Nine building rules for an AI pipeline at a publisher

In conversations with publishing executives, the same question comes up sooner or later: How do we make sure an AI pipeline publishes nothing we cannot take responsibility for? This can only be ensured by rules anchored in the pipeline itself; a better prompt or a newer model is not sufficient.

I described the roles the agents have in such a system in the article What building a multi-agent system requires. This article covers the building rules behind it, meaning the guardrails anchored in the pipeline itself. They come from a pipeline that runs in day-to-day operation at a Munich publisher, and they apply to any system that produces texts under a publisher's name.

What is passed between the stages

Before turning to the rules, it is worth looking at what a pipeline passes between its stages. This is a series of intermediate results, each of which is stored and checked:

1. The editorial team's specifications: topic, core message, set facts, things to avoid
2. The dossier: every piece of information with its source and date
3. The briefing: structure, target audience, tone, and the safeguard rules for this specific article
4. The versions: version 1, version 2, and so on, each stored separately
5. The review reports: what is supported, what is not, and why a text was sent back
6. The CMS draft: the finished article in the CMS format
7. The log (audit trail): every approval with name and time, every model call with its cost

This list forms the actual blueprint. If each of these results exists, is stored, and can be checked by the next stage, it is possible to trace how an article came about. Otherwise, the pipeline remains a black box whose results an editor-in-chief will hardly trust.

Rule 1: There is exactly one fact base

The dossier is the only source the text may draw from. Whatever is not in it must not be in the article. This turns the hard-to-answer question “Is this true?” into the easy-to-answer question “Is this in the dossier?”

An entry in the dossier reads, for example, “€603 earnings limit, since January 1, 2026”; a statement like “The Minijob limit has gone up” (a Minijob is a German marginal employment) is not sufficient. Without a date, a number in an advice article is worthless, since there is no way to tell whether it still applies.

The dossier draws on three sources. What the editorial team sets as fact is adopted and not researched again. In addition, there is web research as well as the publisher's own materials, such as reader surveys, which are cited with page numbers. Documents marked as confidential, such as media kits, must verifiably be excluded; a mere agreement is not sufficient.

If an article is based on a press release, the press release itself becomes the fact base and the web search is dropped. Every number is still checked, in this case against the press release.

Rule 2: The first approval is for the briefing

A mistake at the very beginning is the most expensive. A wrong focus in the briefing runs through research, writing, review, and formatting.

That is why the first approval comes before writing. The editor-in-chief reads the briefing, approves it, or sends it back with a comment, for example “more focus on the widow's pension.” Minor things like the headline they change directly. Without this approval, writing does not begin. Human in the loop here means that people decide at three defined points; a review at the end is not sufficient for this.

The briefing also contains the safeguard rules for the specific topic. For an advice article on Minijobs and pensions, there were twelve, for example: do not mix up disability pension and old-age pension, do not present a planned tax increase as already decided, no invented quotes. Rules like these cannot be formulated in general in advance, since every topic has its own pitfalls. They do, however, have to be visible so the editorial team can review them, and they have to be checked against the finished text later.

Rule 3: An independent stage reviews

A model that reviews its own text tends to confirm itself. In a newsroom, it goes without saying that someone other than the writer proofreads the text. A pipeline has to be built on the same principle.

That is why a separate fact checker checks every statement against the dossier and sends unsupported ones back with a reason. In one run, the first version contained the sentence “Around 40 percent of them work in retail.” The sentence was plausible but appeared in no source. It was flagged and deleted, and only version 2 moved on to the next stage. The editorial team never got to see version 1.

This loop has to be completed before a human reads the text. Otherwise, the editorial team spends its time hunting for errors, and sooner or later an error goes undetected.

Rule 4: The voice belongs to the editor-in-chief

A magazine's tone belongs in a brand profile that the editor-in-chief maintains personally. A prompt that only a developer knows is the wrong place for it. The profile covers tone and form of address, style rules, banned terms, and the publication's own best texts as models.

