The sentence that started it
On May 7, 2025, in a protest of a sole-source order that was already academic because the agency had terminated it, GAO added a passage that had nothing to do with the procurement. The protester had confirmed that its representative was not a licensed attorney and had relied on AI-assisted tools. Several of the decisions the protest cited could not be located at all.
GAO did not impose a penalty. It did something more consequential: it announced that it could.1
“[O]ur Office necessarily reserves an inherent right to dismiss any protest and to impose sanctions against a protester, where a protester's actions undermine the integrity and effectiveness of our process.”
That sentence has been cited in nearly every decision on this subject since. Our corpus2, measured 15 months after it, holds 25 decisions from GAO and the Board that address fabricated or misrepresented authority, and 4 of them cost the filing party something other than a warning.
This piece is about what those decisions actually say, because the lesson most people have taken from them is the wrong one. And then it is about the harder question they raise for anyone selling AI into this market, including us: what would have to be true of a system before you are willing to put your name on its output.
First, a check on our own corpus
Before trusting a count of our own, it is worth testing it against a count somebody else published. A bid protest litigator writing in the November 2025 issue of NCMA's Contract Management magazine reported that across the four months from May through August 2025, roughly seven percent of GAO's publicly reported decisions involved some apparent misuse of AI, out of ninety-nine decisions.
We ran the same window against our own database without looking at that article's case list. Our corpus holds 95 GAO decisions in that window and 7 of them address the citations, which is 7.4%.
Reproducing somebody else's number from your own data is the cheapest test of whether your corpus is complete. It is also the one nobody runs, because a corpus that quietly misses a fifth of the record answers every question fluently and wrongly.
With that established, here is the whole series. The bars count decisions; the line is those decisions as a share of everything GAO published that quarter.
Note what the rate is not doing. It is not climbing steadily. It moves between roughly three and seven percent and stays there. The interesting change over these fifteen months is not frequency. It is severity.
The patience ran out in stages
Read in order, the decisions are GAO and the Board working out what to do about a problem neither had seen before, and steadily deciding to do more.
August 2025. A protester who had already been warned once came back with more bad citations. GAO said the errors were “far removed from mere typographical or scrivener's errors” and bore the hallmarks of a large-language model used without verification. It warned the protester a second time.
September 2025. The same protester filed three more. This time GAO catalogued the problem into three kinds: citations to decisions that do not exist, holdings attributed to decisions that never held them, and real decisions cited for propositions they do not support. The most striking example was a citation assembled out of one real protester's name and a different real protest's file number, followed by a holding invented to match. GAO dismissed all three protests as an abuse of its process. Not on the merits. On the citations.
October 2025. The Board took its turn, and the filer was a law firm. The Army Corps of Engineers moved to strike a post-hearing reply brief containing 48 false or misleading citations: 29 to the hearing transcript, 12 to the Rule 4 file, and 7 to caselaw. Counsel admitted using AI. The Board treated the motion as one for sanctions under Rule 11,3 struck the entire brief, and denied leave to file a corrected one.
February 2026. Two decisions five days apart moved the warning from the client to the lawyer. In one, GAO advised counsel rather than the protester. In the other it went further and put bar referral on the record.
“We therefore advise attorneys appearing before our Office that the citation of non-existent authority may result in referral to appropriate bar associations or other disciplinary bodies.”
March 2026. The Board showed both edges of its discretion in a span of ten days. In one appeal it refused the government's request to dismiss the case outright, calling dismissal the severest sanction it can issue, and instead struck the offending surreply and denied leave to amend it, citing ten admitted nonexistent cases across three briefs and a lack of candor about how they got there. Ten days later, in a different appeal, it addressed every party appearing before it:
“We caution the parties that the current generation of AI tools are known to sometimes create materially false characterizations of legal precedent, misquote cases, and even create non-existent case citations. Thus, any party which uses AI tools to assist in drafting filings before the Board is expected to take independent steps to ensure the accuracy of such filings and may be subject to appropriate sanctions if their filings mischaracterize the law, misquote cases, or cite to nonexistent cases.”
July 2026. A pro se4 joint venture moved for partial summary judgment on a roofing warranty and cited five cases. Four of them did not exist. The Board granted the government's motion for sanctions and struck the fabricated citations along with every contention that rested on them.
