
Cited sources: why an AI that doesn’t show where its answer comes from can’t be used in a fiduciary firm
By, zero-adm
- 6 Oct, 2026
- 19 Views
An associate brings you a figure for the client letter. The first thing you ask is where it came from. If the answer is “I read it somewhere,” the letter doesn’t go out.
The same rule should apply to an AI. Yet many tools answer with confidence and name no document. The answer may be right. But you have no way to know without redoing the search from scratch, and then the tool has saved you nothing.
The signature stays yours
Under art. 398 CO you must perform the mandate with diligence. If a letter, a calculation or a memo contains a wrong figure, the client comes to you, not to whoever wrote the software. The AI doesn’t sign and doesn’t answer for the mandate.
That is why, in a fiduciary firm, an answer is worth something only if you can check it quickly. The checking stays with you, and the tool has to shorten it.
What "cited source" means
A properly cited source has three traits:
- it is specific: it names the document and the passage, not “your files” in general;
- you can open it: one click takes you to the text, with no hunting through the archive;
- it is tied to the sentence: you know which statement comes from which passage.
A list of documents at the bottom of the answer doesn’t help much. If the answer has six sentences and the list has six documents, you still have to work out which sentence comes from where.
Four checks, thirty seconds
When you receive an answer with sources, run these four steps. They apply to ZeroEdge and to any other tool.
1. Does every sentence have its citation? A sentence without a citation has no source you can open. It may be a deduction by the model or a piece of its general knowledge. Treat it as an opinion.
2. Does the citation lead to the right passage? Open the source and read. If the passage says something else, the passage wins. A model can summarise badly even the text in front of it.
3. Does the sentence add something the document doesn’t say? This is the most insidious error. The model reads “six months’ notice” and writes “six months’ notice for the year 2026.” That year isn’t in the contract. If a detail doesn’t appear in the passage, it doesn’t go in the letter.
4. Is a record kept of the question, the answer and the sources? If a year from now the auditor or the client asks where a figure came from, you need the question, the answer and the sources of that day. Ask the vendor where they are kept and who can delete them. In ZeroEdge, the access log records who queried the documents and when; the question, answer and sources from the documents stay in the conversation until the person who started it deletes it; for web pages, what stays is the search that was run, not the link.
When there is no answer
There is a fifth check, and it is worth running before you choose a tool: ask for something you know is not in the documents.
A language model tends to complete stories. If the case file holds a formal demand letter, the model expects a summons for payment under Swiss debt enforcement law to follow and may write one, with a plausible date. The tool you want in your firm replies that nothing in the documents shows it, and cites no sources. A “not found” answer sends you to look in the right place. An invented date ends up in a letter.
What to ask the vendor
Before you give an AI your clients’ documents, have the vendor show you three things on a test file:
- an answer with the citation sentence by sentence, and the click that leads to the passage;
- what it does when the answer isn’t in the documents;
- where the question, the answer and the sources are kept, and who can read or delete them.
And remember the other question of our campaign: where those documents are processed. The sources tell you whether the answer is right. The place of processing tells you who else has read it.
Try it on one of your files
In the October demos we run these checks together, on your documents and with your client’s authorisation. Forty-five minutes, no commitment: write to sales@zeroedge.ch or request the demonstration at ai.zeroedge.ch (page in Italian).
Demos are reserved for fiduciary and accounting firms. The module for law firms is not yet available.
Where does your AI work? Bring a file. Watch where it goes.
— ZeroEdge AI · Sovereign AI, made in Switzerland. Processing and storage in Switzerland · data processing agreement · access log.
Cover image generated with AI.
Tags:
Recent Posts
- Cited sources: why an AI that doesn’t show where its answer comes from can’t be used in a fiduciary firm
- ChatGPT Flaw Sent One User’s Gmail to Another Account: What It Means for Firms Holding Client Files
- Business secrecy and AI: the guide for a Swiss fiduciary firm
- The AI that “runs locally” doesn’t run locally
- The EU’s 24-Hour Clock Starts 11 September: It Also Covers Products You Shipped Years Ago
Category
- Cyber Security (101)
- Vulnerability Assessment (71)
Newest Posts
All Tag
2025 AI AI Security Automation Awareness Beneficial Ownership Business ChatGPT Check Point CISO Cited sources CLOUD Act Cloud Security Competition Law Compliance CRA Cybercriminals Cyber Resilience Act CyberSecurity Academy Cybersecurity Awareness Dataprotection Data Residency Digital Sovereignty ENISA EU AI Act EU Regulation Future Malware nFADP nLPD OpenAI Phishing Product Security Ramsonware Ransomware Supply Chain Swiss AI Switzerland Threat Intelligence Transparency Register Treat Detection Vulnerability Assessment Vulnerability Management Zero-Day Zeroedge Academy
