What Could Prove Me Wrong

The letter predicts that by 2027 the first firms will hold a complete, machine-drawn and human-signed map of their obligations; that by 2028 they will enter new countries by changing a profile rather than hiring a department; and that compliance teams will be rebuilt around software. This piece sets out the evidence that the prediction fails. Regulators have been promising cheaper compliance through technology since the FCA’s 2015 call for input, and $73.4 billion of regtech funding between 2019 and 2025 coincided with 99,470 more US compliance officers. In the regulators’ own pilot of machine-readable reporting, the baseline single-product rollout was still in deficit after ten years. McKinsey finds 88% of organisations using AI and about 6% attributing an EBIT impact of 5% or more to it. Purpose-built legal AI tools hallucinated on 17% to 33% of queries in 2024, and a public database of court decisions involving hallucinated AI content listed 1,501 US cases in October 2026. Three of four recent standards and rule deadlines slipped by 8 to 16 months. And the Bureau of Labor Statistics, the letter’s own source for the headcount, projects compliance employment growing 4% over the decade to 2035, not shrinking. Each risk is paired with a public number that will settle it.

In this piece: the thesis stated so that it can fail; regtech has promised this before; enterprise AI stalls at the pilot; the accuracy ceiling and who carries the liability; regulators may not accept a machine-drawn map; the economics may not reach the buyer; standards arrive late and unevenly; the official forecast says more people; the signposts.

The thesis, stated so that it can fail

A prediction that cannot be wrong is not worth reading. The letter makes three claims with dates attached. First, that by 2027 at least one regulated firm will hold a map of its obligations that was drawn by software, reviewed and signed by named people, and that covers the whole firm rather than one rulebook chapter. Second, that by 2028 a firm will add a jurisdiction by changing a description of itself, its products and its licences, with the duties, policies and controls generated from that change, rather than by hiring a local compliance department. Third, that compliance teams will be reorganised around such a system, with the headcount line that Article I charted bending.

Each claim rests on an assumption that could be false. The first assumes that the reading machines are accurate enough for a person to sign what they produce. The second assumes that a common language for rules, duties, roles, documents and firm profile is adopted beyond the firm that proposed it; the letter calls that language CLHEAR, and it is an open standard in development, not a finished one. The third assumes that firms, regulators and the labour market all move within three years, when the history of compliance technology is one of slower movement. What follows is the evidence for each failure, how large the evidence says the risk is, and the public indicator that will show which way it went.

Risk one: regtech has promised this before

In November 2015 the Financial Conduct Authority published a call for input on what it called RegTech, describing the goal as technologies that “help firms better manage regulatory requirements and reduce compliance costs”.¹ The letter’s target, a cut of 80% in a firm’s total compliance cost, aims at the same thing. In May 2025 the United States employed 417,070 compliance officers, up from 257,010 in May 2015, the year of that call.⁴

An instructive case is the one the regulators ran themselves. In 2018 and 2019 the FCA and the Bank of England, with Barclays, Credit Suisse, HSBC, Lloyds, Nationwide, NatWest and Santander, piloted Digital Regulatory Reporting: reporting instructions published by the regulator as code, and firm data tagged to agreed data standards. The Phase 2 viability assessment, released in January 2020, is candid. Within six weeks the pilot built a mortgage data model that could describe ten UK mortgage reports with 160 data point definitions rather than the 860 in those reports. But “for digital regulation, no existing third-party solution appeared to meet all the requirements”: some met some of them, and others “failed because they were built on proprietary standards or required an unproven, nascent technology”. The lack of standardisation in how firms define and describe their data was named as a significant barrier. A central body to run the scheme was costed at £5.31 million to set up and £3.03 million a year.²

The cost model is the part that bears on the letter. Large retail firms spent on average about £450,000 a year running their mortgage reporting and a further £700,000 a year on new obligations and requests for data, and mortgages were put at 5% to 10% of total reporting cost. In the baseline scenario, a large firm rolling out machine-executable reporting for mortgages alone saved about 2% a year once the central body’s costs were included and was still about £457,000 in deficit in year ten; the authors judged that “the standalone viability of DRR (limited to just mortgage reporting) is likely to be low”. Payback came when the firm reused third-party solutions (by year three), rolled out alongside a regulatory change (year four), or extended the system to three domains within three years (paid off by year seven). The scenario covering all reporting, with savings of £680 million to £1.8 billion a year, was described by the authors as “an estimate of the upper bound of savings to aim for in a wider roll-out”. The verdict was “sufficient promise to warrant continued investment and exploration”, a verdict that stops short of a business case.²