The appellant won its summary judgment motion anyway, on the contract language, which is worth sitting with. Its argument was right. Its authority was fiction. Those are separate failures, and only one of them was survivable.
The comfortable story is wrong
The comfortable story is that this happens to small businesses filing without a lawyer, using a free chatbot, and that a firm with a real legal research subscription is not exposed. The record does not support it.
It is true that most of these filings arrived without a lawyer, and there is a structural reason GAO sees the pattern first: it lets a company protest without counsel, where the Court of Federal Claims does not. But 7 of these 25 filings came from counsel of record at named firms, and both of the ASBCA briefs that were struck were signed by lawyers.
The most instructive one is a February 2026 protest where counsel, asked to explain three citations GAO could not locate, confirmed that they had used a commercial legal-research AI assistant sold to law firms, and acknowledged that some of the citations it produced were erroneous. The attorney had even spotted some irregularities and corrected them. Not all of them.
A paid legal-research assistant grounded in a real case database still put citations into a federal filing that GAO could not find. Buying a serious tool does not transfer the checking obligation to the vendor. Nothing does.
Neither GAO nor the Board takes the accusation on faith either, which matters if you are on the receiving end of one. In July 2025 the Army alleged that an appellant had improperly used AI to generate attacks on government personnel. The Board read the filings, compared them to the leading court decision on the subject, and found nothing even remotely approaching that conduct. The allegation failed. “This looks like AI” is not self-proving, and a tribunal that reaches for the record rather than the adjective is doing exactly what you would want.
Three different failures wearing the same coat
“Hallucinated citation”5 is doing too much work as a phrase. Reading the decisions, there are at least three distinct failures, and they have different fixes.
One: the case does not exist. This is the famous one and the easiest to catch. Every decision GAO and the Board publish is free and public. GAO said so directly, and pointed at its own website. Anyone with fifteen minutes can check a citation list.
Two: the case exists and says something else. Harder to catch, and in this record at least as common. A real decision, correctly cited, offered for a proposition it does not support. GAO put this in its own category and treated it as equally serious, because from GAO's side the effect is identical: a reader has to open the case to find out. One decision described a citation built by merging a real party's name with an unrelated protest's file number, then a holding written to fit. A citation checker that only asks “does this exist” passes that.
Three: the citation is to YOUR record, and it is wrong. This is the one almost nobody talks about, and it is the one that cost a law firm its brief. Of the 48 defective citations in that reply brief, 41 were not caselaw at all. They were citations to the hearing transcript and to the Rule 4 file: testimony from witnesses who never testified, documents not in the record, and citations past the final page of a transcript volume that ends at page 116.
No legal research product on earth can catch the third failure, because it is not about caselaw. It is about whether the model correctly described your own hearing transcript. The only thing that catches it is a check that runs against the document the claim came from.
That third category is the reason we build the way we do, so it is only fair to point the same test at ourselves.
What has to be true before you sign it
The right conclusion from 25 decisions is not that contractors should stop using AI. GAO and the Board have each said the opposite in almost the same words: there is nothing inherently wrong with competently using these tools. The conclusion is narrower and more useful.
The accountability never moves. It sits with whoever signs the filing. So the only question worth asking about a tool is how much of the checking it does for you, and how much of that checking you can see.
Four requirements follow from that, and each of them is testable.
1. It answers from a corpus you can open
A model asked what GAO held in a given case answers from what it absorbed during training, a compressed and lossy memory of the internet, and it cannot tell you where its memory ends and its pattern-completion begins. A grounded system retrieves6 the actual document at question time and answers from that.
Our retrieval runs entirely over stored rows: 12,484 decisions held with their verbatim text across GAO protests, ASBCA appeals, Court of Federal Claims opinions and SBA appeals, plus 10,141 regulation sections, chunked into 113,010 embedded passages so a citation lands on a passage rather than on a whole document.
2. Citations are records the system holds, not text the model wrote
This is the structural fix for the first failure mode. In our agentic workflows,7 a citation is not a string the model types into a sentence. Each grounded tool call8 that returns a document also registers that document as a numbered citation record, and the source rail beneath a report is built from those records. A marker in the text that resolves to no record is counted as unresolved rather than silently rendered, and the rail lists only the sources the answer actually used, renumbered.
