Field note
ChatGPT Citations That Look Right: Verify Them
A citation-shaped answer is not evidence. Open the source, check that it says what ChatGPT says it says, and mark every claim that the source does not support.
A citation-shaped answer is not evidence. Open the source, check that it says what ChatGPT says it says, and mark every claim that the source does not support.
What the risk is
ChatGPT can produce a reference that has the right shape: an author, a year, a journal or a court, a page number, a URL. Some of those references are real and accurate. Some are real sources that do not say what the answer claims. Some do not exist at all. The model is completing a pattern, and a confident citation is part of the pattern.
Web search and deep research reduce the problem, because the model is reading a live page and linking to it. They do not remove it. The link may be real while the sentence in front of it overstates, misdates or misreads the page.
For a UK business the risk is not academic. In 2025 the High Court of England and Wales dealt with cases in which lawyers had put fabricated citations before the court, and the judiciary's guidance on AI warns that such tools can produce plausible but incorrect references. The same thing happens in tender responses, health and safety statements, marketing claims and HR letters.
A realistic example
A small accountancy practice asks ChatGPT for the HMRC rules on a particular relief and receives a clear answer with three references to HMRC manuals and a tribunal case. Two manual references are real and relevant. The third points to a real manual page that covers a different relief. The tribunal case does not exist. The answer is fluent and mostly right, which is exactly why it is dangerous: the reviewer trusts the two good references and does not check the other two.
The damage is not that ChatGPT was wrong. The damage is that the practice sent the advice with the practice's name on it.
The claim-first check
Check claims, not citations. Start from the sentence you are relying on and work backwards.
- List the claims that matter. A number, a date, a legal duty, a price, a product capability, a quotation. Ignore the connective prose.
- For each claim, open the cited source. Not the search result, the actual page or document.
- Find the supporting text. Search within the page for the key term or figure. If the claim is a quotation, search for the exact words.
- Grade it. Confirmed: the source says this. Weaker: the source is real but says something narrower or older. Not found: the source does not contain it or does not exist.
- Check the date and the authority. A 2021 blog post and the current gov.uk page are not equal, even if both exist.
- Fix the document. Delete not-found claims. Rewrite weaker claims to match what the source actually says. Keep the grading in a note next to the document.
If you cannot open a source, treat it as not found. A citation you cannot check is worth nothing.
Signs a citation needs extra care
- A case name, journal or report that returns no result on a normal search.
- A URL that looks plausible but returns a 404 or redirects to a home page.
- A DOI, ISBN or case number in the right format that resolves to a different work.
- A quotation that is too neat, with no page or paragraph number.
- A statistic with a precise decimal and a vague source such as "a 2023 industry survey".
- Two citations that support the same sentence with slightly different numbers.
- A source the model cannot have read: a paywalled paper, a document behind your own login, or a page published after the model's training date, when web search was off.
Make the model help you check
You can use ChatGPT to make its own output easier to verify, as long as you still do the opening and reading yourself.
- Ask for the exact supporting sentence from each source, in quotation marks, and the URL.
- Ask it to separate what the source states from what it infers.
- Ask for a list of claims it could not source. A model told to say "I could not find a source for this" will often do so, which is more useful than a fabricated reference.
- Turn on web search for anything factual and current, and then still open the links.
- Do not ask it to "verify" its own citations in the same conversation. It will tend to confirm them.
What to write into policy
A short paragraph in your AI use policy is enough:
- Any external-facing document, legal or regulatory statement, or financial figure that came from an AI tool must have its sources opened and checked by a named person before it is sent.
- Citations that cannot be opened are removed, not kept.
- The reviewer records the check in the document or the ticket.
- Advice in a regulated area goes to a qualified person regardless of how well it is referenced.
If you want help turning that into a working control set with owners and evidence, an AI governance review is the right place to start. For research-heavy work, our note on deep research source control covers how to set the source boundary before the run.