Read on 30 September 2026. Every incident links to the source we read.
If you run a company with 10 to 200 people, you have probably had the pitch by now: a free audit, a number on the homepage, a guarantee, and a system that goes live in a week. We read a few dozen of those pages across the kinds of businesses we work with, then went looking for what regulators, courts, trade press and researchers have recorded when the same kind of offer went wrong. This page is what we found, one section per kind of business.
This page is not a vendor blacklist. No agency is named on it, and most of the people selling these systems are doing honest work. What repeats is the shape of the offer. Each section below shows where the public record says that shape breaks and the questions that would have caught it, and every incident links to the source we read.
Find your business, read the pitch you recognize, and take the questions to your next vendor call. If none of it applies to you today, keep the page around for the week a pitch like one of these arrives.
How it is sold to you. The headline is a headcount substitute: more placements without more recruiters, a pipeline that fills while you sleep. Scale is a profile count nobody can check, next to an accuracy figure with no method. ROI numbers are usually industry statistics. The funnel is a free audit, then a build or demo at a custom price. Bias testing, retention and compliance rarely make the page.
In May 2025, in Mobley v. Workday, a federal court preliminarily certified a collective of applicants aged 40 and over who applied through Workday's platform and were denied employment recommendations, noting that disparate impact cases rely on statistics and need no showing of intent. A firm whose vendor ranks or rejects candidates should expect the same theory (our reading).
iTutorGroup programmed its application software to automatically reject women aged 55 or older and men aged 60 or older, rejecting more than 200 qualified U.S. applicants. It settled with the EEOC in September 2023 for $365,000, with at least five years of monitoring. The rule was simple, and the employer paid.
Source: iTutorGroup to Pay $365,000 to Settle EEOC Discriminatory Hiring Suit (EEOC)
The UK Information Commissioner's Office audited AI recruitment tools and reported in November 2024 that some let recruiters filter out candidates by protected characteristics, some inferred gender and ethnicity from a candidate's name, and some collected far more personal information than necessary and kept it indefinitely. It made almost 300 recommendations, all accepted or partially accepted.
Source: ICO intervention into AI recruitment tools leads to better data protection for job seekers (ICO)
LinkedIn's help page says it does not permit third-party software such as crawlers, bots, browser plug-ins or extensions, and that members using them risk having their accounts restricted or shut down. Many sourcing and outreach products automate those exact actions (our observation), and your recruiters' accounts carry the risk.
What we would look at first. We would start where recruiters lose the day, call notes, scheduling, follow-up, where a wrong answer is cheap to catch. Ranking or rejecting a person comes last, if at all, with a selection-rate check we run ourselves, and nothing touches LinkedIn through a tool LinkedIn prohibits.
How it is sold to you. The lead promise is replacement: your agency, a marketing hire, support headcount, at a fraction of the cost. Support automation is sold on a resolution percentage stated as a headline rather than a measured result for a named client. A new worry gets a name, AI search, agentic commerce, and an audit is sold to answer it. Proof is testimonials, logos and aggregate ROAS.
Air Canada's chatbot told a customer he could buy a full-price ticket and apply within 90 days for a bereavement refund, contradicting the airline's actual policy. Air Canada argued the chatbot was a separate legal entity responsible for its own actions. The tribunal rejected that, found negligent misrepresentation and awarded CA$812 plus costs. The standard is what a returns bot now works under.
Source: Moffatt v. Air Canada (BC Civil Resolution Tribunal, 2024 BCCRT 149), summary
Klarna said in February 2024 that its AI assistant did the work of 700 agents and handled about 75% of customer chats. By May 2025 its CEO told Bloomberg the company was hiring human agents again, saying it is critical to be clear with customers that there will always be a human if they want one.
In January 2024 Futurism reported Amazon listings titled "I'm sorry but I cannot fulfill this request it goes against OpenAI use policy" and a description containing the placeholder "[task 1], [task 2], and [task 3]." Futurism read them as sellers generating copy without proofreading. Amazon said it had removed the listings.
