A lawyer's signature is a certification. Courts are finding out what it is worth.

More than a thousand court cases worldwide now involve generative AI producing fabricated citations that reached a judge. Rule 11 has required a human certification on every filing for decades. The gap is that electronic filing turned that certification into a login, and a login certifies nothing about whether anyone read the document.

The letter from opposing counsel

The brief went out at 11:14pm on a Tuesday, which is not unusual. An associate had drafted it over two days with help from a research assistant that summarised authority and proposed language. The partner read the argument section, thought it was strong, and filed. The signature block said /s/ Jane Whitfield, because that is how electronic filing works. The system authenticated her with a username and password, accepted the PDF, stamped it, and docketed it.

Eleven days later, opposing counsel sent a letter. Four of the cases cited in the brief did not exist. Not misdescribed, not distinguishable on the facts. They had reporter citations in the correct format, plausible party names, and holdings that supported the argument beautifully, and no court had ever decided any of them.

The judge's order to show cause asked a question that the firm found it could not answer. Not "did you use AI", which everyone now expects and which the firm answered honestly. The harder question was: who read the final document before the signature was applied, and what did they check?

The associate had read a draft. The partner had read the argument section of a later draft. Somebody had assembled a final version, and the file metadata showed several people with access. The e-filing system's audit trail showed a successful login from Jane's account at 11:14pm and an upload. What it did not show, because no e-filing system in the country records it, was any evidence that a human being read the text that was actually filed.

The firm was not lying. It genuinely did not know. And that, rather than the fabricated citations, is the structural problem worth writing about.

What does a Rule 11 signature actually certify?

Rule 11 of the Federal Rules of Civil Procedure is short, old, and much more demanding than most non-lawyers assume. Every pleading, written motion and other paper must be signed by at least one attorney of record. And by presenting that paper to the court, the signer certifies that to the best of their knowledge, information and belief, formed after an inquiry reasonable under the circumstances, several things are true: the filing is not being presented for an improper purpose, the legal contentions are warranted by existing law or a non-frivolous argument for changing it, and the factual contentions have evidentiary support.

Read the phrase "formed after an inquiry reasonable under the circumstances" again, because it is doing all the work. The rule does not ask whether the lawyer believed the brief was good. It asks whether they made a reasonable inquiry before saying so. A citation to a case that does not exist is a failure of inquiry almost by definition, because the minimum reasonable inquiry into whether a case supports your argument is reading the case.

This is not a technicality that AI created. Rule 11 in something like its modern form predates the personal computer. Courts have been sanctioning lawyers for unfounded filings for a very long time, and the drafters were explicit that the signature is a certification with teeth, not a formality. The rule already contains the answer to the question everyone is asking.

Why the signature is the right place for the duty

There is an elegance to Rule 11 that is easy to miss. The rule does not attempt to regulate research methods, or dictate how a brief may be produced, or list acceptable tools. It puts a single named human at the end of the process and makes them personally answerable for the whole of it. That design is technology-neutral in the deepest sense: it survived typewriters, word processors, Westlaw, paralegals, contract attorneys, and offshore drafting services, because it never cared how the words were produced. It cared who vouched for them.

That is why the flood of AI disclosure orders, however well-intentioned, feels like it is solving a different problem. The rule was never about provenance. It was about accountability.

How many lawyers have been sanctioned for AI citations?

The most comprehensive public accounting is a database of AI hallucination cases maintained by Damien Charlotin, a researcher at HEC Paris, which catalogues court decisions worldwide in which generative AI produced fabricated citations or content that was submitted to a court. By mid-2026 the database had passed a thousand entries and was still growing at a steady monthly rate, having grown roughly an order of magnitude in about a year. Reported sanctions run from modest fines into six figures for a single matter, and reporting in 2026 described a federal judge cancelling a trial and suspending lawyers on both sides of the case.

