Blog · 6 October 2026 · Jon McLachlan

Who did the work. On the record.

A year ago this week Deloitte agreed to repay part of its fee for a government report that cited sources that do not exist. Since then the same failure has turned up at EY, KPMG and PwC and twice more at Deloitte, in security work as well as policy work, and the question clients ask has changed. It is no longer whether a firm uses AI. It is who did the work, who checked it, and whether the firm can show it. This post follows that question through the year: the reports, what clients, governments and insurers now write into their terms, what curl and the security world learned about cheap reports, why an approve button is not an answer, what the courts did to lawyers first, and what a small firm can put in place. With twelve recordings, five posts from X, the Hacker News threads, six figures, pictures of the product, six books and four episodes of The Security Podcast of Silicon Valley. None of it is legal advice.

In the first week of October 2025, Deloitte Australia agreed to repay the last instalment of its fee for a review of the Targeted Compliance Framework, the IT system that penalises welfare recipients who miss their obligations. The Department of Employment and Workplace Relations had paid A$440,000 for the report. It cited academic work that does not exist and a quotation, attributed to a Federal Court judgment, that the judgment does not contain. When a corrected version went up on 26 September 2025, its methodology had a new sentence: the work had used “a generative AI large language model (Azure OpenAI GPT-4o) based tool chain licensed by DEWR and hosted on DEWR’s Azure tenancy”. The department later told Senate Estimates it had asked for A$97,587.11 back. That is about 22% of the fee. The figure of $290,000 in many headlines is the whole contract in US dollars.

The day the refund became public, Deloitte announced that it would give Anthropic’s Claude to nearly 500,000 of its people, and TechCrunch put the two stories in one sentence.

The two are not a contradiction, and this post is not an argument against AI in client work. It is about what a client is buying when it can no longer tell who did the work. Deborah O’Neill, a Labor senator from New South Wales, told the Australian Financial Review that “too often, as our parliamentary inquiries have shown, these consulting firms win contracts by promising their expertise, and then when the deal is signed, they give you whatever [staff] costs them the least.” Then she put the question this post is named for.

“Anyone looking to contract these firms should be asking exactly who is doing the work they are paying for, and having that expertise and no AI use verified.”

Senator Deborah O’Neill, to the Australian Financial Review, as reported by Futurism, 6 October 2025.

We run a security consultancy, YSecurity, and the record we built to run it is Ceed. Every hour in it carries the name of the person who worked it, the date, and a line in their words about what the hour was for. That turns out to be close to the record everyone in this story now asks for, in one form or another: the client who wants to know who did the work, the government that wants detailed records of AI use, the insurer that wants a written policy, and the court that wants a signature. This post is about why, and about what a record can and cannot prove.

One line before the rest, because it matters: none of this is legal advice. The rules below differ by country, by contract and by client, and the person to ask before you change an engagement letter or a statement of work is your attorney.

A year after the refund.

The errors were found by one careful reader. Chris Rudge, who works on health and welfare law at the University of Sydney, read the July report and flagged references to work that does not exist and a made-up quotation from a Federal Court judgment. “I instantaneously knew it was either hallucinated by AI or the world’s best kept secret,” he told Fortune. The Financial Review reported his findings on 25 August 2025, and two days later Paul Karp of Guardian Australia added a detail that made it worse.

The Australian Broadcasting Corporation covered it twice, on the news the day the refund was reported and on its current affairs program three days later, and the second of those is the most watched account of the story we found.

Deloitte’s position, and the department’s, is the strongest defence of the report, and it deserves to be stated in full. Deloitte: “The updates made in no way impact or affect the substantive content, findings and recommendations.” The department: “The substance of the independent review is retained, and there are no changes to the recommendations.” If the findings were sound and only the footnotes were wrong, the argument goes, the client got what it paid for.

Rudge’s answer is the one this post is built on. “You cannot trust the recommendations when the very foundation of the report is built on a flawed, originally undisclosed, and non-expert methodology.” The client paid for judgment, and the references were the visible part of the work that was supposed to support it. When they turned out to be invented, nobody outside the firm could tell which parts of the judgment were a person’s and which were a tool’s. The department took money back for a report whose recommendations it kept.

The politicians were blunter than either side of the contract. Senator Barbara Pocock told Fortune that “Deloitte misused AI and used it very inappropriately: misquoted a judge, used references that are non-existent.” O’Neill’s summary was “Deloitte has a human intelligence problem.” The Greens’ Penny Allman-Payne said Labor “should be insisting on a full refund from Deloitte”. At Senate Estimates in November a deputy secretary of the department said this: “At no point was the department advised that the cause of the errors was attributed to the use of generative AI tools.” In December the Department of Finance began examining whether Deloitte had breached the supplier code of conduct, and asked other agencies about the quality of Deloitte’s recent work for them. We found no published outcome as of 28 September 2026.

On LinkedIn the reaction split along the same line as this post. Felicity Menzies read it as a lesson about oversight.

“Deloitte’s failure to ensure a ‘human-in-the-loop’ approach to AI oversight is a wake-up call for the consulting industry.”

Felicity Menzies, on LinkedIn, 5 October 2025.

Gianluca Mauro, in a post that drew 524 reactions the next day, argued that “the issue isn’t that Deloitte used AI to make an expensive report.” We agree with both of them, and the rest of this post is about the distance between the two: a person in the loop is necessary, and a person in the loop is not the same as a record of who did what.

