Why AI Projects Fail in Regulated Industries (It's Rarely the Regulator)

AI projects in regulated industries rarely fail because a regulator says no. They fail because the project was designed as if the rules didn't apply, and the rules show up anyway, usually at the worst moment: a pilot built on patient or client data that no contract allows the vendor to hold, a tool that can't explain why it scored an applicant the way it did, or a review step that nobody can prove happened. MIT's 2025 study of more than 300 public AI initiatives concluded that the gap between companies getting results from AI and those getting nothing "does not seem to be driven by model quality or regulation, but seems to be determined by approach" (Challapally, Pease, Raskar, and Chari, The GenAI Divide, MIT NANDA, July 2025, p. 3).

In other words, the rules are a design input, and projects that treat them as a final hurdle are the ones that stall. Our guide to why AI projects fail covers the causes every industry shares. This page covers what changes when the work runs under HIPAA, financial privacy rules, professional conduct rules, and the newer state AI laws, and that reaches well beyond hospitals and banks.

A medical billing company, a mortgage broker, a tax preparation firm, and a 20-lawyer firm are all regulated businesses, and most of them have 10 to 200 people and no compliance department to speak of.

Key Takeaways

• AI projects in regulated industries usually fail from approach, not from a regulator's refusal. MIT's 2025 research said the divide in AI results "does not seem to be driven by model quality or regulation."
• Most of the rules that stop these projects are already in force and are written to be technology neutral: HIPAA's business associate requirement, the FTC Safeguards Rule's vendor oversight, lending's duty to give specific reasons for a denial, and lawyers' confidentiality duties.
• HHS says a HIPAA covered entity or business associate (a medical practice, a billing company, or another vendor handling patient data for one) that lets a cloud vendor process or store patient data without a business associate agreement is in violation of HIPAA. Staff pasting claim details into an unvetted AI tool create the same exposure.
• In IBM's 2025 breach study, one in five organizations reported a breach involving shadow AI (tools employees use without approval), and 63% of breached organizations had no AI governance policy or were still writing one.
• Courts have now identified more than 2,200 cases worldwide involving AI-fabricated material in legal filings, each one signed by someone responsible for checking it.
• The safest path is to start with work where a person reviews every output and no decision about a customer rests on the AI, and to bring compliance in during the first week rather than the last.

Table of Contents

• Why do AI projects fail in regulated industries? The short answer
• The rules already apply to your AI project
• Six places AI projects stall in regulated industries
• The opposite failure: banning AI outright
• Rules that move while the project runs
• Sort the work by risk before you choose the first project
• A 70-person medical billing company on its third try
• How to run an AI project that survives compliance review
• Where Avolis fits
• Frequently Asked Questions
• Continue Learning

Why Do AI Projects Fail in Regulated Industries? The Short Answer

AI projects fail in regulated industries because the questions a regulator would ask get asked too late, after the tool is chosen, the data is loaded, and the team has started relying on it. Who holds the data, and under what contract? Who checked the output before it reached a patient, a borrower, or a court? Can the business show a regulator what the AI did and why? A project that can't answer those questions isn't ready for real work, however well the demo went.

In these industries the tools have mostly stayed at the edges of the work. MIT scored eight sectors on how much generative AI had changed them, on a 0-to-5 index, and put healthcare and financial services at 0.5 each. It described healthcare's activity as documentation and transcription pilots with clinical models unchanged, and financial services' as backend automation with customer relationships stable (MIT NANDA, p. 5).

The Rules Already Apply to Your AI Project

The most common misreading in regulated businesses is that AI compliance means waiting for AI laws. Most of what governs an AI project in these industries already exists and was written to apply to any technology. FINRA said so directly in 2024, reminding broker-dealers that its rules "are intended to be technology neutral" and continue to apply when firms use generative AI, from supervision to recordkeeping (FINRA, Regulatory Notice 24-09, June 2024). The other regulators have taken the same line in their own words.

The Safeguards Rule surprises people most, because its reach is wider than the word "financial" suggests. The FTC's own list of examples includes mortgage brokers, collection agencies, credit counselors and other financial advisors, tax preparation firms, and investment advisers that aren't required to register with the SEC, and it tells those businesses that their vendor contracts "must spell out your security expectations" and build in ways to monitor the vendor's work (FTC, "FTC Safeguards Rule: What Your Business Needs to Know"). An AI vendor that reads customer files is a service provider under that rule, whether or not anyone thought of it that way when the subscription was bought.

