In May 2026 EY Canada published a cybersecurity report whose citations were mostly AI-fabricated. A Big-4 firm — not your aunt trying ChatGPT. The problem is structural: AI sounds confident even when wrong. What that means for your business.
1. What hallucination really is
An LLM predicts the most likely next word. When knowledge is missing it picks what sounds plausible — not what's true. Result: fabricated URLs, non-existent numbers, invented court cases, case law that never happened. It looks factual because it's factually structured.
2. Where small business is already burned
- Customer emails with invented prices, guarantees or delivery terms
- Product descriptions with wrong technical specs — liability risk
- Legal texts (privacy, terms) generated without GDPR check
- Financial reports where AI 'intelligently' interprets numbers — wrongly
3. The 4 verification levels (by risk)
- Level 1 — Low risk (ideas, brainstorm): AI output directly OK, end-user = you
- Level 2 — Medium (internal docs): AI writes, human reads before circulation
- Level 3 — High (customer output): AI writes, human checks, plus automated claim verification (e.g. prices against DB)
- Level 4 — Critical (legal/financial): AI as helper only, not as source — domain professional accountable
4. Concrete verification patterns we build
In client projects we build 3 standard verification layers into AI features:
- Schema validation — force AI output into a JSON structure, parse error = retry
- Fact-check against your own data — AI claims €299? Check against price list DB, mismatch = block
- Second model as reviewer — Claude checks GPT-4 output, or vice versa, with explicit 'find contradictions' prompt
5. What to do today
- No AI text directly to customer without review — not even when time-pressed
- Always double-check numbers — AI numbers are probability distributions, not facts
- Disclaimer on AI assistants — 'responses generated by AI, not legal advice'
- Keep an audit trail — which prompt, which model, which output — so you can reproduce problems
6. The EY report lesson
If a Big-4 firm with large teams and compliance departments gets AI-fabricated citations into a published report, it'll happen to your 5-person small business too — unless you build in explicit verification. Not 'we pay attention' but a process you can't skip.