On Hacker News the Guardian’s story drew 464 points and 230 comments, and the commenters went straight to what a client buys from a large firm. abxyz: “Consultants are brought in to make the decision instead, to put space between the employees and the decision.” rwaksmunski: “Quality of the consulting is irrelevant and interns or AI will do just fine. When the project inevitably implodes, you blame the consultant.” OkayPhysicist: “It’s all just an accountability shell game.” And wmeredith named the idea: “It’s called an accountability sink or liability sink.” citizenpaul linked to the book the phrase comes from, Dan Davies’s The Unaccountability Machine, which is about organisations that hand decisions to systems and rules until nobody who made them can be held to account.

If that is what a client buys, the Deloitte year is its test. A firm that sells accountability has to be able to show who did the work. When it cannot, the client asks for the fee back, or it asks the senator’s question.

Then Canada. Then the other three.

In November 2025 it happened again, at the same firm, in another country. The Independent, a news site in Newfoundland and Labrador, reported on 22 November that the province’s “Health Human Resources Plan”, 526 pages written by Deloitte for C$1,598,485 over two years, cited at least four papers that do not exist. Two of the researchers it credited, Martha MacLeod and Gail Tomblin Murphy, said they had never written the papers attributed to them. Deloitte said AI “was not used to write the report” but was “selectively used to support a small number of research citations”. The Health Department later said the citations “did not affect that model”. No refund has been reported in anything we could find, which is not proof that none was paid.

In August 2026 the province’s accountants said they could not look into it. “The report in question was prepared and delivered to government under a contract between the Government of Newfoundland and Labrador and Deloitte Inc., which is not a registered firm with the Association,” CPA Newfoundland and Labrador said, and “the work carried out for the report by Deloitte Inc. consisted of management consulting work, and did not engage any aspects of public accounting, such as an audit.” The province changed its policy on AI disclosure in public procurement, The Independent reported, though we could not find the wording. The lesson is plain for anyone who sells advice. For most of what a consultant sells, no professional body is watching. The oversight that exists is the contract and the record the firm keeps.

Then the other three of the four largest firms. In May 2026 EY Canada took down “Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems”, a 44-page study credited to two partners and a senior manager, after GPTZero, which sells tools that detect AI writing, found that 16 of its 27 references were hallucinated, among them a McKinsey report that does not exist. “EY Canada takes the accuracy of all the content we publish seriously,” the firm said. In June KPMG International withdrew “Total Experience: Redefining Excellence in the Age of Agentic AI”, published the October before, after GPTZero found that only 5 of its 45 citations were accurate. The Financial Times verified the findings, the organisations falsely cited included UBS, NHS Greater Manchester, Swiss Federal Railways and Transport for London, and KPMG said it had taken the report down “while it reviews how it was produced”. In July GPTZero went through four PwC Middle East reports from 2024 to 2026, found 4 confirmed hallucinations and 7 citations it could not verify among 111, and wrote that “PwC Middle East appears to have hallucinated both an entire product and business dealings with four separate nations.” PwC said it was correcting the citations, Convergence reported, without explaining how the errors got in.

Two of these were security reports. EY’s study was about cyber threats to loyalty programs, and one of the four PwC reports was “Building a Cyber-Resilient eMobility Ecosystem”. The failure is not confined to policy papers, and the security side of it, which is the part of consulting we know best, gets its own sections below.

In September the question came back to Deloitte in New Zealand, in a different form. Wellington’s mayor, Andrew Little, said “large chunks” of the NZ$435,000 “Future Fit Pōneke” report Deloitte wrote for the city council were “written by AI”, and called most of it “frankly, just a waste of time”. The errors in 1News’s account were in the numbers, not the footnotes: double counting, three-year-old data, and staff costs overstated by $21.5 million, in a report that said the council had 330 more staff than it needed. Deloitte’s reply is the most useful sentence of the year.

“Deloitte uses a range of tools and technologies across its work, including AI-enabled tools where appropriate. We are satisfied that the report’s conclusions reflect the work performed and the professional judgement applied.”

Deloitte New Zealand, to Local Democracy Reporting, via 1News, 2 September 2026.

The firm did not defend the words. It defended the work performed and the judgment applied, which is exactly what clients pay for, and exactly what a reader of the finished report cannot see.

Governments had the same trouble with their own documents. South Africa withdrew a draft national AI policy in April 2026 after at least 6 of its 67 sources were found to be hallucinated, and Rest of World’s account of the year also covered 26 wrong footnotes among 492 in a report by ENISA, the European Union’s cybersecurity agency, and the White House’s health report of May 2025. When Wellington’s story reached Hacker News in September, the comments had not moved in a year. casper14 wrote that “these consultants are only hired to shift the blame and responsibility away from civil servants.” Quekid5: “The ‘system’ was responsible, but without personal accountability, nothing will change.” And phil21, against the thread: “Wouldn’t be all that surprised if quality went up with the use of AI for this stuff.” That last one is a fair point, and we come back to it.

What clients now write down.

Buyers are writing the question into their terms, slowly, and the first to write it are the ones with the most to lose. Fulkerson Advisors read 1,054 outside counsel guidelines, the rules that companies and public bodies give the law firms they hire, and published what it found on 16 September 2026. Twenty of them mention AI, 2%. None written in 2022 or 2023 do, 2 of the 220 written in 2024 do, 8 of the 365 from 2025, and 10 of the 261 so far in 2026. Of the twenty, 12 require disclosure when AI is used, 9 deal with billing for AI time, from changing how it is billed to refusing to pay for it, 9 forbid putting client data into public AI tools, 8 require a lawyer to review what the AI produced, and 3 require consent before AI is used at all. It is one small advisory firm’s sample, and it leans to the public sector, but since 2024 the number has risen every year.

One of the twenty belongs to a security company, and it is the most precise we have seen. Zscaler’s guideline, as Fulkerson reproduces it:

“If a timekeeper uses generative AI for a discrete task, they should note that in their time entry.”

