If Your AI Can't Cite It, Treat It as Unproven.

Outside compliance, the answer is the product and the source is a footnote. Inside compliance, that is reversed. The answer to 'does this control satisfy the obligation' is only worth anything if you can point to the obligation, the control, and the line that connects them.

Strip the source away and you are left with an opinion in a confident font. An auditor does not accept 'the AI said so.' A regulator does not accept it. A customer running a vendor review does not accept it. What they accept is a claim they can trace to a document. That trace, the provenance, is not decoration on top of the answer. It is the part that makes the answer usable at all.

An AI answer with no source is a dead end. You cannot confirm it without redoing the work yourself, which means the AI saved you little. You cannot defend it to a third party, because there is nothing to hand them. And you cannot tell whether it is right, because the only thing supporting it is the model's tone.

This is the trap of fluent output. A confident, well-structured paragraph reads like it was researched even when it was not. NIST AI 600-1 calls this risk confabulation: confidently stated false content that can mislead users, including false logic or citations that appear to justify an answer. The absence of a citation is not neutral. It is a warning to treat the answer as unverified until the source is shown.

This is measured, not hypothetical. Stanford researchers benchmarked leading AI legal research tools, the kind explicitly built to retrieve and ground their answers, and found they still hallucinated between 17% and 33% of the time. These were tools marketed on reliability.

That is the source of Stanford's headline: legal AI models hallucinated in 1 out of 6 benchmarking queries or more. The same Stanford article also points to earlier work finding general-purpose chatbots hallucinated between 58% and 82% of the time on legal queries. Sit with that gap. Even specialized, retrieval-backed systems can fail often enough that confidence tells you very little. The only thing that separates a reviewable answer from a trust-me answer is whether it can be traced to a real source that supports the claim. That is why the citation has to be mandatory, not optional.

A citation is not decoration. It should point to the exact paragraph or clause, show the source name and version, preserve the date or publication context, and explain why that passage supports the claim. If the passage merely mentions the topic, it is not enough.

The practical test is simple: could a reviewer click the citation and verify the sentence without redoing the whole research task? If not, the answer is still too loose for GRC work. NIST's Generative AI Profile makes this operational too: it recommends reviewing and verifying sources and citations in GAI outputs during pre-deployment risk measurement and ongoing monitoring. Source, passage, relevance, currency, and permission all matter.

Retrieval and grounding narrow the problem: point the model at real documents and it has less room to invent. But the Stanford results are a warning that grounding alone is not a guarantee. Even retrieval-augmented tools hallucinated, because a system can retrieve the wrong passage, combine unrelated sources, or cite something that does not actually support the claim.

So grounding is necessary, not sufficient. What closes the gap is enforcement: the answer must attach the specific passage it relied on, and that passage must actually say what the answer claims. If those two conditions are not met, the answer does not ship. No source, no answer, is not a slogan. It is a gate.

The Sorena AI Assistant is built so that every answer points back to the passage behind it. It does not free-associate over the whole internet. It reasons over documents you have curated and permissioned, and it shows you the source for each claim so you can click through and check it instead of redoing the research from scratch.

That is only possible because the answers are grounded in Sorena SSOT, our Single Source of Truth. When every answer draws from the same governed set of trusted documents, the citation is not bolted on afterward. It is where the answer came from in the first place. Remove the source and there is no answer to give, which is exactly the behavior you want.

Be honest about what provenance buys you. A citation proves an answer is grounded in a real source you can inspect. It does not prove the source itself is correct, current, or the right one for your situation. A cited answer can still be wrong if the underlying document is outdated or misapplied.

That is the point of keeping the human in the loop. The citation makes verification fast and cheap, which is what lets a person actually do the checking instead of skipping it. Provenance turns 'trust me' into 'here is the passage, judge for yourself.' The judgment still belongs to your people. The system just makes sure they always have something real to judge.

The default assumption should be inverted. Do not assume an AI answer is right until proven wrong. Treat it as unproven until it shows you a source. That single habit, applied to every answer, is the difference between AI that speeds up defensible work and AI that quietly manufactures liability.

If your AI can cite it, verify it and move fast. If your AI cannot cite it, do not rely on it. In GRC, the citation is not the footnote. It is the whole point.