Two lessons transfer directly. Machine-readable reporting built for one product line on its own did not pay for itself within ten years; it paid back when it shared costs with existing solutions, with change already under way or with other domains, and sharing at scale needs a standard that several parties accept. And the binding constraint at the time of the pilot was not reading the rules but agreeing what the data meant, which is the same constraint the letter’s common language is supposed to remove. That is a reason to think the letter has identified the right problem. It is also a reason to think the problem is harder than one firm or one standard can fix in two years.

The money tells the same story at a larger scale. KPMG’s Pulse of Fintech, drawing on PitchBook, counts global venture, private equity and acquisition funding in regtech at $3.7 billion in 2019, $21.3 billion at the 2022 peak and $4.9 billion in 2025, a total of $73.4 billion over seven years.³ Over the same period the US compliance officer count rose from 317,600 in May 2019 to 417,070 in May 2025.⁴ The funding is global and the headcount is American, so one cannot be divided by the other, but the directions are not in dispute: the money went in and the people kept being hired. Anyone predicting that the next wave of money will bend the line has to explain why the last wave did not.

There is a smaller lesson in the same charts. The regtech funding total for 2023 was printed as $2.6 billion in KPMG’s H2’23 edition, $4.4 billion a year later and $9.0 billion the year after that; 2021 went from $11.8 billion to $16.6 billion across three printings.³ The industry cannot yet measure its own inputs to within a factor of three in the first year. That is worth remembering when any party, the letter included, quotes a funding total.

Size of the risk. The precedent is strong and specific: a regulator-run pilot with seven large banks and a published cost model judged the standalone viability of single-product machine-readable reporting “likely to be low”. Signpost. If by the end of 2027 no UK regulatory return is accepted from any firm in machine-executable form generated from a shared data model, the pilot’s conclusion still stands and the letter’s 2027 date has to be read against it.

Risk two: enterprise AI stalls at the pilot

The letter’s mechanism is that models read and write regulatory text well enough, cheaply enough, that firms will deploy them. The evidence from 2025 is that firms are trying, and mostly not getting results they can measure.

McKinsey’s State of AI 2025, with 1,993 respondents in 105 countries, finds 88% of organisations using AI in at least one function but “nearly two-thirds” not yet scaling it across the enterprise; 39% attribute any profit impact to AI at all, and about 6% qualify as high performers, attributing an EBIT impact of 5% or more to AI.⁶

The official statistics are slower still. The US Census Bureau has asked a sample of businesses every two weeks since September 2023 whether they used AI in the previous fortnight. The share said yes rose from about 3.7% at the start to about 5.4% by February 2024. In November 2025 the Bureau reworded the question from AI “in producing goods or services” to AI “in any of its business functions”, and it started a new series because of a level shift it observed with the new wording; under the new wording the rate was about 18% at the end of 2025 and 19.8% for the period ending 3 May 2026, with Finance and Insurance at 33.9%.⁷ Professional-services organisations are further along: Thomson Reuters’ annual survey of professionals in legal, tax, risk and government work puts the share whose organisations use generative AI at 12% in 2024, 22% in 2025 and 40% in 2026, but only 18% of respondents say their organisation collects metrics on the return from AI.⁸

Read together, the surveys say that use is spreading and that measured value is still rare. A map of obligations is an enterprise deployment of the kind the McKinsey numbers describe, not a chat window. If about 6% of organisations attribute an EBIT impact of 5% or more to AI, the letter’s 2027 claim needs only one firm to be among them, which is plausible; its 2028 claim about teams being rebuilt needs that to become the norm in compliance departments within three years, which nothing in these numbers supports.

Size of the risk. Large for the third claim, modest for the first. Signposts. McKinsey’s share of respondents reporting any EBIT impact from AI (39% in 2025): if the 2027 edition still shows it below 50%, enterprise AI is not yet paying, and compliance will not be the exception. Thomson Reuters’ GenAI usage rate (40% in 2026): if the 2028 report shows it below 60%, adoption has plateaued at the point the letter needs it to accelerate.