The FTC's final rule on fake reviews, announced August 14, 2024, bans reviews that misrepresent they are by someone who does not exist, such as AI-generated fake reviews, or by someone with no actual experience of the business, and lets the Commission seek civil penalties against knowing violators.
Source: Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials (FTC)
What we would look at first. We would start behind the storefront, where a mistake is cheap: ticket tagging, draft replies a person sends, catalog cleanup a person approves. A customer-facing bot comes later, with the path to a human measured in clicks and a kill switch we have tested.
How it is sold to you. The product is sold as an AI version of you, your thinking on demand in your voice, so nothing changes except capacity. The promise is time and scale, without burnout, 24/7, live in under a week. Setters are priced against a human setter, or per booked call. Proof is self-reported counters and Instagram testimonials. Risk sits on a guarantee or a trial rather than on evidence.
In Operation AI Comply (September 25, 2024) the FTC sued business-opportunity sellers who dressed earnings claims in AI language; one took at least $25 million promising its AI tools would help consumers quickly earn thousands a month. The same sweep announced a proposed settlement with an AI writing tool whose review feature could generate unlimited consumer reviews.
Source: FTC Announces Crackdown on Deceptive AI Claims and Schemes (Operation AI Comply)
Air AI sold a conversational AI billed as replacing human customer-service reps, telling buyers they would earn back tens of thousands of dollars in days or months, with full refunds if they did not. The FTC sued on August 25, 2025, alleging the guarantee was rarely honored and buyers lost as much as $250,000.
On February 8, 2024 the FCC ruled, effective immediately, that calls made with AI-generated voices are artificial voices under the Telephone Consumer Protection Act, so telemarketing with them needs the prior express written consent FCC rules already require. The release does not say who holds the consent record; we would want it to be you.
Source: FCC Makes AI-Generated Voices in Robocalls Illegal (FCC press release, February 8, 2024)
TechCrunch reported on June 16, 2025 that Instagram users were complaining of mass bans for violations they say they never committed, with appeals unanswered. A gym owner said the ban had directly affected his business; another user relied on Instagram for leads. Users suspected AI moderation without direct evidence; Meta had offered no on-record statement.
Source: Instagram users complain of mass bans, pointing finger at AI (TechCrunch)
What we would look at first. We would start with what the audience never sees: the admin behind delivery, the follow-up a person still sends, the student questions with one right answer. Anything that speaks as you to a prospect gets a disclosure line and a review log first.
How it is sold to you. The lead is lost revenue from missed calls, quantified with a borrowed statistic and a dollar table. Agents get human first names so you picture a hire. "Never miss" and "24/7" framing is near universal. Entry is cheap or free, with the real engagement priced later. "HIPAA compliant" is a badge with no business associate agreement or retention terms on the page.
In Mata v. Avianca a New York federal judge sanctioned two lawyers and their firm $5,000 in June 2023 after a filing cited six judicial opinions that did not exist, created by ChatGPT. Existing rules, the court wrote, impose a gatekeeping role on attorneys to ensure the accuracy of their filings.
Source: Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023), sanctions opinion
On April 8, 2026 patients filed a proposed class action in federal court in California against Sutter Health and MemorialCare over an ambient AI scribe, alleging their conversations were recorded, sent outside the clinical setting or processed by third-party systems without meaningful, informed consent. It is an allegation; the consent script is the part a practice controls.
A randomized trial of 238 physicians across 14 specialties at UCLA Health compared two ambient AI scribes with usual care. One cut time in the note by 9.5 percent; the other's reduction was not significant. Omissions were the most reported error, and the authors concluded ongoing physician oversight will be necessary to prevent clinically significant omissions.
Source: Ambient AI Scribes in Clinical Practice: A Randomized Trial (NEJM AI, PMC full text)
On June 24, 2026 the IRS Office of Professional Responsibility released guidance on how Circular 230 applies to practitioners' use of AI. Per the AICPA's summary, AI must be used with human oversight, professional judgment, due diligence, confidentiality safeguards and accountability, and does not replace professional judgment.