Six Places AI Projects Stall in Regulated Industries

AI projects in regulated industries stall in six places, and each one traces back to treating the rules as a final check instead of a design requirement.

1. Compliance sees the project last

In most smaller regulated businesses, the person responsible for compliance is also the office manager, the controller, or a partner with a full client load, so AI projects tend to start without them. The owner sees a demo, an operations lead runs a trial, and the compliance question comes up only when someone has to sign off on going live. By then the tool is chosen, the workflow is designed around it, and the team has spent weeks getting used to it, so a "no" from compliance feels like sabotage rather than a review.

The fix is mostly a matter of timing. A compliance lead who hears about the project in week one can steer it toward a vendor that will sign the right contract and a data flow that won't need to be undone. The same person hearing about it in month four can only stop it.

2. The data can't legally go where the tool sends it

Every AI tool sends data somewhere, and in a regulated business the question of where is a legal one. The Department of Health and Human Services is blunt about it. If a covered entity or business associate uses a cloud service provider to process or store electronic patient data without a business associate agreement, it "is in violation of the HIPAA Rules." HHS also notes that its Office for Civil Rights has already reached a resolution agreement with an organization that stored the data of more than 3,000 people on a cloud server without one (HHS, "Guidance on HIPAA & Cloud Computing"). An AI tool is a cloud service provider in that sense the moment someone pastes a claim, a chart note, or a patient letter into it.

Law firms face the same problem under a different name. The ABA's first formal opinion on generative AI, Formal Opinion 512, issued in July 2024, applies the duty of confidentiality to these tools: lawyers must keep information relating to a client's representation confidential unless the client gives informed consent (American Bar Association, "ABA issues first ethics guidance on a lawyer's use of AI tools", July 2024). A pilot that works beautifully on real client files, and turns out to have no permission to use them, has to be rebuilt from the data up.

3. Nobody can show what the AI did

Regulated businesses live on records, and many AI pilots produce none. A biller drafts an appeal with an AI tool, edits it, and submits it, and afterward there's no record of what the tool wrote, what the biller changed, or which version of the tool was used. That's fine until a regulator, an auditor, or a client asks.

Insurance shows where this is heading. The NAIC's model bulletin on insurers' use of AI had been adopted with little or no change by 24 states and the District of Columbia as of March 2025. It expects insurers to keep a written AI program, to oversee third-party AI vendors (with audit rights in contracts where appropriate), and to be ready to produce documents about how they develop and use AI during an investigation or market conduct review (Quarles, "Nearly Half of States Have Now Adopted NAIC Model Bulletin on Insurers' Use of AI", April 2025). From 2027, Colorado's new AI law will require businesses that use AI in consequential decisions about people to keep the records that show compliance for at least three years. A project with no log can't satisfy any of that.

4. The review step is a signature, not a check

Almost every regulated AI project includes the phrase "a human reviews the output." The failure is when that review becomes a click. A person who approves forty AI drafts an hour isn't reviewing them, and the record will show their name on every mistake.

The legal profession has run this experiment in public. In June 2023, a federal judge in New York sanctioned two lawyers and their firm $5,000 for filing a brief that cited court decisions ChatGPT had invented. The opinion made the point that there's nothing inherently improper about using a reliable AI tool, but existing rules give lawyers a gatekeeping role to ensure the accuracy of what they file (ABA Journal, "Lawyers who 'doubled down' and defended ChatGPT's fake cases must pay $5K, judge says", June 2023). The gatekeeping didn't take. A database maintained by the legal researcher Damien Charlotin had identified 2,217 court decisions worldwide dealing with AI-hallucinated material in filings as of October 2026 (Charlotin, "AI Hallucination Cases"). Every one of those filings was signed by someone responsible for checking it.

A review step only works if it's designed: the reviewer knows what to check, has time to check it, and can see the source the AI worked from. That design belongs in the build itself.