Risk three: the accuracy ceiling, and who carries the liability

The first claim says “human-signed”. A signature is only worth something if the signer can reasonably rely on what is signed, and the published evidence on legal reading is not reassuring. Dahl, Magesh, Suzgun and Ho at Stanford and Yale asked three general-purpose models verifiable questions about randomly sampled federal cases and found hallucinations “between 69% of the time with ChatGPT 3.5 and 88% with Llama 2”.⁹ A follow-up study of commercial legal research tools built on retrieval found that “Over 1 in 6” of its 202 queries caused Lexis+ AI and Ask Practical Law AI “to respond with misleading or false information”, and that for Westlaw AI-Assisted Research “one-third of its responses contained a hallucination”.⁹ Article IV examines these studies and what has changed since; the point here is the floor they establish. In 2024 the leading commercial tools sold to lawyers were wrong on more than one query in six.

The courts have shown what happens when the signature is given anyway. In Mata v. Avianca, a New York federal judge sanctioned two lawyers and their firm $5,000 after they “submitted non-existent judicial opinions with fake quotes and citations created by the artificial intelligence tool ChatGPT”, and wrote the sentence quoted at the top of this piece: the technology is not improper, but “existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings”.¹⁰ That was June 2023. At its update of 19 October 2026, the AI Hallucination Cases database kept by Damien Charlotin, which tracks court decisions in cases where generative AI produced hallucinated content, listed 1,501 cases in the United States.¹⁰

The analogy to an obligation map is direct. A map that says a duty is met when it is not, or omits a duty that applies, is a false filing of a different kind. The person who signs it carries the liability. If reviewers must check every line to be safe, the machine has saved them the typing and nothing else, and the cost cut the letter expects does not arrive. The letter’s 80% cost-cut figure is a target, not a measurement, and this is a mechanism that could defeat it.

Size of the risk. Real but moving. The rates above are from 2023 models and 2024 tools, and from case-law retrieval, not from statute reading with a controlled vocabulary; neither the letter nor its critics have a published accuracy figure for obligation mapping. Signpost. A published evaluation, by a regulator or an independent academic group, of machine-drawn obligation maps against a human gold standard. If the first such evaluation reports a miss rate above 10% on binding duties, human review cannot be sampled and the economics fail; below 2%, sampling becomes defensible. Until one exists, the claim is untested.

Risk four: regulators may not accept a machine-drawn map

The letter assumes that regulators will treat a human-signed, machine-drawn map as satisfying the duty to know one’s obligations. The published position of the regulators is that accountability sits with people, and nothing they have said moves it.

In the United Kingdom, under the duty of responsibility in the Senior Managers and Certification Regime, the FCA and the PRA can act against a Senior Manager responsible for an area in which the firm breaches a requirement if they “do not take such steps as a person in their position could reasonably be expected to take to avoid the contravention occurring (or continuing)”.¹¹ The European Securities and Markets Authority said in May 2024 that “firms’ decisions remain the responsibility of management bodies” whether people or AI tools make them, and that the duty to act in clients’ best interests “applies irrespective of the tools” a firm adopts.¹¹ The EU AI Act requires that high-risk systems “can be effectively overseen by natural persons during the period in which they are in use”.¹² None of these forbids a machine-drawn map. All of them say that if it is wrong, a person answers for it, and a regulator asked to accept a sampled review of a machine’s output has every incentive to ask for a full one.

There is a second, less obvious way the regulators could prove the letter wrong: by doing less. On 12 June 2025 the US Securities and Exchange Commission withdrew fourteen proposed rules, among them the 2023 proposal on conflicts of interest in the use of predictive data analytics by broker-dealers and advisers.¹³ On 24 July 2026 the European Union published Regulation (EU) 2026/1744, the Digital Omnibus on AI, moving the AI Act’s Annex III high-risk obligations from 2 August 2026 to 2 December 2027 and the Annex I obligations to 2 August 2028.¹³ These cut both ways. Fewer and later rules mean fewer duties to map and less of the rule churn that makes a living map valuable; a firm facing a quieter rulebook has less reason to rebuild its compliance function in a hurry. The letter’s case rests partly on regulation growing without pause, and Article I showed the Federal Register at 61,584 pages in 2025, its lowest year of the century.¹⁹ One quiet year is not a trend. Several would be.