“Any work product created by a Large Language Model (LLM) or other generative AI tool must be reviewed by a human attorney.”

“Any time and cost associated with AI-generated work product shall not be passed on to Zscaler.”

Zscaler’s outside counsel guideline, as reproduced by Fulkerson Advisors, September 2026.

The first of the three sentences puts the disclosure where the work is recorded, in the time entry, the one place a client can read it next to the hour it paid for. The second names who checks. The third is the billing question, which we took apart in Fewer hours. Same margin. Together they are a small firm’s whole policy in three lines, written by the client.

The clients who have not written anything down still want to know. More than two-thirds of the corporate legal professionals in the Thomson Reuters Institute’s research “have no idea if their outside law firms are using AI or not”, and one chief legal officer named the fear underneath: “I fear that firms will use AI to cut time, but continue to bill for the hypothetical amount of time a task would have taken without it.” In Clio’s 2025 survey, 78% of clients wanted to be told when their lawyer used AI, while 35% of legal professionals rarely or never told them. And clients disagree with each other. Thomson Reuters found that 40% of firms get contradictory instructions from different clients, some requiring AI and some forbidding it, which means the answer has to be kept client by client and not once for the firm. Oregon’s bar added the billing rule in February 2025: lawyers “must inform their clients, preferably in writing, if they intend to charge clients for the actual costs of using AI”.

Governments have gone further, in writing. In the United States, the Office of Management and Budget’s memo M-25-22 of April 2025 told agencies to decide whether to include “a provision in a solicitation requiring disclosure of AI use as part of any given contract’s performance.” In March 2026 the General Services Administration proposed a clause, 552.239-7001, under which contractors would “disclose within 30 days of award (or earlier if requested) all AI systems used in performance of the contract”. Contractors objected, and the agency pulled it from the next refresh of its schedule. The version it proposed on 17 June is about safeguarding data, and as Jenner & Block summarised it, it asks for notice of changes, among them “Notice of any change that may materially increase output bias, reduce truthfulness, or raise safety concerns, due within seven days of identification”, and it says that “The LLM must be able to summarize its reasoning from input to output and make that record auditable”. Comments closed on 3 August. As of 28 September it is still a proposal, and firms that sell to federal agencies, defense contractors among them, will want to read the final text when it comes.

Australia went furthest, because it went first. The Digital Transformation Agency published model clauses for AI in March 2025, and the Australian Government Solicitor’s summary of them reads like a checklist for this post. The seller must “obtain the approval of the Buyer for use of AI in the provision of the services”, “conduct quality assurance checks to confirm the accuracy and reliability of AI outputs”, “keep detailed records of AI use” and “design and develop the AI system so that it can be effectively overseen and monitored by humans”. Version 2.0 adds the sentence that matters most, as Securiti quotes it: “The seller remains responsible for the performance of this contract regardless of how the AI system is used across the entire supply chain.” Then, in November 2025, the Australian Public Service AI Plan told every supplier on the government’s management advisory and people panels to say what AI it plans to use when it quotes, with new clauses stating that consultants “remain fully responsible for the services they deliver regardless of whether generative AI is used”. The Minister for the Public Service, Katy Gallagher, left no room: “So if you’re a consultant or contractor working in the APS, you would have to abide by the guidance that will be provided centrally”.

The United Kingdom asks, and does not score the answer. Procurement Policy Note 017, reissued in February 2025, gives public buyers two model questions, one about the bid and one about the work: “Are AI or machine learning technologies used as part of the products/services you intend to provide to [Insert Contracting Authority Name]?” The answers are for information only, and as Burges Salmon summarised the note, “Suppliers should not be discriminated against by their use of AI”.

A few companies now write it into the code their suppliers sign. Akamai’s supplier code, version 1.1 of March 2026, says that “Suppliers must conduct appropriate risk assessments, particularly for security-sensitive or high-impact AI applications, and implement human oversight for critical AI-driven decisions,” and that “Suppliers should classify AI systems based on risk and implement data governance, testing, documentation, traceability, and logging measures commensurate with the level of risk.” TIAA’s code for 2026: “Suppliers may not use our Materials in any Technology without first notifying us and giving us the opportunity to assess and explicitly consent to such use.” A consultancy that supplies either of them may be held to those sentences whether or not its own engagement letter mentions AI.

Read together, the clauses ask for four things: tell the client, have a named person check, keep a record, and stay responsible. The first and the last are sentences in a contract. The middle two are a practice, and a practice that leaves no trace cannot be shown to have happened.

The insurer asks. Before renewal.

A firm whose clients have not asked yet will be asked by its own insurer. The exclusions came first. In 2025 W. R. Berkley introduced what lawyers at Hunton Andrews Kurth called an “absolute” AI exclusion for directors and officers, errors and omissions, and fiduciary liability, excluding any claim “based upon, arising out of, or attributable to: (1) any actual or alleged use, deployment, or development of Artificial Intelligence”. Verisk, whose ISO forms many insurers use, rolled out general liability exclusions for generative AI, CG 40 47, CG 40 48 and CG 35 08, effective January 2026. In November 2025 the Financial Times reported that AIG, Great American and W. R. Berkley had asked US regulators for permission to exclude AI liabilities, and AIG said it “has no plans to implement them at this time”.

By the middle of 2026 the lawyers who read policies for a living were saying the same thing in different words. Fenwick in June: “some carriers are declining to cover liabilities associated with AI-generated outputs.” Alana McMullin of Lathrop GPM in August: “There’s been a major shift in the insurance industry’s treatment of AI-related risks and insurers are moving very quickly to limit this exposure.” Her firm’s advice to clients in May was practical: read your renewal for AI exclusions, tell your broker how you use AI before the renewal, tighten your own controls, and check your contracts with clients and vendors for the risk that is no longer insured.

