it. A reusable block that renders provenance in a standard place, driven by the taxonomy, so disclosure cannot drift from reality. Changing the label in one place changes it everywhere.
- Propagate corrections to downstream copies on a schedule. Scroll’s News Atom principle, done on WordPress: when a corrected version is published, a cron task updates the feed items, the sitemap entry, and the structured data block. The AI systems reading you cache aggressively. The correction has to reach them.
- Cap AI-assisted output per reviewer per day, enforced in the editor. Not as a cultural ask. A dashboard widget per editor, counting items awaiting their review, with a hard limit set at the role level. Fatigue is not a soft problem.
Roughly, two to four weeks of focused work on a mid-market WooCommerce or editorial WordPress build, with a longer tail for the correction-propagation plumbing because that one touches analytics and feeds. On a VIP estate the deploy mechanics shrink that significantly, which is the second half of what you are paying for.
Where We Would Start if You Hired Us Tomorrow
We would separate the two layers in writing, on day one, before any technical work. We would audit your platform controls against the Secure MCP checklist above, whether you are on VIP or not, because the same controls apply even if the names differ. We would then run the Values Compass question with your editorial leadership in a room, not over a form, and let it shape what the content model has to carry. The custom fields and the taxonomy follow from that conversation, not the other way round.
If this is the question your board is about to ask, we are at thewpclan.com/contact. We work on both VIP and self-managed enterprise WordPress, and we have an opinion about when each is the right answer.
Last modified: October 27, 2026