Size of the risk. The accountability rules are a constraint on how the thesis is implemented, not a bar to it; the deregulatory turn is a risk to its urgency. Signposts. Whether any of the FCA, ESMA, the SEC or a national competent authority publishes, by end-2027, guidance that names machine-generated obligation registers or control mappings and sets conditions for relying on them; silence or a requirement for line-by-line human review would count against the letter. And the Federal Register page count for 2026 and 2027: two further years under 70,000 pages would indicate the rule flow is slowing rather than accelerating.

Risk five: the economics may not reach the buyer

Article I leaned on Epoch AI’s finding that the price of GPT-4-level reading fell from $37.50 per million tokens in March 2023 to $0.18 in February 2025. Epoch’s own caveat is worth quoting in full: “The rate of decline varies dramatically depending on the performance milestone, ranging from 9x to 900x per year”, and “The fastest price drops in that range have occurred in the past year, so it’s less clear that those will persist.”¹⁷ A price series with two years of history is not a law of nature. If model prices stop falling, the map remains possible but the margin that pays for human review narrows.

The more likely version of this risk is not that inference stays expensive but that the saving is captured before it reaches the compliance department. Well placed to sell a machine-drawn map are the firms that already sell the rulebooks and the research tools. Thomson Reuters completed its purchase of Casetext, whose products include CoCounsel, “an AI legal assistant powered by GPT-4”, for $650 million in cash in August 2023.¹⁸ LexisNexis made Protégé, its personalised AI assistant with agentic AI, generally available in the United States in January 2025.¹⁸ Both own the licensed content, the customer relationships and the sales forces. A compliance department that buys the map from its existing content vendor at the vendor’s price may get a better product and no cost reduction at all, which would leave the headcount where it is for a different reason than the letter expects.

Size of the risk. Moderate; it changes who benefits more than whether the map gets drawn. Signposts. Epoch’s price series ($0.18 per million tokens at GPT-4 level in February 2025): if the cheapest model at GPT-4-level capability is not below $0.10 per million tokens by the end of 2027, the price curve has flattened. And whether, by 2028, any regulated firm publicly reports a compliance cost or headcount reduction attributed to an obligation-mapping system, from any vendor. A list of product launches is not evidence; a reported saving is.

Risk six: standards arrive late and unevenly

The second claim depends on a shared language. The letter’s candidate is CLHEAR, which is an open standard in development. The record of the financial data standards examined here is that they arrive late, are adopted unevenly, and can be applied badly once adopted.

Swift’s migration of cross-border payments to ISO 20022 was first due to begin in November 2021. In March 2020 Swift moved the start to “the end of 2022”, a year later, while holding the end date for retiring the old message format at November 2025; in November 2022 it moved the start again, to 20 March 2023.¹⁴ The end date held: coexistence with the old MT format ended on 22 November 2025, and in September 2025, two months before the deadline, Swift reported that “the average daily ISO 20022 payment instruction messages reached more than 60%”.¹⁴ Swift, which ran the migration, describes itself as “a global member owned cooperative”, and the migration still took two formal slips and more than seven years from its announcement in September 2018 to the final cut-over.

The UK’s Open Banking programme was ordered by the Competition and Markets Authority, which is as much force as a standard can have. Article 14 of the CMA’s Order, under which the nine banks it covered had to provide account-information and payment-initiation access, came into force on 13 January 2018. In December 2017 the CMA issued directions under that article to six of the nine; Bank of Ireland had told the CMA it would not be able to go live with account information “until 3 August 2018” or with payment initiation “until 7 September 2018”.¹⁵ The CMA was still issuing directions to five banks in April 2019.¹⁵ And where a standard is adopted, quality is a separate battle: in 2021 an SEC commissioner said of XBRL financial tagging, mandatory for operating companies since 2009, that “Some users have found material error rates in data tagged in our filings”, including in tags “crucially important to investors like Revenues, Net Income, and Assets”.¹⁶

The pattern is consistent with the regulators’ 2018 and 2019 reporting pilot: the technical modelling is the fast part and the agreement is the slow part. A standard written by one company has the additional problem that competitors have no reason to adopt it and customers have reason to fear lock-in; the Phase 2 assessment found that some candidate solutions “failed because they were built on proprietary standards”.² A standard for obligations, roles and controls faces one more obstacle that payments standards did not: there is no central operator who can set a retirement date for the old way of doing things.