5. The tool can't give a reason when the law requires one

Some regulated decisions come with a legal duty to explain. A lender that denies credit has to give the applicant specific reasons, and the Consumer Financial Protection Bureau has said that duty doesn't go away because the creditor's model is too complex to explain: a creditor can't justify noncompliance on the grounds that the technology is too opaque to identify the reasons (CFPB, Consumer Financial Protection Circular 2022-03, May 2022). That reaches further than banks. A contractor or dealer that extends its own financing and lets a tool score applicants is in the same position.

Projects stall here when the team picks a tool for its accuracy and only later discovers it can't produce a reason a declined borrower could be given. The same question is spreading to insurance and hiring, where the NAIC bulletin and Colorado's new law expect a business to document, and give notice of, how an automated tool was used in a decision about a person. Ask a vendor to show you a sample reason before you ask about accuracy.

6. The first project chosen was the riskiest one

Regulated businesses often aim their first AI project at the most valuable decision in the operation: approving claims, scoring loan applications, triaging patients, screening tenants. Those are exactly the decisions the rules care most about, so the first project lands in the heaviest review and stalls there, and the business concludes AI "doesn't work here."

The higher-return first project is usually the paperwork around those decisions: assembling the file, drafting the letter, summarizing the record, checking that nothing is missing. A person still makes the decision, the AI saves them hours of preparation, and the compliance review is a fraction of the size. The risk tiers below sort this out.

The Opposite Failure: Banning AI Outright

Some regulated businesses respond to all of this by banning AI tools, and that fails too, only more quietly. The work doesn't stop needing to be done, and staff who know a chatbot could draft the letter in two minutes use one on their phone or a personal account. The business then carries all of the risk and none of the controls.

IBM's breach research puts numbers on what ungoverned AI costs. In its 2025 Cost of a Data Breach study of 600 breached organizations, conducted by the Ponemon Institute, one in five organizations reported a breach due to shadow AI, meaning AI tools used without the company's approval, and organizations with high levels of shadow AI saw an average of $670,000 more in breach costs than those with little or none. Sixty-three percent of breached organizations had no AI governance policy or were still developing one, and of the 13% that reported a breach of an AI model or application, 97% said they lacked proper AI access controls (IBM, "IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls", July 2025). Healthcare breaches were the most expensive of any industry in that study, averaging $7.42 million.

The 2026 edition of the study, covering 602 breached organizations, found a larger share, more than 20%, reporting a breach targeting AI models or applications, and financial services breaches averaged $6.3 million (IBM, "IBM Study: One in Four Malicious Breaches are AI-Enabled", July 2026).

Healthcare shows the same pressure from the other direction. In the American Medical Association's 2026 survey of 1,692 physicians, 81% said they use AI professionally, more than double the rate when the AMA first asked in 2023, and 28% said they use it to document billing codes, medical charts, or visit notes. About 40% said they were equally excited and concerned, with patient privacy among their top concerns (AMA, "More than 80% of physicians use AI professionally: AMA survey", March 2026). The people doing regulated work are already using AI, so a ban mostly decides whether that use happens inside the rules or outside them.

Rules That Move While the Project Runs

The newer AI-specific laws add a different kind of failure: a project designed for a rule that changes before it takes effect. Colorado is the clearest example. Its 2024 AI Act, signed in May 2024, was set to take effect on 1 February 2026; a special session in August 2025 pushed that to 30 June 2026 (Greenberg Traurig, "Colorado Delays Comprehensive AI Law With Further Changes Anticipated", September 2025). Then, on 14 May 2026, the state repealed it and enacted a narrower replacement, SB 26-189, which takes effect on 1 January 2027 (Colorado General Assembly, SB26-189, "Automated Decision-Making Technology").

A business that built its AI program around the 2024 law's risk assessments spent money preparing for rules that never applied. What carried through both versions is more useful than any one deadline. The replacement law covers technology used to "make, guide, or assist" decisions about a person's access to employment, housing, lending, insurance, health care, education, or government services, and it requires notice to consumers and records kept for at least three years. The kinds of decisions the law cares about stayed largely the same across both versions, and so did the expectation of a paper trail.

The practical lesson is to design for the durable requirements (know which decisions about people the AI touches, give reasons, keep records, have a person accountable) rather than for a specific statute's checklist. A project built that way survives the next amendment.

