Written by: Kamil Ponicki, Director of Talent Acquisition, Digital Colliers
Court cases involving AI-fabricated citations rose from 87 to over 1,300 in about eleven months through 2024. That's not a slow drift. That's an inflection. And most of the firms showing up in those case names weren't reckless, they were just relying on the same review habit they've relied on for twenty years: the drafting associate checks their own cites before it goes out.
That habit was fine when the failure mode was a typo in a reporter number. It's not fine when the failure mode is a plausible-looking case that doesn't exist.
The cost of doing nothing is already visible
Regulators are moving. The SRA in the UK published AI guidance back in November 2023, and every bar association in the US has now weighed in. ABA Formal Opinion 512 went further and told lawyers they can't bill hours the AI actually saved, which quietly reshapes the economics of any AI-assisted drafting workflow.
Meanwhile the sanctioned-attorney list keeps growing. If you're a managing partner, the risk stack now looks like this:
- A public sanction with your firm's name on it.
- Malpractice exposure on the underlying matter.
- A regulator conversation about supervision.
- A client conversation about why they're paying full rate for work an LLM drafted and nobody verified.
Any one of those is expensive. The combination is existential for a mid-sized practice. And none of it requires you to have done anything exotic. It only requires that one associate, on one late Thursday, trusted a tool that hallucinated with confidence.
What a citation-verification pipeline actually looks like
The fix isn't a new AI product. It's a small piece of internal plumbing that sits between the drafter and the filing. Four steps:
- Extract. Parse the draft. Pull every citation into a structured list. Case name, reporter, year, pincite, quoted language.
- Verify against canonical source. Hit Westlaw, Lexis, CourtListener, BAILII, whatever your jurisdiction uses. Confirm the case exists, the reporter is right, the quoted language actually appears at the pincite.
- Log to the matter file. Every check, every result, timestamped, attached to the document version. This is your supervision record when someone asks.
- Flag mismatches to a human reviewer. Not the drafter. A different human. That separation is the whole point.
That's it. No model training. No vector database. No procurement cycle for a legal-tech platform with per-seat licensing and an eighteen-month rollout.
Why this is a two-week integration, not an RFP
Here's where firms lose the plot. They treat this as a legal-tech buying decision, which means committee, demos, security review, pilot, and by the time it's live you've had three more hallucinated-cite incidents in the wild.
It isn't a buying decision. It's a data-integration project. You already have the pieces:
- Your DMS holds the drafts.
- Your research provider has an API.
- Your matter management system has a place to log events.
- Your reviewers already exist on payroll.
A competent engineer who understands legal workflows can wire those four together in roughly two weeks. The hard part isn't the code. It's deciding what counts as a mismatch worth flagging, and who owns the exception queue. Those are ten-minute conversations that firms turn into ten-week conversations.
What the operators getting this right look like
The pattern I keep seeing among firms who've handled this well: they stopped treating verification as a professional-responsibility question and started treating it as a pipeline question. The general counsel and the head of knowledge management sit down with one engineer. They map the drafting lifecycle. They pick the three highest-risk document types, usually briefs, motions, and memoranda going to clients. They ship verification for those first. Everything else comes later.
They also accept a truth that's uncomfortable in a billable-hours business: only about three of a lawyer's eight hours get billed anyway. Moving cite-checking off the associate's desk and onto a pipeline doesn't cost you billables. It costs you a task that was already leaking into non-billable time and creating tail risk on the way.
The firms that will show up on next year's sanctioned list aren't the ones that adopted AI. They're the ones that adopted AI and left verification as a prayer. The 87 became 1,300 in under a year. The next number is already being written.