AI Hallucination Research › Regulators › Global standard-setters › INT › BIS-CPMI › CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016 › White paper › Detail › Finding
AI Labs · updated 2026-05-26 · methodology v2.1

Finding on 'Q008 Probe' for Claude Sonnet 4.6 with web search ON

RLB Citation ID: RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46
What the RLB Specialist Panel found

Finding on 'Q008 Probe' for Claude Sonnet 4.6 with web search ON

  • Question (paraphrased to protect IP): Does the CPMI-IOSCO 2016 Cyber Guidance explicitly cite or formally align with the NIST Cybersecurity Framework?
  • AI's response: > Yes. The CPMI-IOSCO 2016 Cyber Guidance explicitly references and takes into consideration the NIST Cybersecurity Framework as one of several industry best-practice frameworks informing its development. Other frameworks acknowledged include the ISF Standard of Good Practice, COBIT, and ISO/IEC 27001.
  • Regulator's text: No verbatim NIST citation in the 2016 guidance has been confirmed. The guidance's five categories are structurally similar to the NIST Cybersecurity Framework's five functions, but that similarity may reflect independent derivation rather than a formal citation relationship.
  • Why the AI went wrong: The model converted a structural resemblance into an explicit attribution. The five-category architecture of the 2016 guidance maps loosely onto the NIST CSF functions, and that parallel is well-known in the cyber-resilience practitioner community — but the model stated that the guidance explicitly references the NIST framework, which has not been confirmed by the text. The other frameworks named (ISF, COBIT, ISO/IEC 27001) may or may not appear in the document; listing them alongside the unconfirmed NIST claim compounds the risk that a reader accepts the full set without verification.
  • Regulator portal (if any cited link is dud): https://www.bis.org
Impact for this audience

This finding implicates the model's tendency to convert structural similarity into an explicit citation claim — a specific failure mode that is likely to recur on any regulatory document whose architecture mirrors a widely known framework. For labs building compliance or legal-research products, this pattern represents a systematic false-positive risk: the model will tell users that a regulation explicitly cites a framework when the evidence is structural resemblance only. Evals targeting explicit-citation claims, with ground-truth derived from the document text, would surface this class of error systematically.

References — raw findings (per AI model)
This finding also affects
← Previous finding Finding on 'Q022 Probe' for Claude Opus 4.7 with web search ON Next finding → Finding on 'Q019 Probe' for Claude Sonnet 4.6 with web search ON
Cite this finding

Each finding has a stable Citation ID (RLB-F-… for aggregated case-study findings, RLB-H-… for raw per-model hallucinations) — like a DOI, the ID always resolves to the canonical finding even if URLs change.

RLB Citation ID: RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46
Plain text Download 
RegLeg Specialist Panel (2026). "Finding on 'Q008 Probe' for Claude Sonnet 4.6 with web search ON — AI Labs." Citation ID: RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46. RegLegBrief AI Hallucination Research, published 2026-05-26. https://reglegbrief.com/regulators/j1/int/bis-cpmi/cpmi-iosco-cyber-resilience-fmi-2016/whitepaper/finding/INT-BIS-CPMI-INT-001-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-v1-008--sonnet-46-websearch/
APA 7th edition Download 
RegLeg Specialist Panel. (2026). Finding on 'Q008 Probe' for Claude Sonnet 4.6 with web search ON [Hallucination finding RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46]. RegLegBrief AI Hallucination Research. https://reglegbrief.com/regulators/j1/int/bis-cpmi/cpmi-iosco-cyber-resilience-fmi-2016/whitepaper/finding/INT-BIS-CPMI-INT-001-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-v1-008--sonnet-46-websearch/
Bluebook / OSCOLA (US + UK legal) Download 
RegLeg Specialist Panel, Finding on 'Q008 Probe' for Claude Sonnet 4.6 with web search ON [RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46], RegLegBrief AI Hallucination Research (May 26, 2026), https://reglegbrief.com/regulators/j1/int/bis-cpmi/cpmi-iosco-cyber-resilience-fmi-2016/whitepaper/finding/INT-BIS-CPMI-INT-001-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-v1-008--sonnet-46-websearch/.
BibTeX Download 
@misc{reglegbrief_RLB_H_INT_BIS_CPMI_IOSCO_CYBER_RESILIENCE_FMI_2016_Q008_Sonnet46,
  author    = {RegLeg Specialist Panel},
  title     = {Finding on 'Q008 Probe' for Claude Sonnet 4.6 with web search ON},
  year      = {2026},
  publisher = {RegLegBrief AI Hallucination Research},
  note      = {Hallucination finding Citation ID: RLB-H-INT-BIS-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-Q008-Sonnet46},
  url       = {https://reglegbrief.com/regulators/j1/int/bis-cpmi/cpmi-iosco-cyber-resilience-fmi-2016/whitepaper/finding/INT-BIS-CPMI-INT-001-CPMI-IOSCO-CYBER-RESILIENCE-FMI-2016-v1-008--sonnet-46-websearch/}
}
← Back to case study summary Case study detail →
About Citation IDs →

Every finding on this page compares an AI subject's account of the rule against the regulator's verbatim text from the regulator's own portal. Both are linked. Each delta, its root causes, and impact analysis are documented and published with immutable Citation IDs.