The brokers now describe the conversation from the other side. Two of them spoke to Insurance Business on 24 September 2026. Natalie Chan, a senior risk advisor at Navacord:

“Whether underwriters are asking questions on risk with our clients that have that agentic AI or AI exposure, we are really recommending to our clients: either adopt a formal policy, or perhaps don’t use AI.”

“AI risk will evolve to be a separate cover, just like cyber were a decade or more ago.”

Natalie Chan of Navacord, to Insurance Business, 24 September 2026.

Alex Ilkos of Purves Redmond drew the line where a consultancy lives. He is comfortable when an AI tool helps a firm perform its professional service, and less so as AI becomes the service itself: “that’s where I see a little bit of that grey area.” For a firm of ten people, a consultancy or an engineering firm with its own errors and omissions cover, the line runs through the middle of most engagements, because the same week can hold a report a partner wrote with a tool’s help and a first draft a tool wrote with a partner’s.

We have not found an application form that asks consultants about AI in so many words, and we looked. What the brokers describe is a conversation, and the underwriter’s side of it is the same as the client’s: show us the policy, and show us that you follow it. The first half is a document. The second half is a record, and it is the same record the client will ask for after a mistake, which is the moment an insurer reads it too.

The report is cheap. The check is not.

Security work met this problem early, because security work is mostly reports. A penetration test ends in a report. A bug bounty is a market in reports. A SOC 2 is a report about evidence. And the clearest numbers on what AI did to the value of a report come from one of the most widely used pieces of software in the world. curl, the command-line tool and library that moves data for billions of devices, ran a bug bounty from 2019. Its founder, Daniel Stenberg, published the results when he ended it.

“Previous years we have had a rate of somewhere north of 15% of the submissions ending up confirmed vulnerabilities,” he wrote on 26 January 2026. “Starting 2025, the confirmed-rate plummeted to below 5%.” Six months earlier, in a post called “Death by a thousand slops”, he had counted about 20% of all submissions as AI slop, and described the cost of each one: the curl security team has seven members, and every report takes three or four of them, for thirty minutes, sometimes an hour or three, each. The program had confirmed 87 vulnerabilities and paid more than $100,000 to researchers since 2019. It ended on 31 January 2026, and reports now go through GitHub’s private vulnerability reporting instead.

Stenberg explained what had changed in a conversation with RedMonk in February. Two years earlier, a report meant that the reporter had spent time thinking, testing and verifying. “They actually invested something.” The report was evidence of work because writing it took work. Once writing it took none, it stopped being evidence of anything, and the whole cost moved to the person reading it. He had made the case at length in a keynote at FrOSCon in Bonn in August 2025, five months before he ended the bounty.

When the bounty’s end became news in January, Katie Paxton-Fear, a security researcher who teaches bug hunting, said what she thought of the people sending the reports, and dax, who works on the open-source projects SST and opencode, said it was happening to his projects too.

The thread on Hacker News, 435 points and 264 comments, turned to the fix the market already had. memesarecool: “Hackerone (where cURL hosted their bounty program) tracks the reputation of bounty hunters.” killerstorm went further: “I think ‘internet’ needs a shared reputation & identity layer.” And Snakes3727 described the same problem arriving from the buyer’s side, as a penetration test nobody had ordered.

“my new favourite AI security companies sending us an AI generated pentest un prompted filled with false positives, untrue things, etc. It has become completely useless so no one looks at it.”

“When I looked at the nearly 250 page report, and saw a critical IIS bug for Windows server (doesn’t exist) existing at a scanned IP address of 5xx.x.x.x (yes an impossible IP)”

Snakes3727, on Hacker News, 21 January 2026.

In April HackerOne, which runs bug bounties for companies and hosted curl’s, paused the Internet Bug Bounty for open source. Its statement: “The discovery landscape is changing. AI-assisted research is expanding vulnerability discovery across the ecosystem, increasing both coverage and speed. The balance between findings and remediation capacity in open source has substantively shifted.” John Morello of Minimus told Dark Reading that AI-assisted hunting had “shifted the bottleneck entirely to validation”. In May Kate Holterhoff of RedMonk wrote the sentence this section borrows: “Reports are cheap. Assessments are expensive.” Her longer version is the economics of every professional report now, security or not: “generating a plausible-sounding vulnerability report now costs pennies in tokens. Evaluating whether it’s real still costs an hour of expert time”. She also noted that Node.js had begun requiring a minimum HackerOne reputation score to submit a report at all, which is a record of who did the work, used as the gate.

A consultancy sits on both sides of this. It receives cheap reports, from scanners and vendors and now from tools that write a plausible finding in seconds, and it sells reports. Its clients have just learned from curl what a report without a person behind it is worth. On our own show in September, the chief information security officer of a16z described the same gap from the buyer’s chair, and the episode’s notes put it in one line: “The pen test and the security questionnaire still run, and on an AI tool they don’t answer that question.” The question being what the tool can reach, and what it can do once it gets there.

Evidence, after the fact.

The worst version of a cheap report is evidence made after the fact. In March 2026 an anonymous writer on Substack accused Delve, a compliance automation start-up, of misleading its customers, and TechCrunch reported the claims on 22 March: “falsely convincing hundreds of customers they were compliant”, and “fabricated evidence of board meetings, tests, and processes that never happened”. The writer said Delve “generates auditor conclusions, test procedures, and final reports before any independent review occurs”. Delve disputes the allegations. “Final reports and opinions are issued solely by independent, licensed auditors, not Delve,” it said, and it describes what it sells as “templates to help teams document their processes”.

