A Report About AI, Undone by AI
KPMG has withdrawn a report titled Redefining excellence in the age of agentic AI after multiple named organizations said that its descriptions of their AI deployments were false or misleading. The irony is almost too neat. A Big Four firm that sells AI-governance and assurance services published a document about responsible AI that appears to have been undermined by the very technology it was extolling, then pulled it pending an internal investigation when the subjects of its claims objected.
The organizations disputing the report's accuracy were not obscure. They reportedly included UBS, the United Kingdom's National Health Service, Swiss Federal Railways, and Transport for London, institutions with the standing and the motivation to publicly correct the record. When a consultancy's flagship thought-leadership describes real deployments at named clients that those clients say never happened as described, the problem is not a typo. It is a failure of verification at the heart of the deliverable.
What the Forensic Review Found
A forensic analysis of the report's citations painted a damning picture. According to reporting on the review, only a handful of the document's roughly four dozen citations correctly pointed to the sources they claimed, while the remainder ranged from mangled and misleading to partially fabricated or simply unverifiable. That distribution is the signature of generative AI used without adequate human checking: confident, fluent prose anchored to references that do not hold up under inspection.
This is the hallucination problem made concrete. Large language models produce text that reads authoritatively whether or not the underlying facts are real, and citations are a particularly treacherous failure mode because they carry the appearance of rigor. A reader who sees forty-five footnotes assumes diligence. When most of those footnotes are wrong, the apparatus of credibility has been turned into an instrument of misplaced trust, and the only defense is the human verification that, in this case, evidently did not happen at sufficient depth.
KPMG's Response and Its Tension
KPMG removed the report and pointed to its own standards. "We expect all our people to follow our guidelines on the responsible use of AI, including human oversight to validate content and verify independent sources," a spokesperson said. The statement is reasonable on its face, but it also exposes the central tension. The firm had guidelines requiring human validation, and yet a public report reached the world with citations that human validation should have caught.
That gap between policy and practice is the real lesson, and it is not unique to KPMG. Having a responsible-AI policy is not the same as operating one. The pressure to produce thought-leadership quickly, the seductive fluency of AI-generated drafts, and the assumption that someone else checked the details combine to let unverified content slip through even at organizations that know better. The policy was correct; the execution failed, and execution is where AI governance actually lives or dies.
A Pattern, Not an Isolated Slip
This was not a one-off. The episode follows a similar retraction by EY roughly a month earlier, when that firm withdrew a report over fabricated footnotes and apparent hallucinations. Two Big Four firms tripping over the same failure mode within weeks is not coincidence; it is a pattern that points to systemic risk in how professional-services firms are integrating generative AI into their output. The reputational stakes for organizations whose entire value rests on accuracy and judgment could hardly be higher.
We find this particularly significant because consultancies are simultaneously among the loudest advocates for enterprise AI adoption and, apparently, among those struggling to deploy it safely in their own work. When the firms advising clients on AI governance cannot reliably govern their own AI use, it should give every buyer of that advice pause. The credibility of AI-assisted analysis is now a live question, and the firms selling it are providing the cautionary examples.
The Executive Takeaway
For CIOs and CTOs, the KPMG retraction is a usefully concrete reminder that AI-generated content requires verification proportional to its stakes, especially anything published externally or used to inform decisions. The cost of that verification is real, and the temptation to skip it grows precisely as AI makes the initial drafting effortless. The efficiency gains of generative AI are genuine, but they are not free; they shift the burden from creation to checking, and organizations that fail to fund the checking inherit the liability.
There is also a procurement dimension. When evaluating vendors and advisors who tout AI capabilities, this episode argues for asking pointed questions about their internal verification practices, not just their tooling. A firm that has publicly hallucinated its way into a retraction has, at minimum, demonstrated where its controls were weak. The broader market is learning, in real time and at the expense of some prominent names, that trust in AI output must be earned through process, not assumed from polish.