What we would look at first. We would start with the phone and the inbox, where the AI's job is to take a message and book a slot, and read the consent and retention terms before the demo. Notes, drafts and filings keep a licensed reviewer and a log.
How it is sold to you. The hook is a time or headcount multiple with no named customer behind it. Speed to go-live is a selling point, live in 48 hours, a quote in 60 seconds, which skips the data cleanup and the TMS integration. Dollar outcomes are quoted per segment, so they cannot be checked against a real P&L. Nobody shows an error rate.
Fraud rings use AI-generated voices and synthetic identities to bypass carrier verification calls, Overhaul's intelligence director says, and a Descartes account executive told FreightWaves that brokerages get calls from AI bots on the carrier side. Her advice: ask drivers real-time questions about the weather, because routine questions are what the bots are programmed to answer.
CargoNet's Labor Day analysis says criminals enter trusted freight channels through compromised carrier accounts, email systems, business phones or compliance platforms, and may change delivery instructions after a legitimate carrier takes possession. CargoNet does not discuss AI; an email agent that executes a reroute without a second channel widens that window (our inference).
Scammers hack carriers' email, mine old sent mail for insurance and authority documents, then book loads from the carrier's own address while intercepting the broker's replies. One victim broker had over 400 loads posted in their name in an hour. An agent that posts loads needs the same identity controls as a person.
Source: Impersonation Attacks Are Here To Stay (FreightWaves, Sep 10, 2025)
MIT Project NANDA's July 2025 preliminary report found that for enterprise-grade systems 60% of organizations evaluated them, 20% reached pilot and 5% reached production. Most fail, the authors say, due to brittle workflows, lack of contextual learning and misalignment with day-to-day operations. The sample was small and self-selected, and the report says so.
Source: The GenAI Divide: State of AI in Business 2025 (MIT Project NANDA, preliminary findings, July 2025)
What we would look at first. We would start with the inbox and the check call, and map which instructions an agent may act on alone. Then the data: where pickup windows, rates and accessorials live today, because the integration is the project. Carrier vetting keeps a person on the line.
How it is sold to you. Speed is the headline, 10x faster proposals, a first draft in under five minutes, with win-rate claims second. Compliance badges are the trust layer, FedRAMP in some state, CMMC Level 2, SOC 2, "no AI training on your data," often without saying which tier or boundary the badge covers. Proof is aggregate dollars attributed to customers, and pricing is almost never shown.
In September 2025 GAO dismissed three bid protests by a Las Vegas small business as an abuse of its process after the filings cited decisions that do not exist and misdescribed a real one. GAO wrote that the errors bear the hallmarks of the use of a large-language model or other artificial intelligence without adequate verification.
Source: GAO decision, Oready, LLC, B-423649 et al., September 25, 2025
Deloitte delivered a 237-page report to Australia's Department of Employment and Workplace Relations in July 2025 containing fabricated references, including nonexistent academic papers and a false quote attributed to a judge. A revised version disclosed that Azure OpenAI was used in drafting, and Deloitte agreed to refund the final installment of the roughly $290,000 contract.
Source: Fortune: Deloitte to refund Australian government after AI hallucinations in report
The clause requires any external cloud service provider used to store, process or transmit covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. It does not name AI tools. A free chatbot tier is an external cloud service, so covered defense information pasted into it has to meet that bar (our reading).
In June 2026 an Alabama defense contractor paid $507,144 to settle allegations that it knowingly submitted false claims on two Navy contracts while it had not implemented required NIST SP 800-171 controls; a government assessment scored it at -170 on a scale that runs from -203 to 110. A product that drafts the system security plan and fills in the score does not change who signs.
What we would look at first. We would start with the boundary: what counts as covered defense information and which tools may touch it, written down before anyone pastes anything. Then the proposal library, because a drafting tool is only as good as what it draws from.
If you have a proposal on your desk, bring it to a 20-minute call and we will read it with you and tell you which of these questions to ask first. If none of this applies to your business, we will say that too.