Whatever the outcome for Delve, the episode showed what a compliance report does and does not prove. Jeff Brown of IANS put it plainly two days later: “A SOC 2 Type II report was never meant to be a security guarantee. It’s an attestation that specific scoped controls operated effectively during a limited observation period.” And the part that should worry every buyer: “The fact that hundreds of companies apparently accepted pre-populated evidence without questioning it shows how much the market has prioritized speed over control effectiveness.” IANS’s advice to buyers was to “Verify accreditation and require confirmation that auditors designed and executed their own tests”, and to pick five to ten controls at random and check that the evidence behind each one exists and is current.

In August a former Deloitte auditor, a CPA who had spent five years on SOC 2 fieldwork, published a method on Hacker News and said what the buyer cannot see: “A buyer holding two SOC 2 reports can’t tell whether one auditor inspected evidence and the other just collected screenshots”. In the same thread primitivesuave described the other half, the side of the firm being audited: “at the end of the day it’s a huge pain grabbing screenshots for what feels like a very performative process.” Evidence gathered in a rush the week before an audit is the kind that can be faked, because it was assembled rather than kept.

The CPA firms that do these examinations say the rules did not change and the questions did. Aprio’s information assurance directors, Danielle Kubinski and Ricardo Pryce, wrote on 18 September that the Trust Services Criteria are the ones in use since 2017, with points of focus refreshed in 2022, and that “If your team relies on AI, that now includes basic AI literacy and the habit of verifying an AI output before acting on it.” Their warning is the one a buyer will repeat: “‘we haven’t really thought about that’ is not an answer that holds up in front of an enterprise buyer.” For the security consultancies and managed security providers that help clients through these audits, the lesson runs both ways. The client’s evidence has to be made during the work. So does the consultancy’s own.

On Hacker News in March, a commenter named matrixgard described what most firms could not produce if asked: “Most companies cannot produce a log showing which employee sent what data to which model, when it was authorized, and what classification level it had.” And the line every policy writer should read twice: “‘Policy says don’t paste customer data into ChatGPT’ gets zero credit as a control.” A policy is a sentence. A control is a sentence plus a record that shows it was followed.

The approve button. The third click.

The usual answer to all of this is a person in the loop: let the tool draft, and have someone approve. Menzies asked for it, the clauses ask for it, and the AI companies build it into their products as a prompt that asks whether you accept the action. The trouble is that the approve button measures a click, and people stop reading long before they stop clicking. Yash Kosaraju, the chief information security officer of a16z, said it on episode 104 of The Security Podcast of Silicon Valley on 22 September.

“Prompt injection is an unsolved problem. The one perceived defense we have is sort of Claude or OpenAI giving you those prompt or user sort of interfaces that say, do you accept this request, or do you accept this action?”

“The problem with that, though, after the third click you don’t really read what’s in there, and you just start clicking through.”

Yash Kosaraju, chief information security officer at a16z, on The Security Podcast of Silicon Valley, episode 104, 22 September 2026, at 16:33 and 16:52.

His answer is not a better button. It is to decide in advance what the tool can reach: “The bigger issue here is what data do you have access to? How do you access it? And is it a two-way read-write or just a read?” And it is not to refuse, because refusal fails too: “Not to say no when people request for something. That’ll lead to two things, right? One, they’ll never come back to you. Two, they’ll find a way to use it anyway, right?”

The research agrees with him, and it is older than the tools. In a study published in Radiology in 2023, Thomas Dratsch and his coauthors had 27 radiologists read 50 mammograms, each with a category suggested by an AI system. When the suggestion was right, inexperienced readers were about 80% accurate and very experienced readers, fifteen years or more, 82%. When the suggestion was wrong, inexperienced readers fell below 20% and the most experienced to 45.5%. “Even highly experienced radiologists were adversely impacted by the AI system’s judgments, albeit to a lesser extent,” Dratsch said.

Ben Green, at the University of Michigan, surveyed 41 policies that require human oversight of government algorithms and found two flaws. “First, evidence suggests that people are unable to perform the desired oversight functions.” Second, and worse for anyone who sells oversight, “human oversight policies provide a false sense of security in adopting algorithms and enable vendors and agencies to shirk accountability for algorithmic harms.” His remedy is “a shift from human oversight to institutional oversight”: rules and records outside the moment of the click. A 2023 experiment by Kupfer and colleagues on AI in hiring found the same limit from another angle. Warning people that the system could make mistakes made them check more, and telling them they were responsible did not make them check significantly more. In May 2026 Liming Zhu and four coauthors, writing in AI and Ethics, described the failure in two words: overseers become “rubber stamps” for outputs they do not fully understand.

The engineers who build these tools say the same about themselves. On Hacker News in July, chonghaoju asked the makers of an authorization tool for AI agents the question every approval tool has to answer: “How do you deal with approval fatigue? In our experience users start rubber-stamping everything within a week, and then the whole layer is theater.” laurencoral, who built a tool that records what coding agents do, described what it looks like: “on a long Claude Code or Cursor run you start clicking Approve on autopilot and stop reading the diffs,” and later, “I had approved my way straight past it.” alanwreath, in June: “reviewers can also tend to just click ‘approve’ (or slap a LGTM) without much effort into critiquing a piece or giving a thoughtful review.” And MomsAVoxell described the rule one team adopted instead, which is not a button at all.

“No LLM code can be committed to upstream branches without at least 2 reviews within the team.”

“Nobody is allowed to just say ‘the LLM wrote this code’. What is important to the team is, who reviewed it? Who reviewed it, again?”

MomsAVoxell, on Hacker News, 16 August 2026.