Size of the risk. This is a central risk to the 2028 claim. A firm can draw its own map in its own vocabulary by 2027 without anyone else agreeing; it cannot switch on a new country from a profile unless the rules of that country have been expressed in the same vocabulary, by someone. Signposts. Whether, by the end of 2027, any organisation other than the standard’s originator has published rules, duties or control libraries in CLHEAR or in any other open obligation vocabulary, and whether any regulator has referenced such a vocabulary in a publication. One implementer is a product; two independent ones are a standard.

Risk seven: the official forecast says more people, not fewer

The letter uses the Bureau of Labor Statistics to show the headcount growing. The same Bureau publishes a forecast, and it does not predict a fall. The Occupational Outlook Handbook puts compliance officer employment at 436,400 in 2025 and projects growth of 4% to 2035, an increase of 16,700 jobs, which it describes as “as fast as average”. It expects about 32,700 openings a year over the decade; growth accounts for about 1,670 a year of them, so about 95% replace workers who move to other occupations or leave the labour force (computed for this article).⁵ The Handbook’s base count includes the self-employed, whom the employer survey does not cover, and sits above the 417,070 that the employer survey found in May 2025, but the rate is what matters: about 0.38% a year, against the 4.9% a year the employer survey recorded from 2010 to 2025.

That gives three futures to test. If the 2010 to 2025 trend continues, the May 2028 count is about 481,000. If the Bureau’s projected rate holds, it is about 422,000. If the letter is right that teams are rebuilt around software, it should come in at or below the Bureau’s path, since a function that is being re-staffed around a system does not also grow at 4.9% a year. It is worth noting what the official forecast is not: it is not a prediction that AI will reduce compliance work, and the Handbook page does not cite AI, automation or software as a factor in employment. The Bureau attributes demand to “the need for businesses and government agencies to comply with various laws and regulations”, and its method divides projected industry employment between occupations on historically observed staffing patterns, adjusted for expected structural change; a 4% decade is already a sharp break from the 15 years before it, and the Handbook does not explain the break.⁵

Size of the risk. The forecast is direct counter-evidence to the letter, from its own source. Signpost. The May 2028 OEWS national employment estimate for occupation 13-1041, published in spring 2029. Above 460,000, the trend is intact and the third claim has failed on the measure the letter itself uses. Below 430,000, the line has bent. Between the two, the question stays open until May 2030.

The signposts

Every risk above comes with a number that someone other than the letter’s author will publish. The table collects them. None of them proves the thesis true; the letter can be right about the map and wrong about the headcount, or right about one firm and wrong about the industry. Each of them can prove it false.

Forecasts of this kind can fail on timing before they fail on direction, and timing is not a small matter: a map that arrives in 2032 instead of 2027 is a different business, a different cost base and a different labour market. The evidence in this piece makes the 2027 claim plausible, the 2028 claim unproven, and the headcount claim contrary to the official BLS forecast. The dates in the table are when that changes, one way or the other.