When we A/B tested two models in three configurations through our GAO protest drafting workflow on the same solicitation, every arm produced 13 citations with zero unresolved and invented no file numbers. That was not a difference between the models. It is a property of the plumbing, which is the point: correctness on citation existence should be the floor, not a feature.
3. Something deterministic runs after the model finishes
This is the requirement almost nothing in the market meets, and it is the one that addresses the second and third failure modes.
When our system generates an analysis of a decision, a pure function runs afterward over the output.9 It takes every citation, every quotation and every dollar figure the analysis emitted, and string-matches each one back against that decision's own extracted text. Quotations are tested verbatim. Citations are tested in a normalized form that tolerates the spacing and punctuation damage that text extraction10 introduces. Each item is stamped verified or not-found, the ratio is stored as a grounding score,11 and the badge is shown in the interface next to the item.
Here is what that check has found across the whole corpus.
The number worth arguing about is the quotation column. On the GAO corpus, where the source is captured HTML, verbatim quotations confirm at 95.3%. On the ASBCA corpus, where the source is a PDF and some of the older ones are scans, they confirm at 80.0%. Same verifier, same models, same prompts. What changed is the quality of the text we extracted.
So most of those 3,002 unconfirmed ASBCA quotations are almost certainly real quotations that failed a character-exact test because a hyphen broke across a line or a two-column page was read across. We could raise the number tomorrow by loosening the test.
We do not loosen it, because the check has no way to tell an extraction artifact from an invention, and a check that guesses in the system's favor is not a check. It says “not found in the source” and puts that in front of you.
Corpus-wide the score is 92.6% confirmed. Median grounding score per analysis is 1.00 on the ASBCA side, with 3,075 of 4,542 analyses fully confirmed, and mean 0.92. The distance between the median and the mean is where the scanned PDFs live.
4. It is auditable, and it says when it does not know
Every AI surface in this platform is listed on a register, 39 entries today, and each one writes its model, its task type and its measured token usage to an audit table12 as it runs. A test in the build fails if a surface invokes a model without being registered, which is the difference between an audit trail and an audit trail with holes in it. The same telemetry is what lets us publish per-run costs instead of estimating them.
The counterpart is what happens when the corpus is silent. A view whose underlying data has not been built renders an honest “not available” with a link out to the publisher, rather than a fluent paragraph. That is a deliberate architectural rule and not a courtesy, because a system that fills gaps with prose is exactly the system that writes a citation to a case that does not exist.
What this does not do
A vendor unwilling to say where the line is has not found it. Ours:
- The check tests traceability, not soundness. It confirms that a quoted sentence appears in the decision and that a cited case is named in it. It has no opinion on whether the argument built from them is any good, whether the case is still good law, or whether the strongest authority was missed entirely. A perfect grounding score on a bad argument is a perfectly traceable bad argument.
- It cannot verify a claim about a document we do not hold. If a claim rests on your contract file, your transcript or your correspondence, the verifier can only test it against text you actually put in front of it. The third failure mode above is catchable in principle and only for documents in the record.
- The corpora have edges, and the edges are not uniform. We hold 822 Court of Federal Claims opinions and 1,191 SBA appeals with text, but scoped to contract disputes and size and status appeals. We found zero AI-citation decisions in either, and that is a statement about our scope, not about the court or the office. The Court of Federal Claims decision GAO and the Board cite most, Sanders v. United States, 176 Fed. Cl. 163 (2025), is not in our corpus, because it is not a contract dispute.
- A drafted filing is a draft. Our protest workflow computes the filing clocks deterministically in code against 4 C.F.R. part 21 rather than asking a model, because a date is not a judgment call. Everything above that line is a starting document for a professional to review, and nothing in the product is a substitute for counsel. Nothing on this page is legal advice either.
- 25 decisions is a small number. The quarterly rate moves on counts of two to six. Do not read a trend line into it. The severity ladder is the durable finding; the rate is not.