Treat every specific count as a moving target rather than a fact, because the database updates continuously and any number printed here will be stale within weeks. The direction and the order of magnitude are the durable observations: this is not a handful of embarrassing anecdotes, it is a persistent category of professional failure occurring at a rate of dozens of new cases per month across multiple jurisdictions.

The origin point is generally taken to be a 2023 matter in the Southern District of New York involving fabricated authority in a personal injury case, which received enough attention that the profession was on notice from that moment. What is striking is what happened next. Being on notice did not slow it down. The rate accelerated for three years after the entire legal world had read about the first one.

That fact should stop anyone who wants to explain this as carelessness or ignorance. Thousands of lawyers who knew exactly what had happened to their colleagues did the same thing anyway. When a failure mode survives universal awareness, the cause is structural.

Why does the same story keep repeating?

Read a dozen of the sanctions orders and a pattern appears that is more interesting than the citations themselves.

In a large share of the reported decisions, the conduct that draws the heaviest sanction is not the original error. It is what happened afterwards. Lawyers who acknowledged the mistake immediately, explained how it occurred and paid the cost tended to receive proportionate treatment. Lawyers who claimed the cases were real, or blamed a junior without evidence, or filed a second document defending the first, found judges reaching for the more serious end of the range, including referrals to disciplinary bodies and suspensions.

There is a very human reason for that, and it connects directly to the identity problem. When a lawyer is asked "did you read this before you signed it", they often genuinely do not remember, because the signing was not an event. It was a click at the end of a long day, indistinguishable from the four hundred previous clicks. Faced with a question they cannot answer honestly with confidence, under enormous professional pressure, some of them guess. And the guess becomes the misrepresentation that ends the career.

A process that produces no record of its own most important step is a process that sets people up to fail exactly this way.

What broke, exactly?

Here is the mechanism, and it is worth going slowly because the profession has been discussing the symptom for three years without naming the cause.

When filings were paper, the signature was a physical act performed on the specific document being filed. The lawyer held the final version, in its final form, and put ink on it. That does not guarantee they read it, but it guarantees a moment of contact between a particular human and a particular text. The certification and the document were physically fused.

Electronic filing separated them. Under the conventions used across federal CM/ECF and most state systems, an attorney's signature is represented by a typed /s/ block, and the system treats a successful login by that attorney's account as the signature. The user identifier and password serve as the signature for filing purposes. This was a sensible design when it was introduced, it has worked for two decades, and the profession is right that it is not the source of the AI problem.

But look at what the artifact now proves. It proves that someone with valid credentials for Jane Whitfield's account uploaded a file at 11:14pm. That someone could be Jane. It could be her assistant, using shared credentials, which is common and often technically prohibited and universally tolerated. It could be an attacker with a stolen session, which is the subject of a whole separate failure mode. And increasingly it could be a drafting agent operating with delegated access to the firm's systems.

The certification survived. The evidence for it did not. That is the entire story.

This is the same failure as email approval

If this feels familiar, it is because it is the same shape as a problem we have written about in a completely different industry. When a finance team approves a wire transfer by replying to an email, the approval inherits the security of the mailbox rather than proving anything about intent. We called that Mailbox-Grade Approval, and it is why business email compromise remains a multi-billion dollar category.

A court filing signature that is really a session login is the same pattern wearing a different suit. So is a click-to-sign e-signature that proves someone opened an email. In each case a high-consequence certification was quietly downgraded to whatever the surrounding channel could prove, and nobody noticed until an adversary or a tool made the gap visible. We catalogue this family of failures in the Identity Failure Map, because seeing the same defect in payments, in property records and in court filings is what makes it obvious that it is a defect in the design and not in the people.

Why don't AI disclosure orders fix it?

The profession's response has been fast and mostly sensible. Judges have issued standing orders requiring disclosure of generative AI use and certification that citations were verified. Firms have written AI policies. Bar associations have issued guidance, including the American Bar Association's 2024 formal opinion on generative AI, which addresses competence, confidentiality, candour and supervision obligations. These are the right instincts from people acting quickly with the tools available.

