Too Many Hands on the File

A law firm sent a tribunal twenty pages of legal argument, single-spaced. The judge began checking the cases it cited. Four troubled him.

One matched a decision of his own, but it was cited as a High Court case, for a point that was no part of its reasoning. Two more he couldn't find as cited. For the fourth, as far as he could tell, no case with that citation even existed. He was careful. He added that he might be wrong about any or all of it.

But first he had a more basic question. Who wrote this?

The claim form carried the solicitor's name, and it was signed. The twenty pages carried the firm's name and a date. Nobody had signed them. So the judge asked the firm's compliance officer to name the author, in a signed statement, within a week.

The compliance officer? The solicitor himself. His first answer: a part-time trainee lawyer, working under supervision, drafted the argument.

Then, at the hearing, a different story. A "very junior caseworker," the solicitor now said, and not a trainee solicitor. Probably at the firm three or four months. Gone now. On the solicitor's account, the junior drafted the argument on his own, the solicitor wrote the statement of facts, and another member of staff would have filled in the claim form and signed it with the solicitor's name.

Which one? He couldn't say.

There was a spreadsheet, he told the tribunal, with the names of all the fee-earners who had worked on each case. The tribunal rose so he could get it. Then it looked.

No entry.

And other cases? The junior might have worked on two, three or four more, the solicitor suggested at different times. As he put it, "Nothing is for sure."

So there appears, the tribunal said, to be every likelihood that the junior worked on other files nobody had identified, and may have relied there, too, on false citations generated by AI. Here, he had. The tribunal records that the solicitor accepted it.

The price of a file with no names on it? Not one bad claim. Every file that hand might have touched.

Now count the hands on a file of your own.

Not the name on the cover. The hands. AI-prepared work often passes through more than one pair. A junior asks the AI. A senior reads the draft. Someone built the tool, and someone in the firm chose it. Somebody signs. And if it all goes wrong, an insurer may get the bill.

It isn't only a lawyer's problem. In California, the real estate regulator says that if an AI tool generates inaccurate information, misleading ads or improper messages to consumers, responsibility under current law rests with the licensee and their responsible broker. Not the technology provider.

In Australia, the state of Victoria gives its government buyers an example. A buyer hires a professional services supplier for a report, and expects the skilled staff listed in the tender to prepare it. Then it arrives. Its serious problems include factual errors and fake references. The supplier later admits that AI hallucinations led to them. It had no approval to use AI to write the report, and it kept no proper oversight of the AI.

A courtroom. A brokerage. A government buyer's desk.

Each comes back to the same thing. Whose work is it? When the stranger picks up your file, that's what they'll want to know before they ask how good the AI was. If you can't answer, you're where that solicitor stood, scrolling a spreadsheet for a name that isn't there.

I'll follow the hands from the desk outward. The insurer last.

Who Answers When the Junior Is Wrong

Most people would blame the junior. The tribunal didn't stop there. It accepted that the solicitor had an unblemished record of fifteen years, and that he genuinely regretted what happened. It referred him to his regulator anyway, for the false citations and for failing to supervise.

Why the supervisor? It would be easy, the tribunal says, to think this is a case about the naive use of generative AI. Not merely that, though. It is principally about supervision, and about the duty to make sure the tribunal is not misled. How the errors came about matters not. A "hapless trainee" or a chatbot, it's really neither here nor there. The qualified legal professional with conduct of the matter, the one in charge of the case, is expected to make sure the documents are checked, that errors are found, and that only accurate documents reach the tribunal.

The hand in charge answers. Not just the hand that typed.

Then it goes further. Who's more to blame? A lawyer who gets his own citations wrong, or a supervisor who lets a junior's false ones through? Most of us would say the first. The tribunal says the second is likely to be more culpable. The first fails the tribunal, the public and his client. The supervisor fails them too, and also fails to help junior lawyers develop.

Two climbing instructors, then. One ties a bad knot on a client's rope. That's a failure. The other lets a trainee tie the knot and never checks it. Same failure. Plus one more. The trainee doesn't learn.

Pass the work down, and keep the duty.

