AI Hallucination Research › Briefings

Briefings Blog

The running blog from the RLB Specialist Panel delves into real-world scenarios where the compliance, legal, or AI lab team interacts with frontier AI models under specific regulations. The blogs are anonymised to remove client-specific details and include insights from the RLB team analysing the hallucinations experienced in AI models while working on these cases. For example, when a model returns a confident answer that contradicts the regulator's primary text, such as a fabricated staff letter, a wrong appendix, or an inverted scope, these issues are discussed here. Each blog explains one set of findings and what it would have meant for the team that would have acted on it, sans this research initiative. This blog is frequently updated, a few times a day.

263 briefings in the archive · Subscribe via Atom: /briefings/feed.xml (this blog) · /feed.xml (all RegLegBrief publications)
Audience colours: AI Labs Practitioner (profession) Sector × Department
Audience
Jur.
Regulator
Profession
Sector
Dept
Range
Sort
Per page
Showing 5 of 263 · page 36 of 53
Monday, 29 June 2026
Sector: Investment Banking and Dept: Operations INT BIS-CPMI

Investment Banking Operations teams: documentation and reporting gaps possible from AI reading of CPMI-IOSCO Cyber Resilience for FMIs (2016)

For Investment Banking Operations teams working with Guidance on Cyber Resilience for Financial Market Infrastructures (CPMI-IOSCO 2016): Specialist-Panel-verified findings on where AI summaries diverge from the...

Operations teams at investment banks running CCP-clearing and CSD-settlement participation are increasingly relying on AI to draft cyber-incident response runbooks for clearing-counterparty operations, generate operational-recovery playbooks, prepare resilience-testing scope documents, and update business-continuity briefings citing the CPMI-IOSCO 2016 framework. In practice, AI is used to draft cyber-incident response runbooks for clearing and settlement counterparty operations, generate operational-recovery playbooks citing CPMI-IOSCO 2016 expectations, prepare resilience-testing scope documents against the 2016 guidance categories, and update CCP/CSD-participant business-continuity briefings.

That workflow places the regulator-issued text of the 2016 guidance, its 2018-2020 derivative standards, and its current operative status at the centre of every AI-generated deliverable for investment-banking operations teams.

Two frontier AI models tested by the RegLeg Brief Specialist Panel produced confident, citable reconstructions of the CPMI-IOSCO 2016 Cyber Guidance (June 2016) that the regulator-issued primary text directly contradicts across nine findings spanning four failure classes: Source-Credit Fabrication (an asserted NIST Cybersecurity Framework citation that the 2016 guidance does not contain), Misattribution (the slogan 'secure the periphery, protect the core' located inside CPMI-IOSCO 2016 guidance or its 2018 wholesale-payments paper rather than the actual 2018 speech source), Anachronistic Cross-Reference (the 2016 guidance asserted as definitionally aligned with the November 2018 FSB Cyber Lexicon and the October 2020 FSB Effective Practices that postdate it), and Outdated Standing Claim (the 2016 guidance presented as the unchanged operative standard when CPMI-IOSCO has issued a May 2026 consultative document under active revision).

Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows investment-banking operations teams use AI for. The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.

For investment-banking operations teams, the failure pattern is operationally consequential. A cyber-incident response runbook that records the 2016 guidance as containing forensic-analysis-database operational depth points the operations team at a specification level the 2016 text does not contain. A resilience-testing scope document that records the 2016 guidance as the unchanged operative standard misstates the regulatory horizon at the testing-scope date.

The audit's nine findings are documented with immutable RLB Citation IDs. Representative entries include RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Opus47, and RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Sonnet46. The full audit is documented at the CPMI-IOSCO 2016 Cyber Resilience Guidance hub on RegLegBrief.com.

Guidance on Cyber Resilience for Financial Market Infrastructures... · View briefing card → · See finding details →
Sunday, 28 June 2026
Sector: Cybersecurity and Dept: Technology & Data INT BIS-CPMI

Cybersecurity Technology & Data teams: documentation and reporting gaps possible from AI reading of CPMI-IOSCO Cyber Resilience for FMIs (2016)

For Cybersecurity Technology & Data teams working with Guidance on Cyber Resilience for Financial Market Infrastructures (CPMI-IOSCO 2016): Specialist-Panel-verified findings on where AI summaries diverge from the...

Technology and Data teams at cybersecurity firms supporting FMI architecture reviews and cyber-tooling baselines are increasingly relying on AI to design architecture review documents, generate cyber-control-mapping artefacts, prepare configuration baselines, and draft architecture review papers against the CPMI-IOSCO 2016 framework. In practice, AI is used to design FMI cyber-resilience architecture review documents, generate cyber-control-mapping artefacts against the CPMI-IOSCO 2016 categories, prepare cyber-tooling configuration baselines citing the 2016 expectations, and draft cyber-architecture review papers for FMI client engagements.

That workflow places the regulator-issued text of the 2016 guidance, its 2018-2020 derivative standards, and its current operative status at the centre of every AI-generated deliverable for cybersecurity technology and data teams.