Sort the Work by Risk Before You Choose the First Project

The decision that most determines whether a regulated AI project survives is which work it touches first. Sorting candidate workflows into three tiers before choosing one keeps the first project out of the heaviest review and gets a result while the team still has patience for it.

Most of the hours a regulated small business could recover sit in tier 2. That's where the paperwork is, and the review step a person already performs is the control the rules want. Tier 3 projects can work, but they should come after the business has run a tier 2 project long enough to know its logging, review, and vendor management hold up.

A 70-Person Medical Billing Company on Its Third Try

Consider a 70-person medical billing company (an illustrative composite) that handles claims for about 40 physician practices. As a business associate under HIPAA, it holds patient data for every one of them. Its biggest drain is denied claims: roughly 900 a month, each needing an appeal letter that a biller assembles from the claim, the remittance notice, the payer's policy, and the chart notes, at 30 to 40 minutes a letter.

The first attempt didn't start as a project at all. Two billers began pasting denial details into a free chatbot on their own and cut their letter time in half. When the company's compliance and privacy lead found out, the tool was shut down, rightly, because no business associate agreement covered that tool, and the company sent a memo banning AI. Six months later, the owner bought a subscription to an appeals tool after a strong demo. The vendor would sign a BAA, but the tool kept no record of what it drafted or what the biller changed, and it submitted letters straight to payer portals. The compliance lead asked how the company would show a client practice which letters the AI wrote if a payer challenged one. Nobody had an answer, and the pilot sat in review for four months until the subscription lapsed.

The third attempt began with the compliance lead in the first meeting and a different vendor, chosen because it would sign a BAA, keep a full record of each draft, and leave submission to a person. The team picked one payer with a high denial rate and one denial type, medical necessity, and wrote down the data the tool would see, the vendor contract it needed, and what had to be logged. The AI drafts the letter from the claim and the payer's policy, and the accounts receivable supervisor's team reviews every draft against a short checklist (right patient, right dates of service, correct policy citation) before a biller submits it. The tool keeps the draft, the reviewer's edits, and the reviewer's name. Before go-live, the team recorded letters per biller per day and the share of appeals overturned for that payer, and the owner, the compliance lead, and the AR supervisor review both numbers every two weeks. The second payer gets added only once the first one has three months of clean logs.

The drafting was no better the third time. What changed was when compliance arrived, which work went first, and whether the review could be proven.

How to Run an AI Project That Survives Compliance Review

A regulated AI project survives review when the review is built into it from the start. Seven steps cover most of what matters for a business of 10 to 200 people.

1. Name the rule before the tool. Write down which rules apply to the data and decisions involved (HIPAA, the Safeguards Rule, lending rules, professional ethics rules, state law) and who in the business answers for each one.
2. Bring the compliance owner in during week one. Whoever signs off on compliance, whether that's a privacy officer, a controller, or a partner, should help choose the workflow and the vendor, not just approve the result.
3. Map the data flow. For the chosen workflow, record what data the tool sees, where it's sent and stored, and whether the vendor trains its models on it. If any regulated data leaves the business, the contract has to cover it.
4. Start in tier 2. Pick work where the AI prepares and a person decides, and keep decisions about people for later.
5. Design the review, then staff it. Write the checklist the reviewer uses, make the source documents visible next to the draft, and set a volume a reviewer can actually check.
6. Log by default. Keep the AI's output, the reviewer's changes, the reviewer's name, and the date. If the tool can't keep that record, the workflow around it has to.
7. Give staff a sanctioned option. Shadow AI shrinks when people have an approved tool that does the job, so pair the policy with something they can use.

Tools that act on their own, submitting a claim or sending a client message without a person in between, push every one of these steps harder, and our page on why agentic AI projects fail covers that case. Large regulated organizations face an extra layer of committee review on top of everything here, which our page on why most enterprise AI projects fail explains.

Where Avolis Fits

The regulated-industry failure pattern is a sequencing problem, and our method is built around getting the sequence right. Every engagement starts with the diagnostic. Working through each workflow with the people who run it, we measure how it runs (volumes, time per task, where work changes hands), map which steps touch regulated data or decisions about customers, and rank the workflows by what each would return against what it would take to build safely. Your compliance owner is part of that from the start, so the ranking already reflects what each project needs before it goes to review. The ranked result is yours to keep, whatever you do next.