The questions, and how to make a vendor answer them
These four questions separate the categories of tool without requiring you to evaluate anyone's model. Ask them of us too.
| Ask | How we answer it | Where to check |
|---|---|---|
| Where do the substantive answers come from, and can I open the source? | Retrieval runs over 12,484 decisions held with their verbatim text plus 10,141 regulation sections in our own database, chunked into 113,010 passages. Nothing is answered from an open-web index. | Open any cited decision from the answer. The link goes to the publisher's own page or PDF, so you can read the document the system read. |
| Does every citation in the output resolve to a record the system actually holds? | Workflow tools emit citations as structured records, not as text the model writes. The source rail lists only the citations the answer actually used, renumbered, and an unresolved marker is counted rather than quietly rendered. | The sources rail beside any workflow report. Every numbered marker in the text has an entry there, and a marker that resolves to no record is reported as unresolved rather than quietly dropped. |
| What runs AFTER generation, deterministically, before I see the output? | A pure verifier string-matches every citation, quotation and dollar figure back against the source document. Corpus-wide that is 51,431 claims tested and 3,811 refused, each one stamped and shown as unconfirmed rather than dropped silently. | The case analysis itself. Each citation, quotation and dollar figure carries its own verified or not-found badge, and the record carries the grounding score those badges add up to. |
| Can I reconstruct what the system did, and does it tell me when it does not know? | Every AI surface is on a register (39 entries) and writes its model, task type and measured token usage to an audit table. A corpus-dependent view renders an honest "not available" with a link out rather than filling the gap with prose. | The AI Audit Trail in your dashboard. Every run on your account is listed with its task, the model that ran it and its measured token count. |
Two answers should end a conversation. The first is a refusal to name the corpus, because a vendor that cannot tell you what its system is allowed to read cannot tell you what it is allowed to invent. The second is a claim that hallucination has been solved. Nothing in this record was caused by a model that was bad at its job. Every one of them was caused by fluent output that nobody opened the case to check.
The full ledger
Every decision behind the numbers on this page, with a link to each one so you can do exactly what GAO and the Board keep telling people to do. This is the same corpus our product searches.
| Date | Decided by | Docket | Filed by | Action taken |
|---|---|---|---|---|
| May 7, 2025 | GAO | B-423447 | Without counsel | Warned. GAO states for the first time that it reserves an inherent right to dismiss a protest and impose sanctions where citations undermine its process. The protester confirmed its representative was not a licensed attorney and had relied on AI-assisted tools. |
| Jun 27, 2025 | GAO | B-423398 | Without counsel | Warned. Parties, including those without counsel, must accurately summarize the decisions they cite. Sanctions reserved, not exercised. |
| Jul 7, 2025 | GAO | B-423326.2 | Without counsel | Warned. The protester acknowledged the citation did not correspond to any published GAO decision and had been introduced by AI-based software. |
| Jul 15, 2025 | ASBCA | ASBCA 64036 | Without counsel | Allegation rejected. The Army alleged improper AI use. The Board reviewed the filings and found NOTHING approaching the conduct described in the court's leading case. The accusation failed. |
| Jul 25, 2025 | GAO | B-423630 | Without counsel | Warned. The agency argued the protest rested on nonexistent decisions bearing the hallmarks of AI generation. Dismissed for failure to state a claim. |
| Aug 13, 2025 | GAO | B-423524.2 | Without counsel | Warned. Second citation warning to the same protester. GAO found the errors far removed from typographical error and bearing the hallmarks of a large-language model. |
| Aug 26, 2025 | GAO | B-423635 | Without counsel | Warned. Faulty citations addressed in a footnote; dismissed on interested-party grounds, so the sanction right was not exercised. |
| Aug 29, 2025 | GAO | B-423583 | Without counsel | Warned. The intervenor moved to dismiss over citations to nonexistent decisions. GAO could not locate three cited decisions and asked the protester to produce them. |
| Sep 25, 2025 | GAO | B-423649 | Without counsel | Dismissed for abuse. Three protests dismissed as an ABUSE of GAO's process. GAO found fabricated decisions, fabricated holdings, and citations that did not stand for the propositions asserted, after two prior warnings. |
