In March 2026, the Sixth Circuit sanctioned two Tennessee attorneys and made a point of being loud about it.
In Whiting v. City of Athens, Nos. 24-5918/5919, 25-5424, 2026 WL 710568 (6th Cir. 2026), the panel found counsel had filed briefs containing more than 24 fake citations, along with citations that lacked the language quoted in the brief and citations that did not support the proposition they were offered for. The court ordered the attorneys to reimburse the appellees’ fees, pay double costs, which it described as “the stiffest penalty available under Rule 38,” and pay $15,000 each in punitive sanctions. It said it was sending “the loudest message” possible that “this type of conduct is not allowed in our court or any other.”
Here is the detail that most coverage skipped. The Sixth Circuit never actually established that generative AI was involved. The opinion hints at it, but the attorneys, in the court’s words, “did not seriously respond to” the show cause order asking who wrote the briefs and whether AI was used. The panel sanctioned them anyway, under rules that predate the technology entirely.
That is the real state of the law, and it is more demanding than the one most firms are preparing for. Courts are not building a separate compliance regime for AI. They are applying the existing duty of candor and finding that it was already sufficient. Whether a fabricated citation came from a language model, a rushed associate, or a copied brief is not the question the court is asking.
I build AI systems for a living, including agents that operate in regulated environments. I want to explain what is actually happening inside these tools when they produce a citation that looks perfect and does not exist, because the fix that follows from understanding the mechanism is not the fix most firms are implementing.
AI hallucinations in legal filings — the numbers so far
- 2,022 documented court decisions involving AI-hallucinated material as of the 5 September 2026 update (1,379 in the U.S.)
- 805 involve a lawyer; 1,163 involve a self-represented litigant; 31 involve a judge; 15 involve an expert witness
- Largest confirmed U.S. penalty to date: $110,204.38 (Couvrette v. Wisnovsky, D. Or.)
- Q1 2026 U.S. sanctions total: roughly $145,000
- The database is growing by about eight new decisions per day
What the record actually shows
The scale of AI hallucinations in legal filings is no longer anecdotal. It is documented, and it is growing by the day.
The most complete public record of this is the AI Hallucination Cases Database maintained by legal researcher Damien Charlotin. As of its 5 September 2026 update, it logs 2,022 decisions in which a court responded to AI-hallucinated material, 1,379 of them in the United States, running from Q2 2023 to the present.
Break that down by who filed the offending material and the story changes shape.
Of those 2,022 decisions, 805 involve a lawyer. 1,163 involve a self-represented litigant. Thirty-one involve a judge. Fifteen involve an expert witness.
Self-represented parties are the larger share by a wide margin. This is not primarily a story about reckless attorneys, and treating it as one leads firms to the wrong remedy. If the problem were professional carelessness, the answer would be training and warnings. But the same failure appears across every category of user, including people with no professional duty at all, and including the bench. What that distribution actually describes is a tool that produces a specific, predictable output defect regardless of who is holding it.
The defect types are logged too: 1,677 involve fabricated material, 845 involve misrepresented authority, and 547 involve false quotes. Fabrication is the largest category, but note that misrepresentation is close behind. A real case, cited accurately, that does not say what the brief claims it says will not be caught by checking whether the case exists. That distinction matters enormously for anyone designing a review process, and I will come back to it.
Why a language model invents a citation that looks correct
A large language model does not retrieve citations. It generates them, one token at a time, by predicting what is statistically likely to come next given everything before it.
A legal citation is one of the most learnable patterns in written English. Volume, reporter, page, court, year. The model has seen millions of them. When it produces Varghese v. China Southern Airlines, 925 F.3d 1339 (11th Cir. 2019), one of the fabrications in the original Mata v. Avianca filing, it is not lying and it is not confused. It is doing exactly what it was built to do: emit the most plausible continuation. A citation that is correctly formatted, plausibly numbered, and attributed to a court that hears that kind of case is the most plausible continuation. Whether the case exists is not a property the model has access to.
