The Firm That Audits Your AI Just Had Its AI Report Pulled for Fabricating the Facts

KPMG published a report on the excellence of agentic AI. The report was built on case studies that did not exist. The irony is no longer surprising — and that is the problem.

Sign up for my Substack daily AI newsletter here.

See my AI Training course portfolio for corporate Business Leaders here.

Article link: https://open.substack.com/pub/johanosteyn/p/the-firm-that-audits-your-ai-just?r=73gqa&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/

In October 2025, KPMG published a report titled Total Experience: Redefining Excellence in the Age of Agentic AI. It was a substantive, professionally produced piece of thought leadership from one of the world’s four largest professional services firms, a company whose entire value proposition rests on its credibility as an independent, rigorous, analytically trustworthy partner to the organisations it serves. The report claimed that UBS integrates AI agents across investment advisory, risk management, and compliance monitoring via a platform co-developed with Microsoft. It claimed that Swiss Federal Railways uses AI agents to plan and optimise passenger journeys. It claimed that Transport for London deploys AI agents to predict and manage congestion. It claimed that NHS Greater Manchester uses AI to manage patient triage and predict hospital readmissions.

None of those claims were true. UBS described them as factually incorrect. Swiss Federal Railways said the characterisation of its AI usage was not accurate. Transport for London said the claim was misleading. NHS Greater Manchester said the assertions did not align with the sources cited in the report’s own footnotes. Research group GPTZero reviewed the report forensically and found that only five of its 45 citations correctly pointed to the claimed source. The rest ranged from mangled and misleading to partially fabricated or too vague to verify. GPTZero told the Financial Times that the inaccuracies stemmed from AI hallucinations. KPMG pulled the report from its websites while it conducts an internal investigation.

A professional services firm used AI to write a report about AI. The AI fabricated the evidence that the report was built on. The firm published it anyway.

CONTEXT AND BACKGROUND

The KPMG incident is not isolated. It is the latest and most prominent entry in a pattern of professional services hallucination failures that has been building throughout 2025 and 2026. EY withdrew a report on loyalty rewards programmes last month after GPTZero identified fake footnotes and AI-generated errors. Deloitte refunded the Australian government after AI-generated content slipped into a taxpayer-funded report. Elite law firm Sullivan and Cromwell admitted in April that a bankruptcy filing it submitted contained numerous AI-generated inaccuracies, including misreadings of the US bankruptcy code. South Africa withdrew its entire national AI policy in April 2026 after at least six of its 67 academic citations were found to be AI-generated fabrications — journals that did not exist, articles that had never been written, authors who had never produced the research attributed to them.

The pattern is consistent across all of these cases: an organisation uses AI as a drafting and research tool, produces output that looks authoritative, skips or inadequately applies the human verification step, and publishes claims that are fictional. GPTZero has coined a term for what is happening at the citation level — vibe citing — the citation equivalent of vibe coding, in which AI generates references that have the appearance of credibility without the substance of accuracy. The sources look right. The formatting is correct. The journal names are plausible. The articles do not exist.

What makes the KPMG case qualitatively different from others in this pattern is the specific combination of who produced it, what it was about, and who was named in it. KPMG is not a startup or a small consultancy operating without established quality controls. It is a Big Four professional services firm with the institutional infrastructure, the professional obligations, and the reputational incentives to verify claims before publishing them. The report was specifically about AI adoption — a subject on which KPMG’s clients are making significant strategic and financial decisions — meaning the authors had every reason to be more careful about AI-generated errors, not less. And the organisations named in the fabricated case studies are among the most scrutinised financial and public sector institutions in the world. UBS is a regulated bank. The NHS is a public health system accountable to Parliament. Transport for London is a public body answerable to the Mayor of London.

INSIGHT AND ANALYSIS

The KPMG report’s failure has a precise cause, and KPMG’s own spokesperson identified it with more clarity than may have been intended. The firm expects all its people to follow its guidelines on the responsible use of AI, including human oversight to validate content and verify independent sources. That statement is the diagnosis. A report containing 45 citations, only five of which correctly pointed to their claimed sources, did not receive the human oversight the firm’s own guidelines require. The verification step that would have caught the hallucinations before publication — reading the cited sources, contacting the named organisations, checking the factual claims against primary evidence — was either skipped, inadequately applied, or trusted to the AI tool that produced the errors in the first place.