| Oct 23, 2025 | ASBCA | ASBCA 62591, 62783 | Counsel of record | Brief stricken. 48 false or misleading citations in one post-hearing reply brief: 29 to the hearing transcript, 12 to the Rule 4 file, 7 to caselaw. Counsel admitted using AI. The ENTIRE reply brief was stricken and leave to refile denied. |
| Nov 24, 2025 | GAO | B-423810 | Without counsel | Warned. Citation irregularities noted; sanctions not imposed, protester advised. |
| Dec 22, 2025 | GAO | B-423881 | Without counsel | Warned. Erroneous citations bearing the hallmarks of a large-language model, including decisions belonging to an unrelated firm with a similar name. |
| Jan 28, 2026 | GAO | B-424064 | Counsel of record | Warned. The protester's response failed to address the basis for its inaccurate citations. Three pages of the decision address the citations rather than the procurement. |
| Jan 28, 2026 | GAO | B-423989 | Without counsel | Warned. Citation warning attached to a denied protest. |
| Feb 12, 2026 | GAO | B-423943 | Counsel of record | Warned. Counsel confirmed using a commercial legal-research AI assistant and acknowledged that some of the citations it produced were erroneous. |
| Feb 13, 2026 | GAO | B-423967 | Counsel of record | Counsel warned. Counsel acknowledged the response included citations to nonexistent caselaw. GAO advised COUNSEL, not the client, that future filings may result in sanctions. |
| Feb 18, 2026 | GAO | B-424006 | Counsel of record | Bar referral warned. GAO advised attorneys appearing before it that citing nonexistent authority may result in REFERRAL to bar associations or other disciplinary bodies. |
| Mar 13, 2026 | ASBCA | ASBCA 63878 | Counsel of record | Brief stricken. The government sought dismissal with prejudice. The Board declined that, but struck the surreply and denied leave to amend, citing ten admitted nonexistent cases across three briefs and a lack of candor about how they got there. |
| Mar 23, 2026 | ASBCA | ASBCA 64064 | Without counsel | Warned. The appellant acknowledged using a generative AI program and that one cited court decision did not exist. The Board issued a corpus-wide caution and pointed to its own published AI policy. |
| Mar 26, 2026 | GAO | B-424081.2 | Without counsel | Warned. Cases produced on request carried different citation information from the cases cited, did not stand for the propositions asserted, or did not exist. |
| Apr 15, 2026 | GAO | B-423066.2 | Without counsel | Warned. GAO could not locate a decision matching the citation or the proposition; the protester called the errors inadvertent. |
| Jun 16, 2026 | GAO | B-424382 | Counsel of record | Warned. Erroneous citations bearing the hallmarks of a large-language model; protest denied on the merits. |
| Jul 13, 2026 | ASBCA | ASBCA 64164 | Without counsel | Sanctions granted. Four of the five cases cited, 80 percent, were fictitious. The Board GRANTED the government's motion for sanctions and struck the citations and every contention resting on them. |
| Jul 31, 2026 | GAO | B-424433.22 | Without counsel | Warned. The Army argued the protest bore indicia consistent with a large-language model. One nonexistent citation and one wholly irrelevant one, after a partial withdrawal. |
| Aug 11, 2026 | GAO | B-424433.3 | Without counsel | Noted. The Army asserted the protester's argument relied on an apparently AI-hallucinated quote that omitted text from the SBA regulation it cited. GAO reminded the protester to check AI-produced citations. |
20 GAO decisions and 5 ASBCA decisions, May 7, 2025 through Aug 11, 2026. Filed-by is read from each decision's own appearance line: 5 of 20 at GAO and 2 of 5 at the Board carried counsel of record. Party names are deliberately not listed; each one is public record in the linked decision, and the subject of this ledger is what GAO and the Board did, not a roster of filers. The protest outcome is not listed either, because a protest dismissed on timeliness with a citation footnote and a protest dismissed for abuse of process are not the same event, and the last column is where that distinction lives.
What we would tell a contractor
Use the tools. GAO and the Board have both said there is nothing wrong with that, and neither is anti-technology: the Board publishes its own policy on AI use and cites it in its decisions.
Then do the three things the record says matter. Open every case you cite, because they are free and public and GAO or the Board will notice before you do. Read enough of each one to know it says what you claim it says, since the second failure mode passes an existence check. And check the citations to your own record hardest of all, because that is the category that got a law firm's brief struck and no research product can catch it for you.
When you are choosing software, ask the four questions. The gap between a tool that retrieves and a tool that verifies is invisible in a demo and shows up in a footnote of a decision.
