AI subject tested: Claude Sonnet 4.6 (web search on)
Question (paraphrased): What level of operational detail does the 2016 CPMI-IOSCO Cyber Resilience Guidance provide for incident response and recovery, and how does that compare to subsequent international publications on the same topic?
AI response:
"Yes, the 2016 guidance does describe specific practices for the response and recovery phases... preparing communication and notification plans...conducting forensic analysis to understand the anatomy of a breach; maintaining a database recording cyber attacks"
Regulator verbatim text:
"FSB published 'Effective Practices for Cyber Incident Response and Recovery' in October 2020 — four years after d146. This contains operational detail for the Response and Recovery phase that goes beyond d146."
Failure mode: misattributed
Substrate document: p_10_REGULATION_FSB_Effective_Practices__2020____R_R_pra_eng.html
This finding documents a confirmed hallucination by Claude Sonnet 4.6 (web search on) on a probe of the regulation. The model's response was tested against the regulator's verbatim primary text and classified as misattributed. Full per-finding context is available via the linked Citation ID.
Each finding has a stable Citation ID (RLB-F-… for aggregated case-study findings, RLB-H-… for raw per-model hallucinations) — like a DOI, the ID always resolves to the canonical finding even if URLs change.
RegLeg Specialist Panel (2026). "What level of operational detail does the 2016 CPMI-IOSCO Cyber Resilience Guidance provide for incident response and re — AI Labs." Citation ID: RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46. RegLegBrief AI Hallucination Research, published 2026-06-07. https://reglegbrief.com/regulators/j1/INT/BIS-CPMI/CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016/whitepaper/finding/INT-BIS-CPMI-INT-001-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-v1-019--sonnet-46-websearch/
RegLeg Specialist Panel. (2026). What level of operational detail does the 2016 CPMI-IOSCO Cyber Resilience Guidance provide for incident response and re [Hallucination finding RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46]. RegLegBrief AI Hallucination Research. https://reglegbrief.com/regulators/j1/INT/BIS-CPMI/CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016/whitepaper/finding/INT-BIS-CPMI-INT-001-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-v1-019--sonnet-46-websearch/
RegLeg Specialist Panel, What level of operational detail does the 2016 CPMI-IOSCO Cyber Resilience Guidance provide for incident response and re [RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46], RegLegBrief AI Hallucination Research (June 07, 2026), https://reglegbrief.com/regulators/j1/INT/BIS-CPMI/CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016/whitepaper/finding/INT-BIS-CPMI-INT-001-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-v1-019--sonnet-46-websearch/.
@misc{reglegbrief_RLB_H_INT_BIS_CPMI_IOSCO_CYBER_RESILIENCE_FMI_2016_Q019_Sonnet46,
author = {RegLeg Specialist Panel},
title = {What level of operational detail does the 2016 CPMI-IOSCO Cyber Resilience Guidance provide for incident response and re},
year = {2026},
publisher = {RegLegBrief AI Hallucination Research},
note = {Hallucination finding Citation ID: RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q019-Sonnet46},
url = {https://reglegbrief.com/regulators/j1/INT/BIS-CPMI/CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016/whitepaper/finding/INT-BIS-CPMI-INT-001-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-v1-019--sonnet-46-websearch/}
}
Every finding on this page compares an AI subject's account of the rule against the regulator's verbatim text from the regulator's own portal. Both are linked. Each delta, its root causes, and impact analysis are documented and published with immutable Citation IDs.