This is the institutional failure that the pattern of 2026 hallucination incidents reveals. Organisations are adopting AI tools for content production, research, and drafting at a rate that their quality control infrastructure was not designed to absorb. The efficiency gain AI offers is real and measurable. The oversight cost that efficiency gain requires is also real, but it is less visible and more demanding than the gain it produces. The result is a systematic pressure toward skipping or abbreviating the verification step — precisely the step that distinguishes AI-assisted professional work from AI-generated content published under a professional brand.

I have previously written about this dynamic — organisations that have comprehensive AI governance policies requiring human verification but fail to apply them in practice, and the accountability consequences that follow when the gap between policy and process becomes visible. The KPMG case is a precise illustration of that failure in a professional services context, where the credibility of the institution and the credibility of its content are inseparable — and where a spokesperson confirming that policies exist is not the same as evidence that those policies were followed.

The KPMG case extends that argument into the professional services sector and raises the stakes considerably. South Africa’s AI policy affected governance. KPMG’s report affects the strategic decisions of the clients who read it, the reputations of the organisations falsely named in it, and the credibility of the professional services model on which KPMG’s entire commercial proposition depends.

The specific harm the fabricated case studies could have caused is worth naming. The organisations named in a KPMG thought leadership report as exemplars of AI adoption are not passive subjects. They are named as validation — as evidence that the approaches the report describes work in practice. An executive at a competitor bank reading KPMG’s report would have had reason to believe that UBS had achieved a particular level of AI integration in investment advisory and compliance. A transport authority reading the report would have had reason to believe Transport for London had successfully deployed AI for congestion management. Those false beliefs could have informed real procurement decisions, real investment cases, and real board approvals — all built on case studies that were invented.

IMPLICATIONS

For boards and executives, the KPMG incident raises three questions that go directly to AI governance.

The first is about external intelligence. Every organisation that uses thought leadership from professional services firms — management consultancies, accounting firms, strategy advisers — to inform its AI strategy needs to ask, in the current environment, whether the factual claims in those documents have been independently verified or are built on AI-generated foundations that the producing firm did not check. That is not a hypothetical question. It is a current and documented risk, and the answer cannot be assumed from the brand name on the cover.

The second is about internal production. If KPMG, with its institutional resources, professional standards framework, and reputational incentives, could publish a 45-citation report with 40 citations that do not support their claimed content, the question of what your organisation is producing under similar conditions is not a comfortable one. Every internal report, board paper, strategy document, or client-facing deliverable produced with AI assistance carries the same hallucination risk that the KPMG report demonstrated. The difference is whether the human oversight step that KPMG’s own guidelines required — and did not receive — is being applied in your organisation before the document leaves the building.

The third is about the professional services relationship itself. KPMG is not only an adviser to the organisations whose AI governance it helps to design. It is increasingly a producer of AI-using systems and AI-generated content on those organisations’ behalf. The incident raises a governance question that clients of all four major professional services firms should now be asking: what are the AI use protocols in the work this firm produces for us, what verification processes apply to AI-generated content in that work, and what recourse do we have if a hallucination makes it into advice that influences a board decision?

The Register’s coinage of vibe citing is useful because it names the mechanism precisely. AI generates plausible-looking references. The human who should verify them trusts the plausibility. The content is published. The fabrication is discovered by an external researcher rather than an internal reviewer. That sequence is not unique to KPMG. It is the sequence that produced every hallucination scandal in this pattern, from South Africa’s AI policy to EY’s loyalty report to Sullivan and Cromwell’s bankruptcy filing. The prevention is not a new AI tool. It is a more rigorous application of the human judgment that every one of these institutions already has policies requiring.

CLOSING TAKEAWAY

There is a particular irony in the KPMG incident that deserves to be named directly. The report that fabricated case studies about AI adoption was a report whose purpose was to build confidence in AI adoption. It was designed to demonstrate that AI is delivering real value in real organisations. What it demonstrated instead is that AI can produce authoritative-looking content that has no relationship to reality, and that the institutions most expected to catch that problem before publication are capable of missing it entirely.

The organisations best positioned to avoid this outcome are not the ones that have stopped using AI for content production. They are the ones that have built verification protocols proportionate to the risk of what they are producing — that treat the human oversight step not as a courtesy check but as the professional obligation it has always been, and that understand that the efficiency AI offers in drafting is only a genuine gain if the accuracy that makes the draft worth publishing is preserved through the process that follows.

Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net