This is the part that surprises lawyers: the model has no internal flag distinguishing recalled fact from generated pattern. There is no confidence value it is suppressing. The fabricated citation and the real one are produced by the same process, and from the inside they are indistinguishable.
Which is why the single most instructive moment in this entire body of case law is a detail from the case that started it. In Mata v. Avianca, Judge P. Kevin Castel of the Southern District of New York sanctioned Steven Schwartz, Peter LoDuca and their firm $5,000 in June 2023 over six fabricated citations. When Schwartz became uneasy, he did the intuitive thing. He asked ChatGPT whether the cases were real.
It said yes.
That exchange is the whole problem in miniature. Asking a model to verify its own output is not verification. It is the same probabilistic process run a second time, on a prompt that now signals the user wants confirmation. Models are non-deterministic in a way that is easy to underestimate: even with temperature at zero and structured output enforced, the same input can produce different results across model versions, prompt changes, or shifts in context. In production systems we treat this as a permanent property of the technology rather than a bug awaiting a fix, and we design around it with input guardrails, output validation against an external source of truth, and logging of every call. Self-checking is not on that list, because it cannot be. A system cannot validate itself against a fact it does not have.
The penalties are compounding, and the leniency window has closed
The escalation over three years is stark.
By early 2026 the largest US penalty on record was $110,204.38, in Couvrette v. Wisnovsky in the District of Oregon. Across three summary judgment briefs filed over five months, plaintiffs’ counsel submitted 15 fabricated case citations and eight fabricated quotations. The court imposed $15,500 against lead counsel Stephen Brigandi under Rule 11 and Local Rule 83-7, made a willful-violation finding against local counsel Timothy Murphy, and entered an amended fee award of $94,704.38 split 85/15 between them. The underlying case was dismissed with prejudice. The client lost the matter.
The aggravating factor in Couvrette was not the initial fabrication. It was that counsel repeatedly failed to acknowledge, correct or explain the fabrications after opposing counsel identified them in briefing. The same pattern drove the sanctions in Whiting, where the panel cited the attorneys’ defiance of the show cause order and prior discipline for lack of candor as reasons for the size of the award.
That is a consistent signal across both cases and it is worth stating plainly: courts are punishing the response far more severely than the error. In Q1 2026 alone, US courts imposed roughly $145,000 in AI-related sanctions. The database is currently growing by roughly eight documented decisions per day.
What the courts have actually held
There is a reading of this case law circulating in firm risk memos that treats AI as radioactive. That is not what the courts have said.
The Whiting panel did not reject the use of generative AI in research or brief writing. It placed AI use “comfortably within” existing federal and local rules and the court’s inherent authority, and treated it as not different or special. Its most consequential holding for firm policy is a narrower one: a court-ordered disclosure about whether AI was used, who wrote the brief, and how it was cite-checked does not violate attorney-client privilege or the work product doctrine.
Read those together and the obligation is clear. You may use these tools. You may be ordered to explain how you checked their output, and you cannot shield that explanation behind privilege. So the process by which your firm verifies citations is, functionally, a discoverable artifact. If it does not exist, that absence is what you will be explaining to a panel.
The fix is a verification layer, not a better prompt
Here is where the engineering answer and the intuitive answer diverge.
The intuitive answer is to write a better prompt, pick a more accurate model, or instruct the model to only cite real cases. None of these work, for the reason described above. You cannot instruct a system out of a limitation that is structural.
The answer that does work is unglamorous: a deterministic verification step that sits between the model’s output and the filing, and that checks every citation against an authoritative external database. Not a model checking a model. A lookup, against Shepard’s, KeyCite, CourtListener, or an equivalent, that returns a binary answer about whether the citation exists and resolves to the case named.
The strongest evidence that this is the correct shape of the fix comes from the person holding the most complete dataset on the problem. Damien Charlotin, having catalogued more than two thousand of these failures, built a tool called PelAIkan. It is an automated reference checker. He did not respond to the data by publishing a better prompting guide. He built a checker.
Two refinements matter for anyone specifying this.