Two frontier AI models tested by the RegLeg Brief Specialist Panel produced confident, citable reconstructions of the CPMI-IOSCO 2016 Cyber Guidance (June 2016) that the regulator-issued primary text directly contradicts across nine findings spanning four failure classes: Source-Credit Fabrication (an asserted NIST Cybersecurity Framework citation that the 2016 guidance does not contain), Misattribution (the slogan 'secure the periphery, protect the core' located inside CPMI-IOSCO 2016 guidance or its 2018 wholesale-payments paper rather than the actual 2018 speech source), Anachronistic Cross-Reference (the 2016 guidance asserted as definitionally aligned with the November 2018 FSB Cyber Lexicon and the October 2020 FSB Effective Practices that postdate it), and Outdated Standing Claim (the 2016 guidance presented as the unchanged operative standard when CPMI-IOSCO has issued a May 2026 consultative document under active revision).

Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows cybersecurity technology and data teams use AI for. The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.

For cybersecurity-firm technology and data teams, the failure pattern is operationally consequential. An architecture review document that records the 2016 guidance as containing an explicit NIST CSF citation documents the engagement's reference framework on a wrong reading of the source. A cyber-control-mapping artefact that records the 2016 guidance as containing forensic-analysis-database operational depth points the client at a specification level the 2016 text does not contain.

The audit's nine findings are documented with immutable RLB Citation IDs. Representative entries include RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Opus47, and RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Sonnet46. The full audit is documented at the CPMI-IOSCO 2016 Cyber Resilience Guidance hub on RegLegBrief.com.

Guidance on Cyber Resilience for Financial Market Infrastructures... · View briefing card → · See finding details →
Sector: Corporate Banking and Dept: Technology & Data INT BIS-CPMI

Corporate Banking Technology & Data teams: documentation and reporting gaps possible from AI reading of CPMI-IOSCO Cyber Resilience for FMIs (2016)

For Corporate Banking Technology & Data teams working with Guidance on Cyber Resilience for Financial Market Infrastructures (CPMI-IOSCO 2016): Specialist-Panel-verified findings on where AI summaries diverge from...

Technology and Data teams at corporate banks designing FMI-gateway cyber controls and wholesale-payment cyber-resilience playbooks are increasingly relying on AI to design control documents, generate playbooks, draft architecture review papers, and prepare cyber-control mappings against the CPMI-IOSCO 2016 framework. In practice, AI is used to design corporate-payment FMI-gateway cyber-control documents, generate cyber-resilience playbooks for wholesale-payment-system access, draft cyber-architecture review papers citing CPMI-IOSCO 2016 expectations, and prepare cyber-control mapping documents against the 2016 guidance categories.

That workflow places the regulator-issued text of the 2016 guidance, its 2018-2020 derivative standards, and its current operative status at the centre of every AI-generated deliverable for corporate-banking technology and data teams.

Two frontier AI models tested by the RegLeg Brief Specialist Panel produced confident, citable reconstructions of the CPMI-IOSCO 2016 Cyber Guidance (June 2016) that the regulator-issued primary text directly contradicts across nine findings spanning four failure classes: Source-Credit Fabrication (an asserted NIST Cybersecurity Framework citation that the 2016 guidance does not contain), Misattribution (the slogan 'secure the periphery, protect the core' located inside CPMI-IOSCO 2016 guidance or its 2018 wholesale-payments paper rather than the actual 2018 speech source), Anachronistic Cross-Reference (the 2016 guidance asserted as definitionally aligned with the November 2018 FSB Cyber Lexicon and the October 2020 FSB Effective Practices that postdate it), and Outdated Standing Claim (the 2016 guidance presented as the unchanged operative standard when CPMI-IOSCO has issued a May 2026 consultative document under active revision).

Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows corporate-banking technology and data teams use AI for. The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.

For corporate-banking technology and data teams, the failure pattern is operationally consequential. A cyber-control mapping that records an asserted NIST CSF citation in the 2016 guidance documents the mapping foundation on a wrong reading of the source. An architecture review paper that records the 2016 guidance as the unchanged operative standard misstates the regulatory horizon.

The audit's nine findings are documented with immutable RLB Citation IDs. Representative entries include RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Opus47, and RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Sonnet46. The full audit is documented at the CPMI-IOSCO 2016 Cyber Resilience Guidance hub on RegLegBrief.com.

Guidance on Cyber Resilience for Financial Market Infrastructures... · View briefing card → · See finding details →
Sector: Retail Banking and Dept: Compliance INT BIS-CPMI

Retail Banking Compliance teams: documentation and reporting gaps possible from AI reading of CPMI-IOSCO Cyber Resilience for FMIs (2016)

For Retail Banking Compliance teams working with Guidance on Cyber Resilience for Financial Market Infrastructures (CPMI-IOSCO 2016): Specialist-Panel-verified findings on where AI summaries diverge from the...

