AI-Generated Deliverable Disclosure and Citation Standards
Define standards for disclosing AI involvement in client-facing, regulatory, or published deliverables, and for verifying citations and factual claims in AI-generated content before external distribution, including disclosure before engagement closeout for professional services organizations.
Objective
Prevent liability arising from undisclosed AI-generated content and unverified AI-generated factual or legal claims in deliverables distributed to clients, regulators, courts, or the public, by establishing disclosure and verification standards as pre-distribution requirements.
Maturity Levels
Initial
There is no policy on disclosing AI involvement in client deliverables or verifying AI-generated factual claims. Individual practitioners make disclosure decisions based on personal judgment.
Developing
General guidance discourages unverified AI content in deliverables, but there is no standard disclosure format, no verification requirement, and no pre-distribution check for high-stakes deliverables.
Defined
A deliverable disclosure policy defines: which deliverable types require AI disclosure, what disclosure language is used, and what verification is required for AI-generated factual or legal claims before distribution. The policy applies to all client-facing, regulatory, and published deliverables.
Managed
Disclosure requirements are embedded in engagement closeout checklists and document templates. Verification procedures are defined for specific high-risk claim types (legal citations, statistical claims, technical specifications). Non-compliant deliverables are caught by a pre-distribution review step for high-stakes engagements.
Optimizing
Disclosure and verification requirements are updated as AI use evolves within the organization. Citation verification tooling (automated hallucination detection, source cross-reference) reduces manual verification burden. The policy covers new AI output types (AI-generated code, AI-generated images, AI-generated audio) as they appear in deliverables.
Evidence Requirements
What an auditor or assessor would expect to see for this control.
- —Deliverable disclosure policy defining disclosure categories, disclosure language, and verification requirements by claim type.
- —Engagement closeout or pre-distribution checklist showing AI disclosure step for Category A deliverables.
- —Sample disclosure language approved for use in client-facing and regulatory deliverables.
- —Training records confirming client-facing staff have completed AI disclosure and citation verification training.
Implementation Notes
The liability landscape for undisclosed and unverified AI content
The risk of undisclosed or unverified AI-generated content in professional deliverables materialized in ways that created clear compliance precedent well before most organizations had formal policies:
Legal citation hallucination: In 2023 and 2024, multiple attorneys filed court documents containing AI-generated case citations that did not exist. Courts imposed sanctions. By 2026, court rules in several jurisdictions explicitly require attorney certification that AI-generated content in court filings has been verified. The liability is not limited to attorneys: consultants, auditors, and financial advisors face analogous obligations when delivering reports containing factual or technical claims.
Undisclosed AI content in regulated submissions: Regulatory bodies in multiple sectors have issued guidance requiring disclosure of AI involvement in regulatory submissions, applications, and filings. The FDA, SEC, and equivalent bodies in the EU have all addressed this. Undisclosed AI-generated content in a regulatory submission may constitute a material misrepresentation depending on the submission type and applicable rules.
Client agreements and AI use: An increasing number of enterprise clients are including AI disclosure clauses in professional services agreements. These clauses may prohibit AI use, require disclosure, or require human review of AI-generated content before delivery. Engaging without reviewing whether the client agreement addresses AI creates contractual liability independent of regulatory requirements.
Deliverable types requiring disclosure
Category A — Mandatory disclosure before distribution:
- Court filings, regulatory submissions, or government filings of any kind
- External audit reports, assurance opinions, or attestation letters
- Published research, white papers, or reports representing organizational positions
- Client deliverables under agreements that include AI disclosure clauses
- Any deliverable where the recipient will rely on factual or technical accuracy
Category B — Disclosure recommended, organization's choice:
- Internal reports using AI-generated summaries or analysis (with human review)
- Marketing content using AI for drafting (with human editing)
- Internal training materials
Category C — No disclosure required:
- AI-assisted grammar and style checking of human-authored content
- AI-assisted translation reviewed by a qualified human translator
- AI-assisted scheduling, summarization of internal meetings for internal use
Verification requirements for AI-generated claims
Any deliverable in Category A that contains factual, legal, or technical claims generated or assisted by AI requires source verification before distribution. Verification standards by claim type:
| Claim type | Verification method |
|---|---|
| Legal citations (case law, statutes) | Confirmed in primary source (Westlaw, Lexis, official government site); do not rely on AI-generated case descriptions |
| Statistical claims | Original source identified and confirmed; AI-provided statistics are cross-checked against the cited source |
| Technical specifications | Confirmed against manufacturer documentation or authoritative technical standard |
| Regulatory requirements | Confirmed against official regulatory text; AI interpretation of regulatory obligations reviewed by qualified counsel |
| Quotations attributed to named individuals | Confirmed from original source or direct communication |
The engagement closeout disclosure step
For professional services organizations, the most effective implementation point is the engagement closeout checklist — the standard quality review conducted before final deliverables are released to the client. Adding a disclosure step here ensures:
- The question is asked at the point where it is most actionable.
- Disclosure decisions are documented as part of the engagement record.
- The partner or senior reviewer responsible for the engagement signs off on the disclosure decision.
Example Implementation
AI Disclosure and Citation Verification Checklist — Client Deliverable
Engagement: [Name] | Deliverable: [Title] | Distribution date: [Date] | Responsible partner: [Name]
Step 1: AI involvement assessment
| Question | Answer |
|---|---|
| Was AI used to draft or generate any portion of this deliverable? | Yes / No |
| Was AI used to research, retrieve, or summarize information included in this deliverable? | Yes / No |
| Does the client agreement include an AI disclosure clause? | Yes / No / Unknown (check with GC) |
| Is this deliverable a court filing, regulatory submission, or government filing? | Yes / No |
If any answer above is Yes, complete Step 2.
Step 2: Disclosure decision
Disclosure required? [ ] Yes — see standard language below [ ] No — document reason: ___
Standard AI disclosure language (insert before executive summary or in cover letter): "Portions of this deliverable were drafted or researched with AI assistance. All AI-generated content has been reviewed, verified, and approved by the responsible professional(s) listed below. Any factual, legal, or technical claims have been verified against primary sources. The views and conclusions expressed are those of [Organization Name]."
Step 3: Citation and claim verification
| Claim | Type | Source verified? | Verified by | Date |
|---|---|---|---|---|
| "74% of enterprise AI agent deployments were rolled back..." | Statistical | Yes — source: [Vendor survey, 2026] confirmed at [URL] | [Name] | 2026-05-20 |
| Smith v. Jones, 2024 WL 123456 | Legal citation | Yes — confirmed in Westlaw | [Name] | 2026-05-20 |
| EU AI Act Article 13 requires... | Regulatory | Yes — confirmed against EUR-Lex official text | [Name] | 2026-05-20 |
Step 4: Sign-off Responsible professional: _______________ Date: __________ [ ] Disclosure complete [ ] Claims verified