None of this means a person should not approve. It means the approval is only as good as what is recorded with it. A click records that a button was pressed. What turns it into accountability is everything around the click: who pressed it, when, what they were looking at, the reason they gave in their own words, and a record that nobody can edit afterwards. Green’s “institutional oversight” is, in a small firm, mostly that record. We made the same choice about budgets, for the same reason, and explained it in Alert. Refuse. Hold.

Lawyers went first. In public.

The profession that sells signed work found out first, in court, with its names in the judgments. On 22 June 2023 Judge P. Kevin Castel of the Southern District of New York imposed a $5,000 penalty in Mata v. Avianca, over a brief that cited cases a chatbot had invented. His opinion is still the clearest statement of the rule: “Technological advances are commonplace and there is nothing inherently improper about using a reliable artificial intelligence tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.” He listed the harms too: “The opposing party wastes time and money in exposing the deception. The Court’s time is taken from other important endeavors.”

It did not stop. In July 2025, in Johnson v. Dunn, Judge Anna M. Manasco of the Northern District of Alabama reprimanded lawyers from a large firm, removed them from the case and referred them to the bar. “The insertion of bogus citations is not a mere typographical error, nor the subject of reasonable debate,” she wrote, and then the sentence that explains the rest of this section: “If fines and public embarrassment were effective deterrents, there would not be so many cases to cite.” The detail that matters most for a small firm is in the facts. “Under firm policy, the use of ChatGPT for legal research requires written approval from a practice group leader.” The firm had an approval policy. The policy did not protect it, because a policy is not a record of who checked what.

Damien Charlotin, a researcher who keeps a database of court decisions about AI hallucinations in filings, counted 2,095 of them worldwide on 28 September 2026, nine more than the day before. 829 concern lawyers, 1,208 people representing themselves, 33 judges and 15 experts. The United States has 1,431, Canada 222, Australia 112 and the United Kingdom 70. The sanctions have grown with the count. In February 2026 the Fifth Circuit sanctioned a lawyer $2,500 in Fletcher v. Experian over sixteen fabricated quotations, because the attorney “failed to verify the accuracy of the content generated”. On 25 September a federal court in Massachusetts revoked a lawyer’s permission to appear and ordered $10,000 in costs in Aguilar v. The Crawford Group. In Couvrette v. Wisnovsky in Oregon, Washington State Bar News reported, the penalty was $110,000 and the case was dismissed.

Washington State Bar News put the rule in eleven words, and it is the one consulting has been missing: “Your signature means you are responsible for every word. Full stop.” A lawyer signs a filing, and the signature carries the responsibility no matter who or what drafted it. A consultant’s report has no signature rule, and, as Newfoundland found, often no professional body. What it has instead is the contract and the firm’s own record, which is why the next section is about both.

Law firms live under this rule already. For the management consultancies, data and AI consultancies and professional advisors that do not, the courts have written the template anyway. Gary Marcus, who writes about these cases on his Substack, put the state of play bluntly: “A lot of lawyers are using tools like ChatGPT to prepare briefs, and many still seem shocked when it makes up cases.”

Say it in the contract. Keep it in the record.

A firm of ten people does not need a governance program to answer the senator’s question. It needs a few sentences in its engagement letter and a habit that leaves a trace, and the governments, courts and security buyers above have already written most of both. Here is what we would put in place, in the order we would do it, with where each piece comes from.

1. Say in the statement of work what AI will and will not be used for. The Australian clauses start with the buyer’s approval, and the filed contracts on Law Insider show the range: from “Without RTI’s prior written consent, Vendor will not use any artificial intelligence software, tools, or technologies” to the lighter “Any specific development involving significant use of AI will be communicated to the CLIENT in advance.” Pick the one your clients would sign, and remember that 40% of firms serve clients who disagree with each other, so the answer is per client.
2. Name the person responsible for each deliverable, and say the firm is responsible whatever tool was used. Zusman Partners’ engagement letter language for law firms is one sentence: “All AI-assisted work product is reviewed by a responsible attorney before any use, filing, or transmission.” Dan Cumberland published a clause one firm added to every new contract in August, which says AI-assisted output is reviewed and approved by an attorney before delivery, and the firm, not the tool, is responsible for the work. He added the warning that goes with it: “A clause without an operational discipline behind it is a liability waiting to happen.”
3. Separate the person who makes from the person who checks. HFS Research said it the week of the refund: “The person prompting AI cannot be the same one validating its results.” In a firm of three that can mean a partner reads every client deliverable a colleague drafted with a tool, and the colleague reads the partner’s.
4. Label what a tool wrote, and review your own first. Tom Bedor’s essay in June, which drew 1,753 points on Hacker News, puts the rule in one line: “If you are requesting human attention, demonstrate human effort.” His practice: “I send AI generated content to teammates. But when doing so, I take care to clearly label what is AI generated.” And: “For human code review requests, I always review my AI-generated code first.”
5. Check the things a tool invents. Every report in this post failed on something a person could have looked up: a paper, a case, a quotation, a number. Aprio calls it “the habit of verifying an AI output before acting on it”. IANS’s spot check for evidence works for citations too: pick a handful at random and confirm each one exists and says what you say it says.
6. Keep the record while the work happens. Zscaler asks for a note “in their time entry”. The Australian clauses ask sellers to “keep detailed records of AI use”. Both mean the same thing: the note is made by the person who did the work, on the day, next to the hour, and not assembled later when someone asks. Delve is the reminder of what evidence made after the fact is worth.
7. Keep client data out of public tools unless the client said yes. Nine of Fulkerson’s twenty guidelines forbid it, and Akamai and TIAA put limits on it in their supplier codes. Xia Hua, a co-founder of Traceforce, described the default on our show in July: “Every employee at your company probably has ChatGPT, Claude, and Gemini installed, and nobody’s tracking what data goes where.”
8. Decide how AI time is billed, and write it down. Zscaler will not pay for it. Oregon’s bar says tell the client in writing if you intend to charge for it. Either way the rule belongs in the letter and the hours belong in the record, and we worked through the arithmetic in Fewer hours. Same margin.
9. Tell your broker before renewal. Lathrop GPM’s advice is to brief the broker on your AI use before the policy renews, and Natalie Chan’s is to adopt a formal policy. The broker will ask for the document, and after a claim, for the record.