From there, we build the first workflow inside the systems your team already uses, usually a tier 2 project where the AI prepares the work and your people decide, with the review checklist and the log built into the workflow. Then we stay embedded while it settles and while the next one is built. Our guide to AI readiness assessment services explains what a good diagnostic produces. In a regulated business, the first question for any partner is how they'll handle your data, and our guide to which AI consulting company to choose covers the rest.

Frequently Asked Questions

Why do AI projects fail in regulated industries?

AI projects in regulated industries usually fail because compliance questions get asked too late. Teams pick a tool and load real data before checking whether a vendor contract covers it, whether outputs are reviewed and logged, and whether decisions can be explained. MIT's 2025 research said the divide in AI results did not seem to be driven by regulation, but by approach.

Is regulation the main reason AI fails in healthcare and financial services?

No. MIT's 2025 study concluded that the gap between organizations getting value from AI and those getting none did not seem to be driven by regulation but by approach. Most rules that affect AI projects, such as HIPAA, the FTC Safeguards Rule, and lending laws, already exist and apply to any technology. Projects fail when they're designed without them.

Can a small healthcare or financial business use ChatGPT with client data?

Only under a contract that meets the rules for that data. HHS says a HIPAA covered entity or business associate that lets a cloud provider process or store patient data without a business associate agreement is violating HIPAA, and the FTC Safeguards Rule requires the businesses it covers to set security terms with their vendors and monitor them. Consumer chatbot accounts usually offer neither.

What AI projects should a regulated business start with?

Start with work where the AI prepares something and a person reviews every output before it leaves the business, such as drafting appeal letters, summarizing client files, or checking documents for missing items. Leave projects where AI scores or decides on a person's eligibility, credit, coverage, or care until the business has proven its review and logging on simpler work.

Do new state AI laws apply to small businesses?

Some can, depending on what the AI is used for. Colorado's replacement AI law, SB 26-189, takes effect on 1 January 2027 and covers technology used to make, guide, or assist decisions about people's access to employment, housing, lending, insurance, health care, and similar services. For most small regulated businesses today, though, the binding rules are the industry rules already in force.

Continue Learning

Regulated AI projects stall at the same few points: data with no permitted path, review nobody can prove, and decisions nobody can explain. Each of those is cheap to design in during the first week and expensive to retrofit in month four.

Before you choose a tool, write down which rules apply to the work you want to change and put the person who answers for them on the project.

Why projects fail, in detail:

• Why do AI projects fail? Common reasons and statistics
• Why agentic AI projects fail
• Why do most enterprise AI projects fail?
• Why are AI projects failing? What's different about the current wave

When a project is already in trouble:

• Why your AI consulting project isn't reaching production
• How to recover a failing AI project

Starting the right way:

• AI readiness assessment services
• Which AI consulting company should I choose?

---

Sources

All sources retrieved 2026-10-26.