You are not accountable for what the model said. You are accountable for what you filed. The only useful thing a system can do about that gap is close as much of it as possible in code, then show you exactly what it could not close.
Footnotes
The vocabulary used above, defined for the reader who lives in the FAR rather than in model documentation.
- 1.Sanctions. A penalty a tribunal imposes for conduct that abuses its process, separate from losing on the merits. At GAO and the Board that has meant striking a brief, dismissing the case, and referring the lawyer to a disciplinary body. GAO has no procedural rule granting it this power, so it grounds the authority in an inherent right to manage its own affairs. ↩
- 2.Corpus. A defined, stored body of documents a system is allowed to answer from. The distinction that matters is whether it is a fixed set you can enumerate and open, or the open internet as remembered by a model during training. ↩
- 3.Rule 11. The Federal Rule of Civil Procedure under which signing a filing certifies that its legal contentions are warranted. The Board's own rules contain no equivalent, so it looks to Rule 11 for guidance, and Rule 11's instruction that a sanction be limited to what deters repetition is why the Board struck a brief rather than dismiss the appeal outright. ↩
- 4.Pro se. Appearing without a lawyer. GAO permits it, which is part of why the pattern surfaces at GAO first: the Court of Federal Claims requires a company to be represented by counsel, and GAO does not. ↩
- 5.Hallucination. An AI model stating something that is not true with the same fluency it states something that is. It is not a malfunction the model can detect: a language model predicts plausible text, and a citation that looks exactly like a real one is, to the model, a success. This is why the failure is invisible in review unless somebody opens the case. ↩
- 6.Retrieval. Fetching the actual text of a document at question time and putting it in front of the model, instead of relying on what the model absorbed in training. Retrieval is necessary for grounding and is not sufficient for it: a system can retrieve the right document and still write a citation that is not in it. ↩
- 7.Agentic workflow. A model given tools and allowed to work in rounds rather than answering in one shot: it requests a document, reads what came back, requests the next thing, and finally writes. The tools are what connect it to real records, which is why what the tools are allowed to return is the whole ballgame. ↩
- 8.Tool call. One request from the model to a function the application exposes to it, such as fetching a section of the FAR or searching the decision corpus. The application executes the request and hands back the result. A model cannot invent the contents of a tool result; it can only misdescribe one, which is what the post-check is for. ↩
- 9.Deterministic verification. A check written in ordinary code, not asked of a model. It runs the same way every time and has no opinion. Here it is string matching: does this quotation appear in the decision, does this citation appear in the decision, does this dollar figure appear in the decision. A model asked to grade its own output is not this. ↩
- 10.Text extraction. Pulling the readable text out of a PDF. It is lossy in ordinary, boring ways: a hyphenated line break, a two-column layout read across, a scanned page with no text layer at all. This is why a quotation can fail a verbatim check for reasons that have nothing to do with the model, and why the honest thing is to flag it rather than to guess. ↩
- 11.Grounded, and a grounding score. Grounded means every substantive claim traces to a retrieved source. The grounding score here is the blunt arithmetic version of that: the share of an analysis's citations, quotations and dollar figures that a deterministic check located in the source document. It measures traceability, not whether the argument is any good. ↩
- 12.Audit trail. A durable record of what the system did: which surface ran, which model, how many tokens, for which account, at what time. It is what makes a claim about system behavior checkable after the fact rather than a matter of trust. ↩
Disclaimer. This article is provided for informational purposes only. It is engineering and market commentary on public decisions and published rules, not legal, financial or professional advice, and reading it creates no attorney-client or advisory relationship with GovConDash or its author. The decisions it discusses are public record and are linked in the ledger above; read a decision in full before relying on anything said about it here, because a summary is not the decision. The counts, rates and verification figures are measurements of one database on the date stated and will change as the corpus grows. Nothing on this page is a prediction of how GAO, the Board or any other tribunal will treat a filing, and anyone facing a filing decision of their own should consult qualified counsel.
GovConDash.ai
Search the corpus that GAO keeps citing
GovConDash holds 12,484 GAO, ASBCA, Court of Federal Claims and SBA decisions with their verbatim text, reads the same federal award record the year-end spending analysis is measured from, and cites the record behind every AI answer it gives you. Free to start.