Some firms will want to say how much of a piece AI wrote, not just whether. David C. Baker and Blair Enns proposed a scale for it on their 2Bobs show on 9 September, six levels from AI-0, all human, to AI-5, “AI-generated”, with three rules: “The author uses this scale to disclose their use of AI in the creation of a written piece of work”, “The highest application level governs the entire piece”, and “At all levels, the author takes responsibility for the finished work”. The last rule is the only one that is not optional.

The same Hacker News thread that took up Bedor’s essay said why, in terms any consultant will recognise. cameldrv: “Ultimately what it means to be a professional is that you are responsible for your work. That’s why you get a salary instead of being paid by the token.” chii: “The reviewers aren’t a shield/safety net.” softwaredoug: “If the creator exerted human effort, they’ll be able to maintain it. They can take responsibility for it.”

What ties the list together is where each piece lives. Items one, two, eight and nine are sentences, and they live in the letter. Items three to seven are acts, and an act a client cannot see only counts if it leaves a trace: a name, a date, a line in someone’s own words, and a month that does not reopen. That is where many small firms are weakest, because their record is a timesheet someone tidies at the end of the month, and it is the part of a firm Ceed was built to keep.

The case against. In full.

The argument of this post has good objections, and the people making them are not wrong about everything.

The first is that oversight is theater. Green found the policies give “a false sense of security”, Kosaraju says nobody reads the third prompt, and chonghaoju calls the approval layer “theater” within a week. We agree, and the post is built on it. A click is not accountability. The answer is not more clicks. It is a record made while the work happens, which says who did the work, who approved it and why, in their own words, dated, in a month that does not change. And Kupfer’s finding points the same way: telling people what can go wrong made them check more, so a record that says what to check does more than one that only says who is responsible. We do not claim a named approver cures automation bias. Nothing in the research says it does.

The second is that people should stop reviewing and let agents verify. Simon Willison, summing up 2026 so far on 27 September, quoted StrongDM’s rule, “Code must not be reviewed by humans”, and turned it into the better question of how agents can help verify their own work. On Hacker News throwaw12 went further: “Ask Agents to review and merge it, also shift the responsibilities to the AI agents as well.” SkiFire13 answered in one line: “That’s not gonna fly most of the time.” Checking can be automated, and in code it increasingly is. Responsibility cannot, because every rule in this post puts it on a named person or firm: Mata’s gatekeeping role, the Australian clause that “The seller remains responsible”, Zscaler’s “human attorney”, Akamai’s “human oversight for critical AI-driven decisions”, and Bar News’s “Your signature means you are responsible for every word.”

The third is that the findings were right and only the footnotes were wrong. That was Deloitte’s position in Australia, the Newfoundland Health Department’s, and in New Zealand, “the professional judgement applied”. It may even be true of some of the reports. But the client cannot check the judgment except through the evidence, and when the evidence is invented, Rudge’s point stands: the foundation is gone, whatever was built on it. The Australian department kept the recommendations and still took the money back.

The fourth is that AI work may be better, and that human reports were never as good as their price. phil21 thought quality might have gone up. pseudohadamard asked, of Wellington, “How could they tell the difference between an AI slop report and a standard Deloitte slop report?” And Thomson Reuters found that more than half of corporate legal and tax departments want their outside firms to use AI. This post is not against AI in client work. It is about who is responsible for it. The same clients who want AI used still want to be told, 78% of them in Clio’s survey, and still want a person answerable for the result.

The fifth is that the trend is tiny. Two percent of outside counsel guidelines mention AI, the United Kingdom’s questions are not scored, and the General Services Administration reworked its clause. All true. But the number has risen every year since 2024, the buyers writing it first are the careful ones, a security company, government panels, Akamai and TIAA, and the insurers are asking where the clients are not.

The sixth is that records get gamed. Archer6621, in the thread on Bedor’s essay: “people naturally optimize perception of effort or value over actual effort or value, because in the end that is what is rewarded.” Delve, whatever the outcome, showed how much evidence made after the fact can look like the real thing. This is the objection we take most seriously, and it is why the record has to be made during the work and then closed. A dated entry in the words of the person who did the work, approved by a named person, in a month that does not reopen, is much harder to fake later than a folder put together before the audit. It is still not proof that the work was good, and we will not claim it is.

The seventh is the cynic’s: consultants were always sold to absorb blame, and nobody wants the record. That is the accountability sink from the Deloitte thread, and it is this post’s argument turned upside down. If what the client buys is someone to be accountable, the accountable firm has to be able to show what it did. When it cannot, the client asks for a refund, or asks who is doing the work.

On the record. In Ceed.

Everything above asks for the same thing in different words. The Australian clauses call it detailed records of AI use. Zscaler calls it a note in the time entry. The broker calls it a formal policy. The court calls it a gatekeeping role, and Bar News calls it a signature. Underneath each one is a record made while the work happens, by the person who did it, that nobody can rewrite afterwards. For the hours a client pays for, that record is the part of a firm Ceed keeps.