• Aditya Challapally, Chris Pease, Ramesh Raskar, and Pradyumna Chari, The GenAI Divide: State of AI in Business 2025, MIT NANDA, July 2025 (preliminary findings; 300+ public AI initiatives reviewed, interviews with 52 organizations, survey of 153 senior leaders; pages 3 and 5 cited), retrieved 2026-10-26: https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf
• FINRA, Regulatory Notice 24-09, "FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models," 27 June 2024, retrieved 2026-10-26: https://www.finra.org/rules-guidance/notices/24-09
• Federal Trade Commission, "FTC Safeguards Rule: What Your Business Needs to Know," business guidance, retrieved 2026-10-26: https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
• US Department of Health and Human Services, "Guidance on HIPAA & Cloud Computing" (content last reviewed 23 December 2022), retrieved 2026-10-26: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html
• American Bar Association, "ABA issues first ethics guidance on a lawyer's use of AI tools," 29 July 2024, on Formal Opinion 512, retrieved 2026-10-26: https://www.americanbar.org/news/abanews/aba-news-archives/2024/07/aba-issues-first-ethics-guidance-ai-tools/
• Quarles & Brady, "Nearly Half of States Have Now Adopted NAIC Model Bulletin on Insurers' Use of AI," 2 April 2025, retrieved 2026-10-26: https://quarles.com/newsroom/publications/nearly-half-of-states-have-now-adopted-naic-model-bulletin-on-insurers-use-of-ai
• ABA Journal, "Lawyers who 'doubled down' and defended ChatGPT's fake cases must pay $5K, judge says," June 2023, on Mata v. Avianca, Inc., No. 22-cv-1461 (S.D.N.Y. 22 June 2023), retrieved 2026-10-26: https://www.abajournal.com/web/article/lawyers-who-doubled-down-and-defended-chatgpts-fake-cases-must-pay-5k-judge-says
• Damien Charlotin, "AI Hallucination Cases" database, retrieved 2026-10-26: https://www.damiencharlotin.com/hallucinations/
• Consumer Financial Protection Bureau, Consumer Financial Protection Circular 2022-03, "Adverse action notification requirements in connection with credit decisions based on complex algorithms," May 2022, retrieved 2026-10-26: https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/
• IBM, "IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls," 30 July 2025, on the Cost of a Data Breach Report 2025 (Ponemon Institute; 600 organizations breached between March 2024 and February 2025), retrieved 2026-10-26: https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
• IBM, "IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average," 29 July 2026, on the Cost of a Data Breach Report 2026 (Ponemon Institute; 602 organizations breached between March 2025 and February 2026), retrieved 2026-10-26: https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
• American Medical Association, "More than 80% of physicians use AI professionally: AMA survey," 12 March 2026 (1,692 physicians, fielded January to February 2026), retrieved 2026-10-26: https://www.ama-assn.org/practice-management/digital-health/more-80-physicians-use-ai-professionally-ama-survey
• Greenberg Traurig, "Colorado Delays Comprehensive AI Law With Further Changes Anticipated," September 2025, on SB 25B-004, retrieved 2026-10-26: https://www.gtlaw.com/en/insights/2025/9/colorado-delays-comprehensive-ai-law-with-further-changes-anticipated
• Colorado General Assembly, SB26-189, "Automated Decision-Making Technology," 2026 Regular Session (became law 14 May 2026), retrieved 2026-10-26: https://leg.colorado.gov/bills/sb26-189

On MIT's sector scores. MIT's AI Market Disruption Index scores industries from 0 to 5 on five indicators, including market share volatility among top incumbents and the growth of AI-native firms. It measures structural change in an industry, not project failure rates. MIT reports that healthcare scored consistently low across alternative weightings.

On the IBM figures. The IBM studies cover organizations that experienced a data breach, not all organizations. The 97% access-control figure applies to the 13% that reported a breach of an AI model or application, and the 63% governance figure applies to breached organizations. The shadow AI and governance figures are from the 2025 study; the 2026 press release does not restate them.

On the regulatory table. It summarizes rules as they apply to typical AI projects and is not legal advice. Whether a particular business is covered (for example, by HIPAA, by the Safeguards Rule, by Regulation B's adverse action rules, which exempt some incidental credit, or by a state's adoption of the NAIC bulletin) depends on its activities and location. The NAIC bulletin is addressed to insurers; insurance agencies and producers are covered by separate state rules. The ABA Model Rules bind lawyers only as adopted by each state. The NAIC count is as reported by Quarles & Brady for March 2025 and covers states that adopted the bulletin with little or no material change; more have adopted it since, some in modified form.

On the hallucination database. Charlotin's database tracks court decisions that found AI-hallucinated content in filings, worldwide. It's a floor, not a count of all such filings, and it includes filings by people representing themselves as well as by lawyers.

On the billing company. It's an illustrative composite, not a client. Its figures (70 people, about 40 practices, roughly 900 denials a month, 30 to 40 minutes a letter, four months in review, three months of logs) are representative examples, not measurements or benchmarks.

---

About Avolis Research Group

Avolis Research Group is Avolis's in-house research practice, focused on how operations-heavy small and mid-sized businesses actually adopt AI. It synthesizes primary economic research, government survey data, and results from real implementations into practical, vendor-neutral guidance.

More about Avolis and how we work · Get in touch