The tribunal gives the tools their due. Legal AI used by properly trained professionals, it says, is a step forward in legal practice. The software currently available is of enormous benefit in properly focused legal research. But there's a condition. Any practitioner who uses non-specialist AI for research or drafting has to check rigorously that what it gives is true and accurate.

And the paperwork has changed. The tribunal's claim form for judicial review, the decision says, has been amended to require the legal representative to confirm, by a statement of truth, three things about any authority cited in the form or in the documents attached to it. That it exists. That it can be found from the citation given. And that it supports the point of law it is cited for.

Sign it, and they're yours. A representative who signs that statement in a case where false authorities are cited, the tribunal says, should ordinarily expect to be referred to their regulator.

Remember the colleague the solicitor couldn't name, who would have signed the claim form? Under the new form, that signature would confirm all three things. Not in this case, though. Its papers came before the change.

It's one tribunal. It rules on lawyers who put papers before it, and on their duty not to mislead it. I don't think its logic stops at the courtroom door.

Step out of the courtroom, then, into a California brokerage. Brokers must reasonably supervise what happens under their license, the regulator says. AI doesn't alter that. A broker's duty to supervise reaches the tools too, AI-powered software included. Using AI to do licensed work, it adds, may be equivalent to asking an unlicensed assistant to do it, which is a violation of California real estate law.

Picture one more assistant at the desk. One with no license.

Fail to review what the AI produced, the regulator says, and the licensee could face discipline. Fail to reasonably supervise, and so could the broker. Two hands. Two duties. That's the tribunal's climbing rope, I'd say, in another trade.

Every firm has someone in the broker's chair, whatever the title on the door. Who sits there in yours? And do they know what the AI drafted under their name?

The Hands You Never Met

Some hands on your file belong to people you'll never meet.

They built the AI. They run it for you. They work for the supplier you hired. And by the logic of guidance that says nothing about professional advice, the answer can still land with you.

The UK's Competition and Markets Authority has guidance for businesses that use AI agents to deal with their customers. Consumer law, then. Yet it reaches the tribunal's place by another road. You are responsible for what an AI agent does, it says, in the same way you are responsible for what an employee does.

Even one you didn't build. That's true, the authority says, even if someone else designed or provides the AI agent on your behalf. If someone else is providing the AI, and you don't check that they've taken appropriate steps to train it, you may break the law. It wants a person in the loop, too, actively checking that the AI agent is making correct decisions and generating expected results.

Take a restaurant kitchen. One cook grills the fish. Another plates it. The fish came from a supplier you've never met. If it arrives spoiled, the diner doesn't ask whose station it came from. The restaurant answers.

By that logic, the supplier's fish is still your dish.

Now switch sides. Say you're the one buying the work, like the buyer in Victoria's example. AI may come into a contract after it is signed, the state's guidance warns, without the buyer knowing. So it gives buyers ways to guard against that. A buyer can require suppliers to disclose if and how they propose to use AI to deliver the work, or ban AI outright. A contract can carry a schedule of permitted AI uses, and then the supplier may use AI only as the contract states. Other terms can stop a supplier from bringing in new AI without the buyer's approval.

In banks and insurers, the chain can get long.

Germany's financial supervisor, BaFin, has written guidance on technology risk in the use of AI, for financial firms and in particular for banks and insurers. It's careful about what it is. Non-mandatory advice, it says. It defines no supervisory expectations, and it deals only with technology risks under the EU's law on digital operational resilience, known as DORA.

Start with the provider. Some points of an earlier statement on outsourcing to the cloud, the guidance says, can also apply to AI run in the cloud. One is that a firm should make a comprehensive risk assessment before it signs with a cloud provider. That assessment should also consider changes to the AI system, such as retraining the model. Even if all changes to the model are made by the service provider.

Someone else retunes the piano. You still need to know what changed.

Then the chain. In the same part, citing the EU law, it says there must be clear arrangements on whether, and on what conditions, the cloud provider may use further subcontractors. And where AI-specific subcontracting supports a firm's critical or important functions, such as specialized machine learning libraries, GPU farms and AI security services, it says, again citing the EU rules, that the firm must at all times keep an overview of which parties are involved in processing the data, where that happens, and how potentially long or complex chains of subcontracting may affect the process.