They have two limits.

The first is that a disclosure requirement asks a question about provenance when the duty is about inquiry. Whether a brief was drafted by an associate, a contract attorney, a research service or a language model has never been the point. A brief drafted entirely by a model with every citation personally verified by the signing attorney satisfies Rule 11 completely. A brief drafted entirely by a human with unverified citations does not. Disclosure sorts filings along an axis that does not correlate with the harm.

The second is that these certifications are themselves clicks. A standing order that requires an attorney to tick a box confirming that all citations have been verified adds a checkbox to a workflow, and a checkbox in a system is exactly as strong as the session that ticked it. This is a pattern we have named approval theatre: a control that looks like human oversight but sits entirely inside the process it is meant to supervise. Adding a certification checkbox to e-filing produces more certifications, not more inquiry.

None of this means courts should stop issuing the orders. It means the orders are a reasonable holding action rather than a fix, and the profession should be honest with itself about which one it has.

What would a filing receipt actually do?

Start with the crucial disclaimer, because overselling to this audience is fatal and deserved.

A filing receipt does not detect hallucinated citations. It cannot. Nothing in this proposal would have caught the four fake cases in the opening scene. The only cure for a fabricated citation is somebody reading the citation, and no cryptographic mechanism substitutes for that. Any vendor telling a law firm otherwise should be shown the door.

What a receipt does is restore the artifact that Rule 11 always assumed existed: verifiable evidence that a specific named human, not a session, put their certification on this exact text at this moment.

The mechanism is a signature from a device the attorney holds, over the hash of the final document as filed. Not a login. Not a typed block. A cryptographic assertion produced by a key in hardware on the attorney's own phone or laptop, covering the exact bytes that go to the docket.

{
  "type": "filing_receipt.v1",
  "document_hash": "sha256:4a71c0f9e2b8...7d3a",
  "caption": "Whitfield v. Ardmore Logistics, No. 3:26-cv-00412",
  "court": "N.D. Cal.",
  "attorney": {
    "name": "Jane Whitfield",
    "bar_number": "CA-241889",
    "key_id": "ak_1f9c22"
  },
  "certification": "FRCP 11(b)",
  "review": {
    "authority_check": "manual",
    "checked_citations": 14,
    "tool_assisted_drafting": true
  },
  "signed_at": "2026-09-16T23:14:07Z",
  "signature": "ed25519:MEQCIF2n..."
}

Three things in that object are worth dwelling on.

document_hash binds the certification to one specific text. If a paralegal assembles a new final version after the partner signs, the hash changes and the receipt no longer matches the filed document. That alone resolves a category of dispute that currently comes down to recollection and file metadata.

attorney.key_id names a key, and a key is held by a person rather than shared like a password. When the court asks who certified this, there is an answer that does not depend on anyone's memory of a Tuesday night.

review is optional and is the part firms will argue about. It lets the signer attest to what they actually did, which is a much more useful disclosure than whether a model was involved. A firm that will not attest to checking its citations is telling you something, and a firm that will has created a record that protects its own people when a client later claims nobody looked.

Verification is a few lines and requires no call to any vendor, which matters when a filing might be examined in an appeal five years later:

def verify_filing(receipt, filed_pdf_bytes, published_key):
    # the certification covers the document that was actually docketed
    h = "sha256:" + hashlib.sha256(filed_pdf_bytes).hexdigest()
    assert h == receipt["document_hash"], "filed text differs from certified text"

    body = json.dumps({k: v for k, v in receipt.items() if k != "signature"},
                      sort_keys=True, separators=(",", ":"))
    VerifyKey(published_key).verify(body.encode(),
        b64decode(receipt["signature"].split(":")[1]))
    return receipt["attorney"], receipt["signed_at"]

Where the drafting agent fits

The version of this that matters in two years is not the fabricated citation. It is the agent that drafts, cites, assembles and files with delegated access to the firm's document system, where the human touch point becomes genuinely ambiguous.

