What Actually Happened
Deloitte submitted a 237-page report to the Australian government. It contained fabricated court quotes, invented academic references, and books that don't exist. One independent researcher found up to 20 errors. The result: a partial refund of A$97,587 from a A$440,000 contract — and a disclosure that Azure OpenAI GPT-4o had been used to fill 'traceability and documentation gaps,' a fact that was hidden until external pressure forced it out.
The full breakdown is documented here. Read it before your next AI-assisted client deliverable goes out the door.
Why This Is a Supply-Chain Problem, Not Just a PR Problem
The Deloitte failure wasn't a rogue prompt or a junior analyst going off-script. It was a process gap: AI output moved through a 237-page document without a verification layer calibrated to catch hallucinated citations. The model filled gaps confidently. No one checked.
This is the default failure mode when teams adopt AI for research or synthesis tasks without redesigning the review workflow around AI's specific failure patterns. LLMs confabulate citations with the same fluency they produce accurate ones. Standard editorial review — reading for coherence and argument quality — doesn't catch it. You need a dedicated citation-verification pass, and it needs to be mandatory, not optional.
The financial exposure is now quantifiable. A$97,587 is the floor, not the ceiling — that figure reflects only the portion of the contract the government clawed back. It excludes reputational cost, remediation hours, and the downstream damage to Deloitte's AI credibility in the Australian public sector. For a mid-market firm, a similar incident on a smaller contract could be proportionally more damaging.
The Process Fix Is Straightforward
If your team is shipping AI-assisted deliverables — to clients, to boards, to regulators — you need three controls in place now:
1. Declare AI use internally before it's discovered externally. The disclosure problem in the Deloitte case compounded the citation problem. Build an internal log of which deliverables used AI and how.
2. Add a citation-verification step as a hard gate. Every source referenced in an AI-assisted document gets independently confirmed before the document leaves the building. Assign it explicitly; don't assume it's happening.
3. Scope AI to tasks where hallucination risk is low. Summarization, formatting, and drafting from provided source material carry lower risk than synthesis across sources the model retrieves or generates. Know the difference and route accordingly.
The Deloitte case gives you a concrete number to put in front of any stakeholder who thinks verification overhead isn't worth the cost. It is — and now you can prove it.