Briefings Blog

Company Secretaries supporting boards exposed to the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) are increasingly using AI to draft board papers on the governance lineage of payment-system standards, generate director-onboarding notes on cross-border payments policy obligations, and prepare regulatory horizon-scanning entries on CPMI workstreams. The same tools validate the attribution of standard-setting authority in committee minutes.

Two frontier AI models tested by the RLB Specialist Panel on the workflows company secretaries use to support advice on the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) produced one discrete hallucination bound to regulator-issued source text. The Panel records a single recurring failure class: Source-Credit Fabrication across the set. Questions were prepared by the Specialist Panel based on real practical AI usage in the workflows company secretaries use AI for, and each finding is bound to verbatim regulator-issued source text held as primary substrate.

For Company Secretaries, each hallucination has a direct operational consequence in the board paper, director-onboarding note, or horizon-scanning entry. The Panel's testing surfaces CPMI working-group chair misattribution. Where these errors flow into a deliverable, the exposure is board-pack error that compounds across multiple committee cycles before it surfaces in a director question or supervisory review. The pattern is uniform across the set: the AI returns a confident, sourced-looking answer that conflicts in a load-bearing specific with the regulator's verbatim text, and the error survives a first-pass review precisely because the surface form is plausible.

The Panel records each hallucination with the regulator's primary substrate held as the anchor, so the corrective text is available alongside the failure.

The Specialist Panel records the citation IDs as follows: RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q004-Sonnet46 (Claude Sonnet 4.6 (web search on), Source-Credit Fabrication). Each citation links to the verbatim regulator-issued source text, the tested AI question, and the recorded AI response, so the Panel's assessment is traceable end to end. For company secretaries, the citation IDs operate as a reference index: when an AI answer in the working draft matches a known Panel finding, the cited regulator text is already available as the corrective anchor. The full per-finding analysis cards, including the audience-specific impact statement, sit on the cell's detail surface for sign-off use.

Accountants advising on the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) are increasingly using AI to model the ROI of ISO 20022 migration for client business cases, populate audit working papers with regulator-sourced inquiry-rate benchmarks, and validate adoption-rate citations in advisory deliverables. The same tools draft sections of client board memos that depend on official CPMI or FSB quantitative anchors.

Two frontier AI models tested by the RLB Specialist Panel on the workflows accountants use to support advice on the CPMI Harmonised ISO 20022 Data Requirements (Updated Report) produced three discrete hallucinations bound to regulator-issued source text. The Panel records two distinct failure classes, False-Negative Retrieval and Numeric Drift across the set. Questions were prepared by the Specialist Panel based on real practical AI usage in the workflows accountants use AI for, and each finding is bound to verbatim regulator-issued source text held as primary substrate.

For Accountants (CA/PA), each hallucination has a direct operational consequence in the audit working paper, advisory memo, or client board paper. The Panel's testing surfaces ISO 20022 adoption rate conflation (RTGS vs faster payments), missing inquiry-rate and resolution-time benchmarks, and ISO 20022 adoption rate conflation (RTGS vs faster payments). Where these errors flow into a deliverable, the exposure is misstated peer benchmark, weakened investment case, and credibility loss when clients verify the underlying source.

The pattern is uniform across the set: the AI returns a confident, sourced-looking answer that conflicts in a load-bearing specific with the regulator's verbatim text, and the error survives a first-pass review precisely because the surface form is plausible. The Panel records each hallucination with the regulator's primary substrate held as the anchor, so the corrective text is available alongside the failure.

The Specialist Panel records the citation IDs as follows: RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Opus47 (Claude Opus 4.7 (web search on), Numeric Drift); RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q007-Sonnet46 (Claude Sonnet 4.6 (web search on), False-Negative Retrieval); RLB-H-INT-BIS-CPMI-ISO-20022-HARMONISATION-UPDATED-2026-Q006-Sonnet46 (Claude Sonnet 4.6 (web search on), Numeric Drift). Each citation links to the verbatim regulator-issued source text, the tested AI question, and the recorded AI response, so the Panel's assessment is traceable end to end. For accountants (ca/pa), the citation IDs operate as a reference index: when an AI answer in the working draft matches a known Panel finding, the cited regulator text is already available as the corrective anchor.