Potentially long or complex chains. That's a regulator's way of asking who all the hands are.

It isn't about who signs a client's file, and it calls itself advice. But it asks a firm the kind of question the tribunal had to put to a law firm. Who's in the chain? For the AI behind your own work, could you write the list?

When Everyone Owns a Piece

Inside a bank, the hands can be whole departments.

The ECB's bank supervisors have noticed. In a keynote speech given on February 24, 2026, and published on ECB Banking Supervision's site, the speaker names one concern its supervisors continue to encounter. Fragmented ownership. Responsibility, the speech says, is split across IT, data science teams, business lines and control functions, without a clear accountability framework.

That's one concern the speech names, not a verdict on every bank.

Four friends plan one trip. One books the flights. One books the hotel. One rents the car. One buys the tickets for the game. Then the flight moves a day.

It's nobody's job to tell the hotel.

That's fragmented ownership. Every part has an owner. The whole has none.

Japan's Financial Services Agency let the firms speak. Its discussion paper on AI in finance, published in March 2025, builds on a survey of financial firms, on interviews and on international discussions. It says it doesn't set out the agency's monitoring views or the specific actions it expects of firms. So the lines that follow are issues the firms raised, as the paper reports them. Not the agency's.

Even on the system side alone, firms told the agency, there are multiple parties concerned, such as basic designers, programmers and system maintenance managers. Several hands again. The scope of shared responsibility needs to be defined for each product and managed correctly. For example, whether each part is made in-house or outsourced, possibly to several outside firms.

And generative AI? A model that is hard to verify, they told it, makes it hard to investigate the cause of an incident, and hard to clarify the boundaries of responsibility. In a large-scale incident, it may cause serious confusion.

To me, this is where AI itself changes the question. A model that's hard to verify can blur the lines between the hands around it. Then who answers?

In your firm, if AI-prepared work went wrong tomorrow, which team would pick up the phone? All of them? None?

The Hand That May Pay

Every chain has a last link. Sometimes it's an insurer.

The Lloyd's Market Association's committee for international professional indemnity has written an article on AI and the international market for errors-and-omissions cover. The association announced it in a release dated September 18, 2025. It's fair to the tools.

Time first. Automating repetitive, conventionally time-intensive tasks lets people focus on higher-value work, it says, though it notes the potential risk of job losses for those hired to do that administrative work. Depending on the task, a model can analyze a whole data set instead of a sample. And it may even be, the article says, that AI reduces the number of errors and omissions, as unsupervised junior staff may be less accurate than a professional relying on generative AI. Stop on that last one.

The weak hand there may be the junior nobody supervised.

On to the underwriters. Policy wordings written on a liability basis don't distinguish between claims that involve generative AI and claims that don't, it says. So underwriters should consider whether they intend to cover losses from professional firms relying on inaccurate generative AI output. If they mean to exclude those risks, careful attention should go to defining generative AI and wording an appropriately specific exclusion.

Here's its example. An underwriter, the article says, may be prepared to cover human failure in not detecting the error. But not an issue with the insured's systems or software, which would generally fall to a cyber policy.

Go to a shop counter. Say the scale weighs wrong. That's one kind of fault. Say the cashier doesn't notice. That's another. The article's example draws a similar line inside a professional firm: an issue with the firm's own systems or software on one side, the person who didn't catch the error on the other. Whether a cyber exclusion reaches generative AI, it adds, depends on how it is worded.

The person, again.

Some questions stay open. If using the system is incidental to the professional service, the article says, a broad cyber exclusion may be ineffective. There are untested coverage issues about whether generative AI would be considered a professional service or a product. And if a firm built its own system and its wrong outputs are relied on, the article asks, is that more appropriately insured under a product liability policy?

And one story. In 2025, the article says, the solicitors' regulator approved the first AI-based law firm. Before approving it, the regulator had to assure itself that the firm's processes met its requirements, including a minimum level of insurance. And its decision was predicated on holding select named regulated solicitors within the firm accountable, should any system outputs go wrong.

