48 invented judgments: three workflows in which every statement brings its source reference

Starting point: 48 citations that do not exist

On 10 February 2026 the criminal chamber of the High Court of Justice of the Canary Islands fined a lawyer 420 euros. In an appeal submission he had cited 48 authorities, judgments of Spain’s Supreme Court and a report by the country’s judicial governing council, which do not exist. The court records that a general AI tool was used rather than one built for the law, and that the cross-check against the official case law database never happened. It sets the size of the fine at half the approximate annual cost of a subscription to an AI tool built for legal work. The ruling also went to the bar association at which the lawyer is registered.¹

It did not stay a single case. On 7 July 2026 the labour chamber of the High Court of Justice of Galicia imposed 1,800 euros on a lawyer whose submission carried 24 citations that were invented, distorted or unrelated to the case; there too the court took its bearings from the annual cost of a tested legal tool.³ Cases of this kind are known from several European countries, and the duty behind them is older than the tools. As early as 9 September 2024 the First Chamber of Spain’s Constitutional Court formally reprimanded a lawyer for quoting verbatim from 19 decisions of that court, not one of which existed.⁴ For the judiciary itself, the Consejo General del Poder Judicial, the self-governing body of the Spanish courts, issued an instruction in January 2026 that requires real, conscious and effective human control over every use of such systems.⁵

From the other direction comes a recommendation that leaves many businesses at a loss. On 27 January 2026 the Spanish data protection authority published ten recommendations on handling AI tools. For work it advises sticking to your own organisation’s information and security rules and entering nothing that would give away confidential data about the company, its staff or its customers.⁶ It names no alternative. Anyone who follows that advice and still wants to work with their own documents needs a place where those documents are allowed to sit.

Now to the official surveys, because they refute a convenient thesis. According to the Banco de España business survey of around 6,300 companies, 19.9% use an AI system, 60% of them only on a trial basis and a mere 6% intensively. The obstacle in first place is a shortage of skilled staff at 45.8%, then excessive cost at 40.8% and the availability of a company’s own data at 37.8%. Regulatory hurdles including data protection were on the list of options as well, and landed behind those three.² For the first quarter of 2025 the national statistics institute counts 21.1% AI use among companies with ten or more employees; among the smaller ones it is 13.4%, but counted only on those with an internet connection, and 79.9% of them have one.⁷ Anyone telling the story that regulation is holding Spain back is writing past these figures. The bottleneck is knowledge, and knowledge grows where an answer can be checked.

Who is affected: five groups that need a source reference

The question of where a sentence comes from is rarely a matter of taste. Behind it there is usually someone who has to answer for that sentence: before a court, before a regulator, before customers or before their own management. That is why the source reference is not an extra but the part of the answer that makes it usable at all.

Spain’s business structure makes the subject broader than it first sounds. As at 1 January 2025 the national statistics institute counted 3,310,824 active companies. 54.4% of them had not a single employee, and 95.1% stayed below ten.⁸ At that size there is no IT department to assess a tool, approve it and monitor it. There is one person finishing something off in the evening.

That data protection is no side note here shows in the authority’s annual figures: 30,931 complaints in 2025, up 64% on the year before, and fines totalling 48,108,765 euros.⁹ These figures cover data protection as a whole and not artificial intelligence in particular; we do not present them as AI statistics. They describe the setting into which a tool is introduced.

What connects the five groups below is not the sector but the kind of responsibility. At the end stands a statement that someone puts their name to. For statements like that, an answer without a source reference is not half as good, it is unusable.

Use case 1: the knowledge base in which every statement shows where it stands

Your company puts its documents into a knowledge base: contracts, instructions, minutes, handbooks, the correspondence on a matter. Someone asks which notice period applies to a particular type of contract. What comes back is not a smooth paragraph but an answer with the place it comes from behind it: document, section, passage of text. One click opens that passage in its context.

The difference lies not in the wording but in the checkability. An answer without an origin has to be believed. An answer with an origin can be checked, and checked at the place itself. That is exactly the step missing in the court cases described above, and exactly the step that turns a tool for drafting text into a tool for work.