Notes and sources

1. Financial Conduct Authority, Call for Input: Supporting the development and adoption of RegTech, November 2015, section 1.4: technologies that “help firms better manage regulatory requirements and reduce compliance costs”; section 1.5 cites the March 2015 Budget commitment that the FCA, with the PRA, would “identify ways to support the adoption of new technologies to facilitate the delivery of regulatory requirements”. The feedback statement is FS16/4 (July 2016).
2. Financial Conduct Authority and Bank of England, Digital Regulatory Reporting: Pilot Phase 2 Viability Assessment. Participants across the pilots: Barclays, Credit Suisse, HSBC, Lloyds, Nationwide, NatWest and Santander. In the DRR vision, “a coded version of reporting instructions are published by the regulator” and firm data are “digitally tagged and identified according to agreed data standards”. Figures used: “Within six weeks they built a model that could describe 10 UK mortgage reports”, with 160 data point definitions rather than 860; large retail firms spend “an annual average of £450k” on ongoing mortgage reporting and a further £700k a year on new obligations and requests for additional mortgage data, mortgage reporting being “around 5-10% of total regulatory reporting costs”; central body set-up £5,310,000 and £3,028,000 a year. Scenario 1 (large firm, UK mortgages only, with central body costs) saves 2% a year and is £457,000 in cumulative deficit in year 10, and “the standalone viability of DRR (limited to just mortgage reporting) is likely to be low”; scenario 2 (reusing third-party solutions) “sees its investment back by year three”; scenario 3 (rolled out with a regulatory change) shows “a positive return on the investment by year four”; scenario 4 (incremental rollout to three domains within three years) is “fully paid off by year 7”; scenario 5 (all reporting) gives savings of £680m to £1,800m a year, “an estimate of the upper bound of savings to aim for in a wider roll-out”. On solutions: “For digital regulation, no existing third-party solution appeared to meet all the requirements”; “Some solutions met some of the requirements. Others failed because they were built on proprietary standards or required an unproven, nascent technology.” On data: “The lack of standardisation of the definitions and descriptions of data by firms is a significant barrier”. Verdict: “DRR showed sufficient promise to warrant continued investment and exploration.” The document prints no publication date; the FCA’s DRR page says it was released in January 2020, that the regulators worked with “7 banks” in 2018 and 2019, and that Phase 2 ran from February to October 2019.
3. KPMG, Pulse of Fintech, global regtech charts, data from PitchBook (the H2’22, H2’23 and H2’25 charts print “data provided by PitchBook”; the H2’24 report states that its figures are based on PitchBook data unless otherwise noted): H2’22 (2019 $3.7bn, 2020 $10.6bn, 2021 $11.8bn, 2022 $18.6bn); H2’23 (2020 $11.1bn, 2021 $12.7bn, 2022 $21.0bn, 2023 $2.6bn); H2’24 (2021 $16.6bn, 2022 $20.0bn, 2023 $4.4bn, 2024 $7.4bn); H2’25 (2022 $21.3bn, 2023 $9.0bn, 2024 $6.8bn, 2025 $4.9bn; “total investment in regtech declined in value from $6.8 billion in 2024 to $4.9 billion in 2025”). The seven-year series in the first chart takes each year from the latest edition that prints it. The 2014 to 2018 figures used in Article I could not be re-opened for this article and are not used here.
4. US Bureau of Labor Statistics, Occupational Employment and Wage Statistics, occupation 13-1041, Compliance Officers, national employment, May of each year: 204,000 (2010), 210,510, 227,500, 236,090, 246,970, 257,010 (2015), 273,910, 287,130, 300,900, 317,600 (2019), 327,360, 334,340, 359,640, 383,620, 397,770 and 417,070 (2025). Read in the annual news releases, Table 1 (for example May 2010, May 2015, May 2024 and the May 2025 release), and in the occupation pages for May 2016 to May 2023 (for example May 2019 and May 2023). The technical note to the May 2015 release says each estimate combines six semiannual panels collected over three years.
5. US Bureau of Labor Statistics, Occupational Outlook Handbook, Compliance Officers, page modified 27 August 2026: 2025 median pay $80,730 a year; number of jobs, 2025: 436,400; projected employment, 2035: 453,100; job outlook 2025 to 2035: 4% (“As fast as average”); employment change 2025 to 2035: 16,700; “About 32,700 openings for compliance officers are projected each year, on average, over the decade”; “Many of those openings are expected to result from the need to replace workers who transfer to different occupations or exit the labor force, such as to retire.” On demand: “Demand for compliance officers will stem from the need for businesses and government agencies to comply with various laws and regulations.” The page does not cite artificial intelligence, automation or software as a factor in employment. The Handbook base comes from the Employment Projections programme, whose National Employment Matrix adds self-employed workers, workers in private households and agricultural workers, taken from the Current Population Survey, to wage and salary employment, and which divides projected industry employment between occupations on historically observed staffing patterns adjusted for expected structural change; the OEWS establishment survey does not capture the self-employed (BLS, Handbook of Methods, Employment Projections: Calculation).
