One of the world’s largest professional services firms, EY, has withdrawn an AI-generated report after researchers discovered fake citations and fabricated references — a development becoming a warning sign for companies moving quickly to integrate generative AI into everyday work.
EY Canada removed a cybersecurity report from its website after researchers from GPTZero said the study contained references to webpages that did not exist, inaccurate sourcing and citations to a McKinsey report that appears never to have been published. The episode exposes a growing workplace problem: businesses are adopting AI tools faster than many companies can realistically review the material those systems produce.
Most companies already know AI systems can invent information. The harder question is whether employees, managers and review teams can catch fabricated material before it reaches clients, courts, regulators or the public under a trusted corporate name.
What Happened With EY’s AI-Generated Report?
The report, titled Points of Attack: Uncovering Cyber Threats and Fraud in Loyalty Systems, was reportedly used by EY consultants in Canada to market cybersecurity services before researchers identified multiple inaccuracies and fake references inside the document.
According to the Financial Times, GPTZero researchers found that several footnotes directed readers to webpages that either did not exist or did not contain the information cited. The researchers also identified contradictory figures within the report itself, including repeated references to the loyalty rewards market being worth $200 billion alongside identical estimates for unclaimed loyalty points.
EY Canada later removed the report and said it was reviewing the circumstances that led to its publication. The firm also stated the study was not connected to client work.
The incident follows other recent examples of fabricated AI-generated material entering professional and legal work. Last month, Sullivan & Cromwell apologised to a New York court after a filing reportedly contained inaccurate legal citations and misquoted sections of the US bankruptcy code. Deloitte also revised a report prepared for a Canadian provincial government after fake academic citations were identified.
Why This Story Is About More Than Fake Footnotes
The significance of the EY incident is not really about a handful of incorrect citations. It is about how easily polished AI-generated material can move through ordinary business processes without somebody spotting the problems early enough.
Professional services firms sell credibility. Their reports are read by executives, boards, cybersecurity teams and corporate decision-makers who often assume published material has already been checked thoroughly.
At the same time, many of those same firms are aggressively promoting AI implementation services and AI governance systems to clients. EY itself said last year that thousands of staff had worked on AI-related projects ranging from enterprise transformation to AI oversight frameworks.
That creates an uncomfortable contradiction. The companies advising businesses on how to manage AI risk are themselves running into the same review and source-checking problems appearing across offices worldwide.
Inside many workplaces, the pattern is already familiar. Employees use generative AI tools to summarise information, draft reports and speed up research under tight deadlines. Managers skim the final version and assume somebody else checked the sources properly because reviewing every citation manually removes much of the speed AI promised in the first place.
The fake citations looked real enough until somebody actually clicked them.
Why AI Errors Keep Slipping Through Workplace Review Systems
Many organisations entered 2025 focused heavily on AI productivity gains. Fewer were prepared for the practical review burden that comes with AI-generated work appearing across departments every day.
Generative AI systems can produce polished reports, realistic references and confident analysis within seconds. Somebody inside the organisation still has to verify whether any of it is true.
That sounds manageable in theory. It becomes harder once dozens or hundreds of employees begin using AI tools simultaneously across marketing, legal, consulting, compliance and internal reporting work.
Review fatigue is becoming part of the problem. Employees assume someone else checked the material. Senior staff trust reports because they look professionally written. Teams under commercial pressure prioritise speed over detailed source-checking, especially for material unlikely to face immediate regulatory scrutiny.
That is partly why incidents like this are becoming more common. Often the problem is less about sophisticated AI failure and more about ordinary workplace behaviour colliding with technology capable of producing authoritative-looking information very quickly.
The Business Risk Is Bigger Than Immediate Legal Exposure
No regulator has announced an investigation into EY’s report, and no litigation linked to the publication has been identified in the verified reporting.
Even without formal legal action, incidents involving fabricated AI-generated information can still create serious business consequences.
Trust is part of what large firms are selling in the first place. If clients or business partners begin questioning whether published research has been properly checked, companies may face pressure to tighten approval procedures, increase human review requirements and place stricter limits on how AI-generated material is used externally.
AI tools are also no longer confined to innovation teams or experimental projects. They are becoming embedded in everyday business operations, including research, legal drafting, marketing, customer communications and strategic planning.
The issue is no longer just technical. It is becoming a workplace management problem.
Why the EY Incident May Matter Beyond the Big Four
For years, conversations around AI hallucinations largely stayed inside technical discussions about model reliability. That is changing quickly.
Now the same problems are appearing in public reports, court filings and business material carrying the names of major law firms, consultants and advisory companies. The EY incident makes the issue easier to understand because it shows how ordinary workplace reliance on AI can produce visible mistakes even inside highly sophisticated organisations.
The EY report shows how AI-related failures can emerge through ordinary workplace habits rather than dramatic system failures. People trust polished output too quickly, especially when deadlines are tight and the work looks credible on the surface.
Businesses moving aggressively into AI adoption may still gain major efficiency advantages. But companies unable to prove that somebody actually checked the material before publication are likely to face growing pressure from clients, partners and internal legal teams.
The Internal Review Processes Companies Are Now Rechecking
Incidents like this often trigger quiet reassessments across legal, compliance and management teams.
Companies using generative AI are likely reviewing:
- source-checking procedures for AI-assisted research;
- approval processes for public-facing reports;
- employee guidance on AI-generated material;
- documentation rules around AI use;
- escalation procedures when unverifiable information is discovered.
The broader shift is already happening. AI tools are becoming embedded across corporate workflows whether businesses feel fully prepared for the oversight burden or not.
Why Companies Are Now Rechecking Their AI Review Processes
EY Canada said it is reviewing the circumstances surrounding the report’s publication and reiterated its commitment to responsible AI use.
No regulatory action connected to the report has been announced. The longer-term significance of the episode may instead lie in how companies respond internally as AI-generated content becomes more deeply embedded inside day-to-day business operations.
Many inside large companies will read the episode less as an isolated mistake and more as an early warning about how quickly AI adoption can outpace the human review systems designed to stop inaccurate information spreading publicly.
People Also Ask
Why did EY remove its AI-generated report?
EY Canada removed the report after researchers identified fake citations, inaccurate sourcing and references that could not be verified.
What are AI hallucinations?
AI hallucinations occur when generative AI systems produce false or fabricated information presented as factual.
Why are businesses worried about AI-generated misinformation?
Companies increasingly rely on AI-generated research and drafting tools, creating concerns about accuracy, oversight and public trust.
Can AI-generated errors create legal risks for companies?
AI-generated inaccuracies can create operational, reputational and workplace accountability risks, especially where unverified information is published externally.
Why is the EY AI story important for other companies?
The incident highlights how quickly AI tools are entering everyday business operations and how difficult it can be to review AI-generated material properly at scale.