It suggests questions, too. Many coverage matters, the article says, will also rely on fair presentation of the risk and on the questions underwriters asked about the firm's use of generative AI. Its example questions are illustrative only, it says, not complete, and would need adjusting for specific uses.

Imagine some of them landing on your desk. What is the purpose of the AI, and has the firm set out where it is of use and where it isn't? How were the tools selected, and how far were their terms and conditions reviewed for exposures such as ownership of the data? Is there an acceptable use policy, given to all employees and kept up to date? What training do staff get, and what procedures assess the outputs for accuracy? Is the use of any tool disclosed correctly to third parties? And the client? Has the client agreed to, or signed a contract confirming, the use of AI, and does that include limitations of liability?

Behind most of these questions stands a person. Who chose the tool. Who may use it. Who checks it. Who was told.

What the Underwriters Think, and Can't See

And the insurers themselves? In a survey of its members in mid-2025, the association invited answers on a long list of AI loss scenarios. Its summary reports on four.

One fits this book. Professional indemnity: AI produces erroneous advice or service to clients, causing a loss. Respondents felt this scenario was the most concerning of the scenarios reported on.

In that scenario, 89% of respondents felt that existing risk management or safety procedures were adequate, which the survey calls a high degree of confidence in insureds to manage the risks. Beside it stands another number. 58% of responses were of the view that losses from that kind of scenario might reach full policy limits.

Small counts, though. The summary keeps scenarios with at least six responses, and says some drew up to 19. It looked at loss potential only, not the benefits AI could bring insureds, insurers and reinsurers, which it says could be material. And across the scenarios it reviewed, concern among underwriters was, on the whole, only modest.

Then the commentary. The risks in this scenario, it says, aren't necessarily being considered a new exposure by the association's members. Reliance on AI, it goes on, may be analogous to reliance on, for example, junior staff producing tax calculations, legal research or technical drawings. The difference with AI might be a matter of scale.

There's the junior again.

The flip side? The benefits of AI, it says, cannot be fully realized if the output must be constantly overseen by human supervisors.

The survey is candid, too. Many respondents found its questions difficult to answer, it says. Insurers are remote to insureds' use of AI. It isn't always clear whether an insured uses AI in the ordinary course of business, and little data on AI usage is currently collected during underwriting. And there is a lack of claims data on AI's part in losses.

So, in most cases: views and opinions, not data.

It's like a weather forecast made without instruments. No sky in view. You say what you think.

So the insurer can't always tell whether a firm uses AI. It has to ask. Like the judge who had to ask who wrote the argument. When it asks you, what will your file say?

So Whose File Is It?

Count the hands one last time.

A junior, a solicitor and a colleague he couldn't name. One claim. A broker who answers for the AI's drafts. In Victoria's example, a supplier who used AI nobody approved. In some banks, teams that each own a piece, with no clear accountability framework for the whole. A chain of subcontractors, potentially long, behind a cloud provider. And at the end, an insurer who may not know whether AI was used, and has to ask.

Track a parcel online, and you see every hand it passed through. Picked up. Sorted. Loaded. Out for delivery. Nobody finds that strange. And if it goes missing, you know where to start looking.

Whoever signs the work should be able to point to every hand that touched it. The AI's included. And show where that's written down.

If the honest answer is a spreadsheet with no entry for the file? You know where you stand.

Then the money. The competition authority says a business that breaks consumer law could be fined, and possibly forced to compensate the consumers affected. Which policy pays for the AI's own mistakes isn't settled, as far as these documents go. The insurers' committee calls some of the coverage questions untested.

Remember that claim form. The change written into it wasn't a better chatbot. It was a signature that means something.

Buying the work? Put it in the contract. When may AI be used, and whose policy answers if the supplier's software causes an error?

And the upside? The competition authority itself says AI agents can help make a business model more productive and efficient, and can improve customers' experience. The insurers' survey calls testing and risk management by insureds key to keeping the risks at an acceptable level.

My reading: they ask for something simpler. Know who did what. And who checked.

Above the chain sits one more pair of hands. The board.

So who answers for the chain itself?