The receipt has room for that. A drafting agent operates under a scoped delegation signed by the supervising attorney, with an explicit boundary: draft and research, never submit. The agent's work is attributable, the attorney's certification is separate and human, and the chain between them is verifiable rather than asserted. We describe how those chains are constructed and checked in can an agent delegate to another agent, and the legal application is one of the cleaner uses of the pattern, because the profession already has a well-developed concept of supervisory responsibility to map onto it.

How do the proposals compare?

The honest reading of that table is that the last two rows are complements, not competitors. A citation validator catches the mechanical failure. A receipt establishes who is answerable when something gets through. Neither replaces reading the cases.

Honest limits

A signature does not prove reading. This is the most important limit and it must be stated without hedging. An attorney can sign a document from an enrolled device having read nothing. What the receipt establishes is that a specific human made the certification, deliberately, on this text, at this time. It converts an ambiguous audit trail into an unambiguous one. It does not read the brief for anyone.

Courts control e-filing, and courts move slowly for good reasons. There are fifty state systems plus the federal judiciary, each with its own technology governance and budget cycle, and none of them will adopt a new signature mechanism because a technology company thinks they should. The realistic entry points are firms and their document management systems, where a receipt can be generated and retained internally today, and malpractice carriers, who have a direct financial interest in a control they can verify. Court acceptance, if it comes, follows demonstrated practice rather than leading it.

It adds a step to a workflow that lawyers already experience as too long. A partner signing fifteen filings on a Friday will not enjoy fifteen additional device prompts, and any honest proposal has to address that rather than pretend friction is free. The sensible scope is filings where the stakes justify it: dispositive motions, appellate briefs, anything with sworn factual assertions, rather than every routine stipulation.

Shared credentials are a real practice with real reasons. Assistants file for attorneys constantly, and pretending otherwise produces a control everyone routes around. The workable design lets an assistant prepare and submit while the attorney's certification signature happens separately, which is closer to the paper world than current e-filing is.

This is not legal advice. Rule 11 practice, state analogues and disciplinary standards vary, and nothing here should be treated as guidance on compliance in any particular matter.

What to do this week

1. Ask your firm the question the judge will ask. For the last dispositive motion you filed, can you produce evidence that a specific human read the final text before it was submitted? Not a policy saying they should have. Evidence. Most firms discover the answer is no, and discovering it now is much cheaper than discovering it in response to an order.
2. Separate the two questions in your AI policy. Most firm policies conflate "was a model used" with "was the authority verified". Split them. The first is a disclosure matter. The second is the Rule 11 duty, and it applies identically whether the draft came from a model, an associate or a form book.
3. Run a citation validator on everything. This is the cheapest available intervention and it catches the specific mechanical failure that produces the sanctions orders. It is not sufficient and it is close to free.
4. Audit who has your e-filing credentials. Count the humans who can file under each attorney's account. If that number is greater than one, your signature block is a shared credential, and you should know that before a court does.
5. Write down what the certification means in your firm. One paragraph: who signs, what they must have done first, and what record exists of it. Firms that cannot write that paragraph do not have a process, they have a habit.
6. Bring it to your malpractice carrier. Ask whether a verifiable record of attorney certification affects your premium or your defence posture. Carriers are often ahead of firms on this, because they see the claims.
7. Treat the drafting agent question as urgent, not theoretical. If any tool in your firm can assemble and submit rather than only draft, define its boundary now, in writing, with a supervising attorney named.

If it helps to see the mechanism rather than read about it, the signing demo shows a device-bound signature over a document hash in about thirty seconds, and the documentation covers the receipt format and offline verification.