The limit here: a knowledge base is only as good as its contents. If an outdated version sits in it, that version gets quoted with a source reference and looks more credible for it than before. Whoever puts documents in has to settle which version applies and who maintains it. That is work, and it cannot be handed over to a model.

Use case 2: an outside document against your own documents

A draft contract, an audit report or the new version of a rulebook comes in. The question is the same every time: what in it departs from what applies here? You set the outside document beside your own knowledge base. What comes back is a list of divergences: covered, open, contradictory, and for every line the place on both sides, in the outside text and in your own.

This task shows why the source reference has to sit on both sides. A divergence only becomes a divergence once someone has read the two formulations side by side. If one side is missing, what remains is an assertion nobody can retrace, and the check starts again from the beginning.

The limit here: the result is a pointer and not a decision. A language model can miss a divergence or invent one that is not there, and the longer the texts get, the more readily that happens. In regulated areas the list replaces neither the qualified professional nor the internal sign-off. This article is no substitute for legal advice.

Use case 3: the draft that stays recognisable as a draft

At some point the check turns into a text: a statement of position, an answer to a customer, an internal note. The AI colleague puts up a draft, and visibly as a draft. Every statement taken from your documents carries its source with it, and the source can be unfolded. Anything formulated without a basis in your documents is marked as such.

The gain lies in the order of reading. Someone handed a finished text reads it for style. Someone handed a draft with sources to unfold reads it for sources. That second posture is the one missing in the court cases. The design of a tool can encourage it, it cannot compel it.

The limit here: a draft does not become correct by showing sources. What counts is that someone opens them. Where deadlines press, that is exactly what gets skipped, and no tool can prevent it. Anyone introducing this workflow should plan the check in as a step of the work and not as a good intention.

Limits: what a source reference does not do

The most important sentence in this article is the most uncomfortable one. Source references do not prevent invented answers. They make them checkable. A language model produces text that sounds plausible, and it does so even when the basis is missing. Human control remains mandatory, and that is exactly what the courts say: the High Court of Justice of the Canary Islands speaks of a breach of the fundamental duty of human oversight, which it calls indispensable whenever AI tools are used, and requires such systems to be treated as an aid and never as the deciding authority.¹ Anyone who promises you something else at this point is selling you a certainty that does not exist.

On top of that comes an error harder to spot than a freely invented source. A language model can also attach a source reference to the wrong place: the document exists, the section exists, only it does not carry the statement. In the Galician proceedings part of the criticised citations were of exactly that kind, formally present and unrelated to the case in substance.³ From that follows a plain rule: the source has to be opened, not merely present. A source reference that nobody clicks on is decoration.

On the state of the law, without turning it into advice. In Spain a bill on the governance of artificial intelligence has been tabled, published in the official gazette of the Congress of Deputies on 12 June 2026; it is in parliamentary deliberation and is not law in force.¹⁰ The European directive on network and information security, NIS2 for short, is not transposed into Spanish national law; on 8 July 2026 the European Commission therefore took Spain, together with three other member states, to the Court of Justice of the European Union.¹¹ We therefore claim neither that your company meets one of these requirements with our tool, nor that it would already have to meet them today. Check that for your own case, and if in doubt with your trade association. This article is no substitute for legal advice.

And now the awkward point, the one about money. The state programmes with which small Spanish businesses financed their digitalisation are taking no new applications at present. The large digitalisation programme closed its final two calls on 31 October 2025, by its own account with around 850,000 supported businesses and more than 3.4 billion euros.¹² That does not make it finished. An order of 26 January 2026 amended the funding rules: they now run until the funds are fully used up, unspent budget has to flow back into the same programme, and credit left over from a closed call has to go to applicants who previously missed out only because the money had run out. New calls are expressly possible.¹² None was open at the beginning of September 2026. The programme for subsidised digital consulting took its last applications back in March 2025 and has been in settlement since.¹³ Whoever starts today cannot rely on an open procedure and pays for it themselves for the time being. That argues for a low entry price and for free self-hosting: the LibreChat base is MIT licensed, and the repository with our extensions is coming soon. Only self-hosting presupposes IT competence, and by the official figures that is precisely what these businesses lack most.² We do not resolve this contradiction. For a business without its own IT, managed operation is the more honest route, even though it costs money.