The full per-finding analysis cards, including the audience-specific impact statement, sit on the cell's detail surface for sign-off use.

Professional engineers scoping projects that may touch areas beyond national jurisdiction are increasingly using AI to draft environmental impact assessment scoping documents, generate technical briefings for design teams on screening thresholds, and validate which provision of the BBNJ Agreement governs a particular obligation before submitting deliverables to clients or regulators.

The RLB Specialist Panel put a set of practitioner-grade questions on the BBNJ Agreement to two frontier AI models with web search active. Each question is prepared by the Panel based on the workflows that professional engineers actually use AI for under this treaty, covering the screening threshold for environmental impact assessments under Part IV, the temporal scope of the marine genetic resources and digital sequence information regime under Part II, the benefit-sharing duty for digital sequence information, and the non-undermining duty constraining Conference of the Parties decisions on area-based management tools under Part III.

The Panel then binds every AI response to verbatim regulator-issued source text held as primary substrate, comparing the AI output line-by-line against the deposited treaty text. Only responses where the AI subject was demonstrably wrong against the verbatim regulator-issued source text are published; responses that were substantively correct, or that refused on calibration grounds, are retained internally and not surfaced. On the BBNJ Agreement, the AI subjects returned a single hallucinated answer in the form of Source-Credit Misattribution for professional engineers.

For professional engineers scoping projects that may engage areas beyond national jurisdiction, citation accuracy in environmental impact assessment scoping documents is load-bearing. A scoping document that pins the screening obligation to the wrong article of the BBNJ Agreement will be challenged on first review by a regulator, a peer reviewer, or the client's own legal team. The substantive screening test the AI paraphrased may be the right test, but the citation will need to be reworked, and the engineer issuing the document carries professional responsibility for the accuracy of the regulatory reference framing the work.

The published Specialist Panel findings, with model attribution, carry the following citation identifiers, each hyperlinked to the bound regulator-issued source text on the BBNJ Agreement regulation hub. The audit register surfaces these findings for professional engineers so that any AI-assisted treaty citation, paraphrase, or rule-statement entering a deliverable can be re-validated against the deposited treaty text before the document is issued:

• RLB-H-INT-UNTC-BBNJ-HIGH-SEAS-BIODIVERSITY-AGREEMENT-2023-Q001-Opus47 (EIA screening threshold misattributed to wrong article)
• RLB-H-INT-UNTC-BBNJ-HIGH-SEAS-BIODIVERSITY-AGREEMENT-2023-Q001-Sonnet46 (EIA screening threshold misattributed to wrong article)

Lawyers advising on the BBNJ Agreement are increasingly using AI to draft 2-page client memos on benefit-sharing exposure, generate partner-level briefings on environmental impact assessment thresholds for high-seas activities, and validate treaty-citation language against the deposited Agreement text before issuing legal opinions.

The RLB Specialist Panel put a set of practitioner-grade questions on the BBNJ Agreement to two frontier AI models with web search active. Each question is prepared by the Panel based on the workflows that lawyers actually use AI for under this treaty, covering the screening threshold for environmental impact assessments under Part IV, the temporal scope of the marine genetic resources and digital sequence information regime under Part II, the benefit-sharing duty for digital sequence information, and the non-undermining duty constraining Conference of the Parties decisions on area-based management tools under Part III.

The Panel then binds every AI response to verbatim regulator-issued source text held as primary substrate, comparing the AI output line-by-line against the deposited treaty text. Only responses where the AI subject was demonstrably wrong against the verbatim regulator-issued source text are published; responses that were substantively correct, or that refused on calibration grounds, are retained internally and not surfaced. On the BBNJ Agreement, the AI subjects returned four hallucinated answers in the form of Inverted-Position Hallucination together with Source-Credit Misattribution for lawyers.

For lawyers issuing legal opinions, memoranda, and transactional documents that engage the BBNJ Agreement, treaty-citation accuracy is load-bearing: a counterparty, opposing counsel, or regulatory reviewer who can identify a citation error on first reading of the document calls the entire piece of advice into question.

