By Lynn Räbsamen, CFA | Advisory Board Member, CFA Institute | Author, Artificial Stupelligence
Earlier this week, PwC became the fourth of the Big 4 caught publishing reports built on citations that do not exist. Deloitte, EY and KPMG were already there. The set is complete.
Tomorrow, on 2 August 2026, the EU AI Act’s content disclosure rules take effect.
The timing could hardly be worse for them.
Most coverage has framed Article 50 as a rule about deepfakes and chatbots. It is. But one of its four limbs covers text, and it arrives at the exact moment the industry that sells expertise has been caught outsourcing it.
What actually starts tomorrow
Article 50 applies from 2 August 2026. Breaching it costs up to EUR 15 million or 3% of the offender’s global annual turnover, whichever is higher. Four situations trigger a duty. Three concern machines imitating people. Number 4 concerns writing.
| Trigger | Who owes it | What is required |
| AI interacting directly with people | Provider (OpenAI, Anthropic, Google…) | The system must say it is a system |
| Synthetic audio, image, video, text | Provider (OpenAI, Anthropic, Google…) | Machine-readable marking |
| Emotion recognition, biometric categorisation | Deployer (the consultancy, the bank…) | Inform those exposed to it |
| Deepfakes, and text published to inform the public on matters of public interest | Deployer (the consultancy, the bank…) | Visible disclosure at first exposure |
Number 4 is plainly worded: deployers of an AI system that generates or manipulates text published to inform the public on matters of public interest must disclose that the text was artificially generated or manipulated.
The rule does not ask whether AI wrote it. It asks whether the reader was told.
Three tests. A published report clears all three.
The Commission sets three cumulative criteria. None of them is a close call for thought leadership.
| Criterion | The threshold | A published consulting report |
| Published | Accessible to an indefinite, relatively large readership. Internal documents and private messages fall outside. | Yes, once it sits on a website |
| Informing the public | The purpose is to inform | Yes, that is the stated point |
| Matter of public interest | Public administration and services, public health, environment, consumer safety, and economic, financial, scientific or cultural developments open to public debate | Yes, that is the entire subject catalogue |
A confidential report for a single client stays outside the rule. Everything published to win that client does not.
The record, in one table
| Firm | Document | Subject | Finding | Response |
| Deloitte | Report for Australia’s Department of Employment and Workplace Relations, AU$440,000 | Employment services | Fabricated references and a fabricated quote from a court judgment | Refunded A$97,000; AI use disclosed in the revision |
| Deloitte Canada | Workforce plan for Newfoundland and Labrador, C$1.6m | Public health staffing | Citations to sources that appear not to exist | Denies AI use; stands by the recommendations |
| EY | Report on loyalty rewards programs | Consumer economics | Apparent fake footnotes | Withdrawn, May 2026 |
| KPMG | Report on agentic AI, October 2025 | Enterprise AI adoption | 5 of 45 citations checked out. UBS, the NHS, Swiss Federal Railways and TfL disputed claims made about them | Pulled, June 2026 |
| PwC Middle East | Transforming Governance (2025) | Public administration | 84% likely entirely AI-generated. Claimed four governments use a PwC framework with no public evidence it exists | Updating “a limited number” of citations |
| PwC Middle East | Shaping the GCC Mobility Landscape (2026) | Transport policy | A chart credited to a WEF study that doesn’t contain it. IEA charging data misread | As above |
| PwC Middle East | Building a Cyber-Resilient eMobility Ecosystem (2025) | Grid and infrastructure security | A cited paper with no trace in the journal named. One footnote URL ends in utm_source=chatgpt.com | As above |
Read the third column against the Commission’s list. Public administration and services. Public health. Consumer protection. Economic developments open to public debate.
Every one of these reports is squarely inside the scope of a rule that starts tomorrow.
A footnote that preserves the tracking parameter of the chatbot which produced it is, meanwhile, the most candid disclosure any of these firms has managed so far.
The Catch-22
There is an exemption, and it is elegantly drafted. Text that has undergone genuine human review or editorial control needs no label. Review means deliberate examination of the substance by people with relevant knowledge and professional judgement. Superficial or purely procedural checks do not qualify.
Which produces a fork with no comfortable side.
Claim human review, and the firm owns every fabricated citation personally. Concede no review, and the label goes on the cover.
The exemption is available only to firms that actually did the work. The firms in the table above have, by their own admission, not been those firms.
Who carries the duty
Here is the question the Act has to answer. A consultancy writes a report using AI. A client pays for it and publishes it. Who owes the label?
The intuitive answer is the consultancy. It wrote the thing.
But there is a real case for the client. The Deloitte Australia report sat on a government department’s website, under the department’s name, as work the department commissioned. Article 50(4) is a rule about published text. The department published it.
Most disclosure regimes work that way. In advertising, the duty follows the advertiser, not the agency that wrote the copy.
The AI Act does not.
It attaches the duty to the deployer, meaning whoever decided to use the AI system and controlled how it was used. Usually that is the same party who wrote the document. When the work is outsourced, the two come apart.
The Guidelines are explicit. A company that commissions an agency, without deciding or controlling whether and how AI is used, is not the deployer.
Now the Newfoundland detail matters. The Canadian Press obtained Deloitte’s 2023 contract. It said nothing about AI. Not whether Deloitte could use it. Not how.
The client set no conditions on the use of AI, so the client controlled nothing.
Deloitte chose to use AI. In the language of the Act, that makes Deloitte the deployer.
The exit nobody will enjoy
One argument survives. The duty attaches to text published to inform the public. Corporate marketing generally is not that.
So a firm can escape the label by conceding its research was never information at all. It was promotion. A sales asset with charts.
To avoid disclosing that AI wrote the report, you disclose that the report was advertising.
Procurement got there first
The regulators were not the quickest movers. Clients were.
After false citations surfaced in two reports, Newfoundland and Labrador rewrote its request-for-proposal forms. Vendors must now state whether they intend to use AI and how. The province may investigate, approve, deny or modify that use, and audit it.
That was March. No fines, no 51-page guidance, no transition period. A clause in a form.
A Canadian province of fewer than 550,000 people shipped an enforceable AI disclosure regime for consultants about five months before Brussels did.
The quiet consequence
Article 50 bans nothing. It requires a sentence.
That is smaller than the headlines suggest and larger than the industry has priced. Because once disclosure becomes routine, its absence becomes a claim. Every unlabelled report will assert that a qualified human read it, checked the sources, and put their name to it.
Which was, until quite recently, the entire product.
Disclosure: Exempt under Article 50(4) of the EU AI Act. Disclosed anyway. This article was partially drafted by AI. A human read it before you did.
For more insights about what AI can or cannot do, check out my book “Artificial Stupelligence: The Hilarious Truth About AI“.
Subscribe here to be the first to receive my insights