A publisher should therefore clarify who changes a term that is no longer to be used, and how long that takes. The editor-in-chief should be able to make this change personally, with immediate effect.

Rule 5: Approved means frozen

Once the text is signed off, that version is frozen. Every later change creates a new version with name and time. This is the only way to answer later which text was approved when and by whom.

What counts is where this rule takes effect. An approval that exists only in the interface can be bypassed through a workaround. It has to be anchored in the software itself and also enforced at the database level.

This also has a legal side. The EU AI Act (Art. 50(4), applicable since August 2, 2026) requires labeling of AI-generated texts that are intended to inform the public on matters of public interest. This does not apply if the texts have been reviewed by humans or are subject to editorial control and a natural or legal person holds editorial responsibility. A log that records every approval with name and time documents that the text was reviewed and approved, and by whom. The assessment in an individual case is a matter for the publisher's legal counsel; the pipeline has to provide the basis for it.

Rule 6: Nothing is ever overwritten in the CMS

The third approval concerns publication. Many integrations fail here on an ordinary case. The final copy desk has already corrected a teaser in the CMS, and afterwards another change is approved in the pipeline. A naive integration simply rewrites the article and thereby deletes the correction.

The pipeline therefore has to detect that the article in the CMS has changed since the last handover; it then overwrites nothing and reports the conflict. The CMS remains the system in which the editorial team has the final say.

Rule 7: Costs are measured per call

Every call to a language model is logged individually, with the step, model, duration, and cost. Only then is it possible to answer whether the system pays off. Every management team asks this question sooner or later.

In an actual run, an advice article with full web research incurred 1.53 US dollars in model costs, all the way to publication. The largest item was the research. Articles based on press releases cost significantly less, because that step is largely dropped.

The log also records what goes wrong. For example, a run that was aborted because a text exceeded the permitted length appeared in the log with its costs. The cause was immediately apparent and was fixed the same evening.

Rule 8: The model changes only deliberately

Language models are updated constantly. A new model may write better, but it may also write differently, and a magazine's tone changes without anyone noticing.

That is why each magazine is assigned a fixed model per format, which changes only when the editorial team deliberately switches it. Before every change, whether to the model or to the instructions, a fixed set of test articles runs through, in my case 17. They show whether the texts get better or worse before readers notice.

At the same time, this lowers costs. Short formats such as checklists run on a compact model, advice articles with research on the standard model, since not every task requires the most powerful model.

Rule 9: The data question has a clear answer

The data protection department will ask where texts flow. The answer has to fit into a few sentences:

• Each publisher has a separate instance; there is no shared database with other customers.
• The servers are located in Germany, or in-house at the publisher on request.
• Sign-in uses a dedicated login without a third-party login service.
• It is openly stated where the language model runs and that content sent via the API is not used for training, according to the provider's contractual terms. It is stated just as openly what is still in progress, such as processing entirely within the EU.

A data protection department that receives a clear answer, including on the open points, approves faster than one that has to work its way through marketing copy.

Checklist: Ten questions for any vendor

When choosing an AI pipeline for an editorial team, the rules above can be translated into questions. A vendor who cannot answer them clearly has probably not implemented the corresponding mechanisms.

1. Where does every number in the text come from, and can I see the source with its date?
2. Can the editorial team specify facts that are not researched again?
3. Do confidential materials verifiably stay out?
4. Is there an approval before any writing happens at all?
5. Does a separate stage review the text before a human sees it, and what happens to unsupported statements?
6. Who maintains the tone and the banned terms, and how quickly does a change take effect?
7. Can an approval be skipped, even through a workaround?
8. What happens if the editorial team has already changed something in the CMS?
9. Can I see the costs per article and per step?
10. When does the language model change, and how is it checked beforehand whether the texts get worse?

The pipeline these rules come from is shown on the page about the AI editorial system. The example A newsroom day walks through a complete working day.