Every hour in Ceed is logged against a client by the person who worked it, dated, with a line about what moved forward, from one Slack reminder a day. When someone logs an hour for a colleague, the entry is the colleague’s and the record names them both. A note that a tool drafted the first version and a person checked every source is a sentence in that line, which is exactly where Zscaler asks for it, and it stays with the hour.

An hour that would push a client past its budget is held the moment it is logged, and it waits in the row where it happened for a person to approve or decline it, with the reason they type. The yes goes on the invoice at the agreed rate. The no stays on the record, unbilled. Either way the name and the reason stay with the hour, which is the rule we wrote about in Held. Not hidden. It is not a review of the quality of the work, and we do not pretend it is. It is a decision about who pays for an hour, made on the day, by a named person, in their own words, which is closer to what the research asks for than a click is.

Every change is on an append-only trail, with the actor, the action, and the value before and after. At the top of it are three tabs, Human, Intelligence and All, because Ceed has its own AI and holds it to the rule this post is about. Ceed Intelligence reads a firm’s people list, W-2s and 1099s, client list and agreements into the record, and turns a sentence such as log two hours on Acme Co into the act. It proposes and a person confirms. Every act shows its price before it runs, every record it adds is marked imported, and what the model cost is its own line on the statement. The trail keeps what people did apart from what Ceed Intelligence did, and every number on an invoice is still computed from the agreement and the record, the same way every time.

The invoice carries the work under the number. Beneath the charges sits every approved entry on the account that month, dated, with the name of the person who did it and the line they wrote, as the home page puts it, for anyone who asks what the money bought. When the month closes, the invoices, the statements and the margin freeze, and nothing in it changes after. The record a client, an auditor or an underwriter reads next year is the one that was made this month, which is also the file a buyer asks for, as we wrote in Bill rate. Pay rate.

On a flat retainer the client sees the fee and not the hours, as the home page puts it, and the invoice still says one line. The record underneath is the firm’s to show when the question comes, and it is already there when it does.

Access follows the same rule. Rates and margin are visible only to the owners and the people they name, enforced on the server, and everyone sees their own hours. A firm that answers to its clients’ rules about AI tools can run Ceed Intelligence on its own account with the model provider, or not at all. Ceed works without it, and every rule and number holds on its own.

What the record cannot do is tell you the work was good. A dated entry in the words of the person who did the work, approved by a named person, in a month that does not reopen, is evidence of who did what, when, and who said yes. It is not a check of a single citation. The checking is still the job, and the judgment is still what the client pays for. What the record changes is that the checking, when it happens, is on the record with a name on it, and a client who asks the senator’s question can be answered from the month itself instead of from a folder put together after the question, which is how we prove the hours on a disputed month too.

Our home page answers a question about whether a firm’s own AI could build this: most of it, in a weekend, but not the month that cannot be rewritten, and not a vendor who answers for the invoice. That is the argument this post makes about consultants. The tools make the work cheap. What the client pays for is someone who answers for it, and we built Ceed so that we could, running our own books on it first.

Ceed costs 0.1% of what you invoice, with no seats and no minimum. Your bank moves the money, and Ceed never touches it. Where Ceed stands beside the time trackers and the suites is on the comparison page, and the row about the record is in Ten rows. One engagement.

What the books say.

Six books: two on how organisations lose track of who decided and who checked, two on automation and the people it leaves watching, one on telling AI that works from the rest, and one against the consultants.

• The Unaccountability MachineDan Davies, 2024. Why big systems make bad decisions that nobody owns, and the accountability sink, the idea the Hacker News thread on Deloitte reached for the week of the refund.
• The Checklist ManifestoAtul Gawande, 2009. What surgery learned from aviation about checks that get done, and why the good ones are short and specific.
• The Glass CageNicholas Carr, 2014. Automation complacency and automation bias for a general reader, the long version of the third click.
• AI Snake OilArvind Narayanan and Sayash Kapoor, 2024. How to tell AI that works from AI that does not, the literacy a reviewer needs before an approval means anything.
• The Future of the ProfessionsRichard Susskind and Daniel Susskind, 2015. What experts sell once machines can produce the output, the question under every clause in this post.
• The Big ConMariana Mazzucato and Rosie Collington, 2023. The case against the consulting industry, written before the refund and easier to read after it.

Four conversations about who checks the work.

The firm behind Ceed also hosts The Security Podcast of Silicon Valley, more than a hundred conversations since 2021 with the people who build and run security. Four of them are about the question in this post, asked of software and data instead of reports.

• 104
  Yash Kosaraju, chief information security officer at a16zSeptember 2026 · Why the approve button stops working by the third click, and what to scope instead.
• 84
  Jack Cable, chief executive and co-founder of CorridorDecember 2025 · What gets missed when nobody reviews the code, because code now ships faster than anyone can review it.
• 89
  Graham Neray, co-founder and chief executive of OsoFebruary 2026 · Agents that can delete a production database and report that everything is fine, which is the case for trusting the record over the agent’s own account.
• 100
  Xia Hua, co-founder and chief executive of TraceforceJuly 2026 · The AI tools every employee has installed, and the data nobody is tracking.

Ceed is for firms that sell their team’s time: security consultancies, managed security providers, IT and software firms, data and AI consultancies, management consultancies, law firms, professional advisors, fractional CFO practices, defense contractors and agencies up to fifty people, and nineteen kinds of firm in all. If a client has asked who did the work, sign up and let the month answer. Nothing to pay until your first invoice.

Sign upOr write to hello@ceed.so.

Questions.

Jon McLachlan is a co-founder of Ceed and of YSecurity, where every hour a client pays for carries a name, a date and a line in the words of the person who worked it. Published 6 October 2026. Corrections to hello@ceed.so, and they are dated when made.