6. McKinsey, The state of AI in 2025: Agents, innovation, and transformation, 5 November 2025: “88 percent report regular AI use in at least one business function”; “Nearly two-thirds of respondents say their organizations have not yet begun scaling AI across the enterprise”; “Thirty-nine percent of respondents attribute any level of EBIT impact to AI”; AI high performers are “Respondents who attribute EBIT impact of 5 percent or more to AI use”, “representing about 6 percent of respondents”. Survey of 1,993 participants in 105 nations, 25 June to 29 July 2025.
7. US Census Bureau, Business Trends and Outlook Survey. Starting values from Bonney et al., Tracking Firm Use of AI in Real Time, CES working paper 24-16, March 2024: “from about 3.7% at the start of the collection in September 2023 to about 5.4% at the end of February 2024”; the survey is collected every two weeks. Question change: Census Bureau, BTOS AI Core Question Updates: on 17 November 2025 “in producing goods or services” became “in any of its business functions”, and a new series was started “Due to a level shift observed in conjunction with the new question wording”. End-2025 level “about 18 percent of firms” from Federal Reserve Board, Allen, Monitoring AI Adoption in the US Economy, FEDS Notes, 3 April 2026 (four-period moving average). Latest: Census Bureau, Large Firms With at Least 20 Employees Biggest AI Users, May 2026: national rate 19.8% for the collection period ending 3 May 2026; Finance and Insurance 33.9%; between 17% and 20% overall from December 2025 to May 2026.
8. Thomson Reuters Institute, 2026 AI in Professional Services Report: “Four-in-ten respondents say their organizations are using GenAI, up from 22% last year”, shown in the report as 40%; “only 18% of respondents say their organizations collect metrics around ROI from AI”; 1,514 respondents in 27 countries, surveyed in October and November 2025, in legal, tax and accounting, risk and fraud, and government. Thomson Reuters Institute, 2025 Generative AI in Professional Services Report, 15 April 2025: the share of organisations actively using GenAI “nearly doubled over the past year, to 22% in 2025, compared to 12% in 2024”.
9. Dahl, Magesh, Suzgun and Ho, Large Legal Fictions: Profiling Legal Hallucinations in Large Language Models, arXiv 2401.01301 v1, 2 January 2024 (authors at Yale and Stanford): hallucinations “occurring between 69% of the time with ChatGPT 3.5 and 88% with Llama 2” on verifiable questions about randomly sampled federal court cases; models tested were gpt-3.5-turbo-0613, PaLM 2 text-bison-001 and Llama-2-13b-chat-hf. Magesh, Surani, Dahl, Suzgun, Manning and Ho, Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools, arXiv 2405.20362 (30 May 2024), published in the Journal of Empirical Legal Studies in 2025 (copy hosted at Stanford): the LexisNexis and Thomson Reuters tools “each hallucinate between 17% and 33% of the time”; “Over 1 in 6 of our queries caused Lexis+ AI and Ask Practical Law AI to respond with misleading or false information”; for Westlaw AI-Assisted Research, “one-third of its responses contained a hallucination”; “the sample size of 202 queries”. Per-tool rates are printed only in the paper’s figures. Stanford HAI’s summary, AI on Trial (23 May 2024, updated 30 May 2024), gives Westlaw as “more than 34%”; the paper’s figure is used here. Article IV treats these studies in depth.
10. Mata v. Avianca, Inc., No. 22-cv-1461 (PKC), 678 F. Supp. 3d 443 (S.D.N.Y. 22 June 2023), Opinion and Order on Sanctions, Castel J., docket entry 54, read in the court filing as archived by CourtListener: “Technological advances are commonplace and there is nothing inherently improper about using a reliable artificial intelligence tool for assistance. But existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.” Respondents “submitted non-existent judicial opinions with fake quotes and citations created by the artificial intelligence tool ChatGPT”; “A penalty of $5,000 is jointly and severally imposed on Respondents”, two attorneys and their firm. Database: Damien Charlotin, AI Hallucination Cases, read 20 October 2026 (“Last updated: 19 October 2026”): “2202 cases identified so far”, of which the jurisdiction filter lists “USA (1501)”.
11. Financial Conduct Authority, PS17/9, Guidance on the duty of responsibility, paragraph 1.8: a Senior Manager can be held responsible where they “do not take such steps as a person in their position could reasonably be expected to take to avoid the contravention occurring (or continuing)”; guidance applied from 3 May 2017. European Securities and Markets Authority, Public Statement: On the use of Artificial Intelligence (AI) in the provision of retail investment services, 30 May 2024, paragraph 2: “firms’ decisions remain the responsibility of management bodies”, whether those decisions are taken by people or by AI-based tools; paragraph 7: the commitment “to act in clients’ best interest” is “an overarching requirement which applies irrespective of the tools that the firm decides to adopt in the provision of services”.