An AI-drafted memo that points at the wrong article on a screening threshold, mis-states the direction of a benefit-sharing rule, or mis-locates the constraint on Conference of the Parties authority leaves the lawyer exposed to professional liability, the firm exposed to reputational risk, and the client exposed to commercial loss from a position structured on the wrong rule.

The published Specialist Panel findings, with model attribution, carry the following citation identifiers, each hyperlinked to the bound regulator-issued source text on the BBNJ Agreement regulation hub. The audit register surfaces these findings for lawyers so that any AI-assisted treaty citation, paraphrase, or rule-statement entering a deliverable can be re-validated against the deposited treaty text before the document is issued:

• RLB-H-INT-UNTC-BBNJ-HIGH-SEAS-BIODIVERSITY-AGREEMENT-2023-Q001-Opus47 (EIA screening threshold misattributed to wrong article)
• RLB-H-INT-UNTC-BBNJ-HIGH-SEAS-BIODIVERSITY-AGREEMENT-2023-Q001-Sonnet46 (EIA screening threshold misattributed to wrong article)
• RLB-H-INT-UNTC-BBNJ-HIGH-SEAS-BIODIVERSITY-AGREEMENT-2023-Q003-Opus47 (MGR retroactivity default inverted)
• RLB-H-INT-UNTC-BBNJ-HIGH-SEAS-BIODIVERSITY-AGREEMENT-2023-Q003-Sonnet46 (MGR retroactivity default inverted)
• RLB-H-INT-UNTC-BBNJ-HIGH-SEAS-BIODIVERSITY-AGREEMENT-2023-Q004-Sonnet46 (DSI benefit-sharing article misidentified)
• RLB-H-INT-UNTC-BBNJ-HIGH-SEAS-BIODIVERSITY-AGREEMENT-2023-Q005-Opus47 (Non-undermining clause attributed to wrong article)

Public auditors testing FMI cyber-resilience controls and audit clients exposed to the CPMI-IOSCO 2016 Cyber Guidance are increasingly using AI to draft testing programmes, populate working-paper regulatory criteria sections, and prepare management-letter findings citing the 2016 framework. In practice, AI is used to draft testing programmes for FMI cyber controls, populate the regulatory criteria section of audit working papers, prepare management-letter findings citing CPMI-IOSCO 2016 expectations, and generate cyber-control walkthroughs against the 2016 guidance categories.

That workflow places the regulator-issued text of the 2016 guidance, its 2018-2020 derivative standards, and its current operative status at the centre of every AI-generated deliverable for public auditors.

Two frontier AI models tested by the RegLeg Brief Specialist Panel produced confident, citable reconstructions of the CPMI-IOSCO 2016 Cyber Guidance (June 2016) that the regulator-issued primary text directly contradicts across nine findings spanning four failure classes: Source-Credit Fabrication (an asserted NIST Cybersecurity Framework citation that the 2016 guidance does not contain), Misattribution (the slogan 'secure the periphery, protect the core' located inside CPMI-IOSCO 2016 guidance or its 2018 wholesale-payments paper rather than the actual 2018 speech source), Anachronistic Cross-Reference (the 2016 guidance asserted as definitionally aligned with the November 2018 FSB Cyber Lexicon and the October 2020 FSB Effective Practices that postdate it), and Outdated Standing Claim (the 2016 guidance presented as the unchanged operative standard when CPMI-IOSCO has issued a May 2026 consultative document under active revision).

Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows public auditors use AI for. The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.

For public auditors testing FMI cyber controls, the failure pattern is operationally consequential. A regulatory-criteria section that records an asserted NIST CSF citation in the 2016 guidance documents the audit's reference framework on a wrong reading of the source. A testing programme that records the 2016 guidance as containing operational depth for forensic analysis or a cyber-attack database points the auditor at a specification level the 2016 text does not contain. A management-letter finding that records the 2016 guidance as the unchanged operative standard misstates the regulatory horizon at the reporting date.

The audit's nine findings are documented with immutable RLB Citation IDs. Representative entries include RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Opus47, and RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Sonnet46. The full audit is documented at the CPMI-IOSCO 2016 Cyber Resilience Guidance hub on RegLegBrief.com.