Rule 11 already had the answer

The most useful thing about this problem is that the profession does not need a new rule. It needs the old rule to be evidenced.

Rule 11 decided, long before anyone worried about synthetic text, that the correct place to locate responsibility is a named human at the end of the process who personally vouches for it. That decision has aged extraordinarily well. It is technology-neutral, it survives every change in how documents get produced, and it puts the duty exactly where the judgment is.

What the profession lost, quietly and without anyone deciding to lose it, was the artifact proving the certification happened. Paper had it by accident. Electronic filing dropped it in exchange for convenience, and for twenty years nothing came along to make the absence visible. Now something has.

The fix is not a disclosure form about which tools were used. It is a signature that means what Rule 11 always said it meant.

Frequently asked questions

Who is responsible when an AI tool fabricates citations in a court filing? The signing attorney. Rule 11(b) provides that by presenting a paper to the court, the signer certifies that the legal contentions are warranted, based on an inquiry reasonable under the circumstances. Courts have consistently applied that to fabricated authority regardless of what produced the draft. Delegating the drafting does not delegate the certification.

How many lawyers have been sanctioned for AI hallucinated citations? A public database of AI hallucination cases maintained by a researcher at HEC Paris had catalogued more than a thousand court decisions worldwide by mid-2026, growing at dozens per month, with sanctions ranging from modest fines into six figures for a single matter. Any exact figure goes stale quickly, so treat the trend rather than the count as the fact.

What does a Rule 11 signature certify? That to the best of the signer's knowledge, formed after an inquiry reasonable under the circumstances, the filing is not for an improper purpose, the legal contentions are warranted by existing law or a non-frivolous argument to change it, and the factual contentions have or will likely have evidentiary support. It is a personal certification with sanctions attached, not a formality.

Would a cryptographic filing signature prevent hallucinated citations? No, and any claim otherwise should be rejected. A signature binds a named human to a specific text. It cannot evaluate whether a cited case exists. The only cure for a fabricated citation is reading the citation. What the receipt fixes is the separate failure of not being able to establish who certified what.

Why don't AI disclosure orders solve the problem? Because they ask about provenance while the duty is about inquiry. A model-drafted brief with every citation verified satisfies Rule 11, and a human-drafted brief with unverified citations does not. Disclosure also usually takes the form of a checkbox, which inherits the security and the meaning of the session that ticked it.

Does electronic filing weaken the attorney signature? It changes what the signature evidences. Under CM/ECF conventions and most state systems, a login serves as the signature, so the artifact proves that someone with valid credentials uploaded a file. Paper fused a specific human to a specific document at a specific moment. Electronic filing kept the legal duty and dropped the evidence of it.

Could courts adopt this without changing the rules? Partially. Firms can generate and retain filing receipts internally today as a matter of practice and malpractice defence, with no court involvement at all. Court acceptance of receipts as part of the record would require technology committee attention and probably rule amendments, which is a multi-year path.

Sources

1. Federal Rules of Civil Procedure, Rule 11, Signing Pleadings, Motions, and Other Papers; Representations to the Court; Sanctions. law.cornell.edu/rules/frcp/rule_11
2. Damien Charlotin, AI Hallucination Cases database, catalogue of court decisions involving AI-generated fabricated content. damiencharlotin.com/hallucinations
3. American Bar Association, Formal Opinion 512 on generative artificial intelligence tools and the Model Rules of Professional Conduct, 2024. americanbar.org
4. United States Courts, CM/ECF electronic filing procedures and electronic signature conventions. uscourts.gov
5. PACER, public access to court electronic records, for retrieving the underlying orders discussed in coverage of AI sanctions. pacer.uscourts.gov
6. CourtListener, free access to dockets and opinions including the 2023 Southern District of New York matter widely treated as the origin case. courtlistener.com

Courts do not need a rule about artificial intelligence. They need the signature Rule 11 always assumed: a specific human, certifying a specific text, in a way somebody else can check.