Court sanctions for unverified AI output, and what they imply for AI in a deal room

What the 2026 sanctions decisions actually punished

The pattern across the decisions is narrow. Courts are not punishing the use of generative AI. They are punishing filings whose citations were never checked against the source.

Norton Rose Fulbright's survey AI in litigation: Update on Gen AI sanctions in 2026 collects several of them. In Whiting v. City of Athens, Tennessee, decided by the US Court of Appeals for the Sixth Circuit on 13 March 2026, the briefs contained more than two dozen fabricated citations. The court ordered the appellees' reasonable attorneys' fees, double costs, $15,000 each in punitive sanctions against the two attorneys, and a disciplinary referral. The court described the double costs award as the stiffest penalty available under Rule 38, and it distinguished the conduct from ordinary sloppiness in drafting.

Outcomes vary widely for conduct that looks similar. On 11 March 2026 the Fourth Circuit's Standing Panel on Attorney Discipline issued a public admonishment over three nonexistent case citations. In Fivehouse v. U.S. Department of Defense (E.D.N.C., 27 April 2026) the court issued a public reprimand over fabricated quotations attributed to real Fourth Circuit opinions. In Gamez v. County of Fresno (E.D. Cal., 9 April 2026) the court identified citations to nonexistent authorities carrying fabricated quotations and imposed no sanction at all.

State courts are active too. Minnesota Lawyer reported on 2 July 2026 that the Appellate Division, Second Department of the New York Supreme Court ordered $10,500 in sanctions, $8,000 against an attorney and $2,500 against the firm, over a brief containing citations to nonexistent cases, fictitious quotations attributed to the New York Court of Appeals, and misrepresentations of what real cases held. The attorney was reported to have admitted that he negligently failed to verify the AI-generated research before filing.

Two things in that record carry over to any other setting. The fabrications were not obviously wrong on their face. And the penalty did not turn on intent.

The certification orders make verification a signed, per-citation duty

Courts have begun converting the expectation into a filing requirement. The Florida Bar reported that Florida's 11th Judicial Circuit issued Administrative Order No. 26-04 on 15 January 2026 and the 17th Judicial Circuit issued Administrative Order 2026-03-Gen on 26 January 2026. The 11th Circuit form requires counsel to certify that "all factual assertions, legal authority, and citations have been independently reviewed and verified for accuracy" and to accept full responsibility for the filing. The 17th Circuit form requires certification that the signer "has independently verified the accuracy of every citation to the law and /or the record, and the accuracy of any language drafted by generative artificial intelligence, including quotations, citations, paraphrased assertions, facts, and legal analysis." Both orders cover self-represented litigants as well as attorneys.

The obligation attaches to each citation and each quoted passage. It is not satisfied by a disclosure line at the top of the document.

The published case counts understate the problem

The Norton Rose Fulbright update cites a public database that had documented over 1,148 instances of lawyer hallucinations as of that publication. The database maintainer's own FAQ explains why that figure is low. An entry is added only where a court or judge identified the hallucination, because the maintainer does not make that judgment independently. The FAQ states plainly that the database "is necessarily an undercount." It also describes the rate rising from two or three cases a month before 2025 to more than five a day, and a skew toward US cases because US docket data is more accessible than European equivalents.

The selection rule matters more than the total. Every entry exists because an opposing party or a judge had both the incentive and the ability to check.

Why a diligence answer carries a similar structure of exposure

No court sanctions a wrong answer in a data room. The exposure arrives later and through a different route. Diligence responses feed disclosure schedules, and disclosure schedules qualify the representations and warranties in the purchase agreement. A Q&A answer that overstates what a contract says can support an indemnity claim or an earn-out dispute after closing, and the diligence record of who said what is discoverable. The failure that got lawyers sanctioned is the failure that matters here: a confident, specific statement whose cited source does not support it, in a document nobody had time to re-check.

What source-verified drafting checks that a general chatbot cannot

The difference is not model quality. It is whether a step outside the model checks the model's output before anyone reads it.

In CogniSuite, an AI-drafted answer to a counterparty request or a Q&A thread is produced as a structured object rather than free prose. The model must return an availability verdict, the answer text, a statement of what is missing, and a list of citations, each carrying a verbatim quote, a document identifier, and the anchor phrase in the answer that the quote is meant to support. The application then verifies every citation on the server before rendering anything:

• The cited document must sit inside the set the receiving side is permitted to read. Identifiers that do not resolve into that set are dropped.
• The quote must actually occur in that document's extracted text as a whitespace-normalized substring, with a fallback that ignores punctuation and spacing for text pulled out of PDFs and spreadsheets.
• The anchor phrase must actually occur in the answer, so a citation cannot be attached to a claim the answer never makes.

If the model asserts that the information is available and no citation survives all three checks, the answer text is discarded and replaced with a routed-for-manual-review message, and the draft is downgraded and flagged. Surviving drafts are then scanned for three specific hazards: language associated with material non-public information such as reserve prices and competing bids, money figures that appear in the answer but in none of the verified quotes, and negation flips where the answer reverses the polarity of its own source. Those raise flags for the reviewer. They do not block the draft.

Two structural points matter more than any individual check. Retrieval for a counterparty-facing draft is scoped to the intersection of what every counterparty organization that can see the request list is permitted to read, and it denies rather than widening when that scope cannot be resolved. And each deal is a separate database, so a query cannot reach another deal's material. The access model is described on our security page.

The draft is also never delivered automatically. It is returned to the deal team, and a person decides whether to send it.

What that verification does not establish

Verification of this kind shows that a sentence exists in a document the reader is entitled to see. It does not show that the document is accurate, current, or the right document to rely on. If the underlying file is a superseded draft agreement, the citation check still passes.

Other limits are worth stating directly:

• The mechanical quote check runs on the counterparty-facing drafting path. Conversational chat over the room is instructed to cite every claim as a titled link to the source document, but that is a prompt instruction rather than a server-side check, and it is weaker.
• Documents are embedded as a single truncated vector, without passage-level chunking. Retrieval ranks whole documents, so a relevant clause buried deep in a long agreement may not surface for a question it answers.
• If text extraction fails, for example on a scanned PDF with no text layer, the file is stored and viewable but carries no embedding. It is then absent from AI retrieval and search with no indicator to the reader, and recovery requires the deal team to re-run enrichment.
• There is no engine that reconciles figures across documents. If two files disagree on a number, that surfaces only if both happen to be retrieved for the same question and the model chooses to say so.
• Defenses against instructions hidden inside uploaded files are prompt-level guardrails plus input filtering. They reduce the risk, but they are not the enforced boundary. The enforced boundaries are the per-deal database, the folder permission check applied before a document can enter retrieval, and the server-side quote verification described above.
• Intersection scoping can legitimately produce an empty grounding set on a widely shared request list, which yields an unhelpful "not available" draft without explaining why.

The standard worth applying to any AI answer in diligence

Given the certification language now appearing in court orders, the question to put to any AI feature is a narrow one. For each factual claim it produces, can a reviewer reach the exact supporting text, inside the document, in one step, without retyping the claim into a search box. If the answer is no, the verification work still has to be done by the person who signs.