First, existence checking is necessary but not sufficient. Recall that 845 of the logged decisions involve misrepresented authority: real cases, accurately cited, that do not support the proposition. A lookup catches fabrication and misses misrepresentation entirely. Closing that gap requires pulling the actual text of the cited passage and putting it in front of a human alongside the claim the brief makes about it. That step cannot be fully automated today, and any vendor telling you otherwise is selling you the failure mode you are trying to eliminate.
Second, none of this should be validated for the first time on live filings. In agent work we treat a sandboxed environment that mirrors production as non-negotiable before a system touches anything real, because edge cases surface in ways testing does not predict, and the tool calls are where actual consequences occur. The legal equivalent is running the verification layer against a corpus of closed matters, including briefs you know contain errors, and measuring what it catches before it stands between your associates and a court.
What this costs, and how to tell whether a vendor can build it
Firms evaluating this generally arrive with the wrong first question, which is what the software costs. The better question is what the verification layer costs, because that is the part that carries the liability.
Realistic AI agent development cost for a citation verification workflow integrated with a firm’s existing document management and research subscriptions sits well below the exposure in a single sanctions order like Couvrette. That is the comparison worth running. When you request AI automation agency pricing, insist that the quote separates the retrieval and drafting components from the verification and audit-logging components, and be suspicious if the second is a rounding error. It is the expensive, unglamorous half, and a proposal that treats it as an afterthought is describing a system that will fail the way the case law describes.
Whether you build internally or hire AI agent developers externally, there are two vendor patterns worth learning to recognise, because both are common in legal tech right now.
The first is a recognisable technical signature sold as something more than it is: a database, an API key to a commercial model, a set of documents embedded into a vector store, and a thin interface on top. That combination is genuinely useful for semantic search over a document set, and genuinely inadequate for the job it is usually sold as. It is then renamed after whichever vertical it is being sold into. Embed policy documents and it becomes a compliance agent. Embed case law and it becomes legal research AI. The stack does not change; only the label does. Retrieval is not reasoning. A system that finds the most similar passage to a query is not deciding anything and has no concept of being wrong.
You can test for this without understanding any of the code. Ask what the system does when it cannot find a relevant authority. A retrieval tool prompts you about phrasing. A real system tells you about its fallback path. Ask to see it complete an action rather than answer a question. If the demo ends there, you have your answer.
The second pattern is newer and catches sophisticated buyers. AI-assisted development has made polished demos cheap to produce, which broke the link between a working demo and the ability to build and maintain the thing. A convincing end-to-end walkthrough can now be produced by someone who could not debug it or extend it. The gap it hides is specific: error paths, retries, what happens when an upstream system returns something unexpected, and what the system does at 3am when nobody is watching. Projects following this pattern start strong and stall at the integration boundary, which in a law firm means the document management system, the billing system, and the research subscriptions.
Four questions surface it, and you do not need to understand the answers, only to notice whether they are immediate and specific or general and reassuring:
- What happens when the model returns malformed output in the middle of a multi-step task?
- Where does state live between steps, and what happens if the process dies halfway?
- What is the retry policy on a failed call, and how do you avoid running the same write twice?
- Who specifically will be debugging this at 3am, and are they employed by you?
Any competent custom AI agent development company answers all four in a sentence each. Whether you are assessing an AI automation agency for law firms or an in-house hire, the shape of the answer tells you more than its content.
The obligation has not changed
Nothing in this body of case law is really new law. Rule 11 did not change. The duty of candor did not change. Rule 38 did not change. What changed is that a tool arrived which produces confident, correctly formatted, entirely fictional authority at scale, and it reached lawyers, self-represented litigants, expert witnesses and judges at roughly the same time.
The 2,022 decisions in the database are not evidence that AI cannot be used in legal practice. Courts have said the opposite. They are evidence that a verification step which was previously implicit in how legal research worked, because finding a case meant the case existed, now has to be built explicitly, because generating a case does not.
The firms getting this right are not the ones with the strictest AI bans. They are the ones that can answer a show cause order describing exactly how a citation was checked, by what system, against what source, and with what result logged.