12. Regulation (EU) 2024/1689 (the AI Act), Article 14(1): “High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which they are in use.” Read on the European Commission’s AI Act Service Desk.
13. US Securities and Exchange Commission, rulemaking file S7-12-23, Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers: proposed 26 July 2023 (Release 34-97990); withdrawn by “Withdrawal of Proposed Regulatory Actions”, Release 33-11377, dated 12 June 2025, Federal Register, 90 FR 25531, 17 June 2025, document 2025-11110, which lists fourteen withdrawn proposals: thirteen published in 2022 and 2023 and one in October 2020. EU: Regulation (EU) 2026/1744 of 8 July 2026 (the Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026, in force from 27 July 2026 according to EUR-Lex. Article 113 of the AI Act as amended, on the European Commission’s AI Act Service Desk: the Act “shall apply from 2 August 2026”, but Chapter III, Sections 1, 2 and 3 apply from “2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III” and from “2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I”.
14. Swift, Swift Board recommends a migration of payments traffic to ISO 20022 starting November 2021, undated page from 2018 (it refers to a paper due “in December 2018”): the start is “currently scheduled for November 2021” and “MT and ISO 20022 will coexist for a period of 4 years.” ISO TC68, New ISO 20022 implementation timeline for cross-border payments, 27 March 2020, by Swift: the timings were first announced in September 2018; Swift will enable ISO 20022 messages for cross-border payments “starting from the end of 2022”, which “extends the originally announced date by one year”; “The end-date to enable full ISO 20022 for cross-border payments remains as originally planned, November 2025.” Swift, Swift accepts community request to begin ISO 20022 migration in March 2023, 9 November 2022: “we will begin the ISO 20022/MT coexistence period for all users on 20 March 2023.” Swift, ISO 20022 in bytes for payments: One month to go, October 2025 edition: coexistence “is scheduled to end on 22 November 2025”; “In September, the average daily ISO 20022 payment instruction messages reached more than 60%.” Swift, Global financial community completes switch to ISO 20022, Brussels, 25 November 2025: “The final switch happened on 22 November, with the end of coexistence with the traditional MT message format”; “Swift is a global member owned cooperative”.
15. Competition and Markets Authority, Directions to Bank of Ireland under the Retail Banking Market Investigation Order 2017, in force 20 December 2017: “Pursuant to Article 2.10 of the Order Article 14 comes into force on 13 January 2018”; the bank “informed the CMA that it would not be able to go live in respect of account information service provider functionality until 3 August 2018” and “until 7 September 2018 in respect of payment initiation service provider functionality”. The CMA’s case page lists directions dated 19 December 2017 to Bank of Ireland, Barclays, HSBC, RBS, Santander and Nationwide Building Society, and directions of 1 April 2019 to Bank of Ireland, Danske, HSBC, Lloyds Banking Group and Santander over app-to-app functionality, which the Open Banking Implementation Entity reported as CMA Issues Directions to 5 Banks (1 April 2019), against nine mandated banks.
16. US Securities and Exchange Commission, Commissioner Caroline A. Crenshaw, The Lessons of Structured Data, 10 November 2021: the voluntary XBRL programmes for operating companies and mutual funds “were made mandatory in 2009”; “Some users have found material error rates in data tagged in our filings”, including “errors in tags that are likely to be crucially important to investors like Revenues, Net Income, and Assets”. The speech gives no numerical error rate.
17. Epoch AI, LLM inference prices have fallen rapidly but unequally across tasks, 12 March 2025: “The rate of decline varies dramatically depending on the performance milestone, ranging from 9x to 900x per year”; “The fastest price drops in that range have occurred in the past year, so it’s less clear that those will persist.” At GPT-4’s MMLU level (86.0), GPT-4-0314 (14 March 2023) is listed at $37.50 per million tokens and Gemini 2.0 Flash (5 February 2025) at $0.18.
18. Thomson Reuters, Thomson Reuters Completes Acquisition of Casetext, Inc., 17 August 2023: “a purchase price of $650 million in cash”; “Its key products include CoCounsel, an AI legal assistant powered by GPT-4”. LexisNexis, LexisNexis Introduces Protégé Personalized AI Assistant with Agentic AI, 27 January 2025: LexisNexis “today announced the U.S. general availability of LexisNexis Protégé”.
19. Office of the Federal Register, Federal Register page statistics, total pages: 61,584 in 2025, the lowest of any year from 2000 to 2025 (the next lowest are 61,950 in 2017 and 62,684 in 2001).