Finally, what we do not claim. Kisuno does not compile an inventory of all the AI systems in your company, it sees only what runs through itself. It does not create human oversight, it makes it demonstrable. Managed operation meets no requirement that calls for customer-held keys without provider access; only self-hosting can do that. And the Green data centres in Lupfig are certified to ISO 27001, which is that operator’s certification and not ours.

Frequently asked questions about source references, knowledge bases and proof

Sources

All figures, quotations and dates in this article come from the sources below, last checked in September 2026. They are official Spanish and European bodies throughout; where a sample is stated, we name it.

1. Consejo General del Poder Judicial, notice of 13 February 2026 on the ruling of the Tribunal Superior de Justicia de Canarias of 10 February 2026, fine of 420 euros for 48 inaccurate citations, set at half an annual subscription to an AI tool built for legal work: poderjudicial.es
2. Banco de España, The adoption of artificial intelligence in Spanish companies, Boletín Económico 2025/T2 no. 6, business activity survey of around 6,300 companies, fieldwork from 11 to 25 November 2024, published on 7 May 2025: bde.es
3. Consejo General del Poder Judicial, notice of 15 July 2026 on the ruling of the labour chamber of the Tribunal Superior de Xustiza de Galicia of 7 July 2026, fine of 1,800 euros for 24 inaccurate citations: poderjudicial.es; the ruling itself, Auto 61/2026 in case 5472/2025, speaks of citations that either do not exist, have nothing to do with the matter in dispute or are simply made up: poderjudicial.es
4. Tribunal Constitucional, Nota informativa no. 90/2024 of 19 September 2024 on the ruling of the First Chamber of 9 September 2024, formal reprimand for verbatim quotations from 19 decisions that do not exist: tribunalconstitucional.es
5. Consejo General del Poder Judicial, Instrucción 2/2026 of 28 January 2026 on the use of artificial intelligence systems in judicial activity, published in the Boletín Oficial del Estado on 30 January 2026: boe.es
6. Agencia Española de Protección de Datos, ten recommendations on protecting privacy when using AI tools, published on 27 January 2026: aepd.es
7. Instituto Nacional de Estadística, survey on the use of information technology and electronic commerce in enterprises, year 2024 and first quarter 2025, final data of 22 October 2025, around 15,000 companies with ten or more employees surveyed and around 10,000 smaller ones; the 21.1% refers to all companies with ten or more employees, the 13.4% exclusively to the smaller ones with an internet connection, whose share is 79.9%: ine.es
8. Instituto Nacional de Estadística, central business register DIRCE, as at 1 January 2025, published on 11 December 2025: ine.es
9. Agencia Española de Protección de Datos, annual report 2025, 30,931 complaints and fines totalling 48,108,765 euros: aepd.es
10. Congreso de los Diputados, Proyecto de Ley Orgánica on the good use and governance of artificial intelligence, bill 121/000096, published in the Boletín Oficial de las Cortes Generales on 12 June 2026, state of deliberation as at 2 September 2026: congreso.es
11. European Commission, press release of 8 July 2026 on the action against Ireland, Spain, France and the Netherlands before the Court of Justice of the European Union for failure to transpose Directive (EU) 2022/2555 (NIS2): ec.europa.eu
12. Red.es, notice of 31 October 2025 on the closing of the last two calls of the Kit Digital programme, by its own account around 850,000 supported businesses and more than 3,400 million euros: red.es; Orden TDF/39/2026 of 26 January 2026 amending Orden ETD/1498/2021, Boletín Oficial del Estado no. 25 of 28 January 2026: Article 4 keeps the funding rules in force until the funds are fully used up, Article 6(3) obliges Red.es to return unspent budget to the same programme, and Article 28(8) requires, once a call has been settled, new award proposals in favour of applicants whose applications could not be granted only because the available credit had run out: boe.es
13. Red.es, notice of 18 June 2025 on the Kit Consulting programme, application deadline expired in March 2025, more than 17,400 grants approved: red.es