Compliance teams at retail banks operating as participants in retail-payment systems and indirect participants in wholesale FMIs are increasingly relying on AI to update FMI-participation onboarding checklists, generate cyber-incident notification protocols for retail-payment gateway operations, and verify cyber-supervisory expectations against the CPMI-IOSCO 2016 source text. In practice, AI is used to update FMI participation onboarding checklists for retail-payment-system access, generate cyber-incident notification protocols for retail-payment gateway operations, validate cyber-supervisory expectations against CPMI-IOSCO 2016 source text, and prepare compliance reports on retail-payment FMI cyber-resilience exposure.

That workflow places the regulator-issued text of the 2016 guidance, its 2018-2020 derivative standards, and its current operative status at the centre of every AI-generated deliverable for retail-banking compliance teams.

Two frontier AI models tested by the RegLeg Brief Specialist Panel produced confident, citable reconstructions of the CPMI-IOSCO 2016 Cyber Guidance (June 2016) that the regulator-issued primary text directly contradicts across nine findings spanning four failure classes: Source-Credit Fabrication (an asserted NIST Cybersecurity Framework citation that the 2016 guidance does not contain), Misattribution (the slogan 'secure the periphery, protect the core' located inside CPMI-IOSCO 2016 guidance or its 2018 wholesale-payments paper rather than the actual 2018 speech source), Anachronistic Cross-Reference (the 2016 guidance asserted as definitionally aligned with the November 2018 FSB Cyber Lexicon and the October 2020 FSB Effective Practices that postdate it), and Outdated Standing Claim (the 2016 guidance presented as the unchanged operative standard when CPMI-IOSCO has issued a May 2026 consultative document under active revision).

Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows retail-banking compliance teams use AI for. The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.

For retail-banking compliance teams, the failure pattern is operationally consequential. A compliance checklist that records the 2016 guidance as containing an explicit NIST CSF citation imports a regulatory-criterion reference the source does not contain. A retail-payment cyber-incident notification protocol that records the 2016 guidance as containing forensic-analysis-database operational depth misstates the international standard's specification level.

The audit's nine findings are documented with immutable RLB Citation IDs. Representative entries include RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Opus47, and RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Sonnet46. The full audit is documented at the CPMI-IOSCO 2016 Cyber Resilience Guidance hub on RegLegBrief.com.

Guidance on Cyber Resilience for Financial Market Infrastructures... · View briefing card → · See finding details →
Sector: Payment Institutions and Dept: Operations INT BIS-CPMI

Payment Institutions Operations teams: documentation and reporting gaps possible from AI reading of CPMI-IOSCO Cyber Resilience for FMIs (2016)

For Payment Institutions Operations teams working with Guidance on Cyber Resilience for Financial Market Infrastructures (CPMI-IOSCO 2016): Specialist-Panel-verified findings on where AI summaries diverge from the...

Operations teams at payment institutions running payment-system access and FMI-gateway operations are increasingly relying on AI to draft cyber-incident response runbooks, generate operational-recovery playbooks, prepare resilience-testing scope documents, and update FMI-gateway business-continuity briefings citing the CPMI-IOSCO 2016 framework. In practice, AI is used to draft cyber-incident response runbooks for payment-system access, generate operational-recovery playbooks citing CPMI-IOSCO 2016 expectations, prepare resilience-testing scope documents against the 2016 guidance categories, and update FMI-gateway business-continuity briefings.

That workflow places the regulator-issued text of the 2016 guidance, its 2018-2020 derivative standards, and its current operative status at the centre of every AI-generated deliverable for payment-institution operations teams.

Two frontier AI models tested by the RegLeg Brief Specialist Panel produced confident, citable reconstructions of the CPMI-IOSCO 2016 Cyber Guidance (June 2016) that the regulator-issued primary text directly contradicts across nine findings spanning four failure classes: Source-Credit Fabrication (an asserted NIST Cybersecurity Framework citation that the 2016 guidance does not contain), Misattribution (the slogan 'secure the periphery, protect the core' located inside CPMI-IOSCO 2016 guidance or its 2018 wholesale-payments paper rather than the actual 2018 speech source), Anachronistic Cross-Reference (the 2016 guidance asserted as definitionally aligned with the November 2018 FSB Cyber Lexicon and the October 2020 FSB Effective Practices that postdate it), and Outdated Standing Claim (the 2016 guidance presented as the unchanged operative standard when CPMI-IOSCO has issued a May 2026 consultative document under active revision).

Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows payment-institution operations teams use AI for. The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.

For payment-institution operations teams, the failure pattern is operationally consequential. A cyber-incident response runbook that records the 2016 guidance as containing forensic-analysis-database operational depth points the operations team at a specification level the 2016 text does not contain. A resilience-testing scope document that records the 2016 guidance as the unchanged operative standard misstates the regulatory horizon at the testing-scope date.

The audit's nine findings are documented with immutable RLB Citation IDs. Representative entries include RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q014-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Opus47, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q020-Sonnet46, RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Opus47, and RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q022-Sonnet46. The full audit is documented at the CPMI-IOSCO 2016 Cyber Resilience Guidance hub on RegLegBrief.com.

Guidance on Cyber Resilience for Financial Market Infrastructures... · View briefing card → · See finding details →
↑ Back to top