Your Vendor’s Shortcut Is Still Your Decision
A newspaper, a government department, a drugstore chain and a legal research startup each learned what had happened in their own supply chain from someone outside it.
On May 18, 2025, the Chicago Sun-Times ran a summer guide called “Heat Index.” Its reading list recommended fifteen books. Ten of them did not exist.
Nobody at the Sun-Times wrote that list. The section was licensed from King Features, a Hearst division, and written by a freelancer who later said he had used AI and had not checked what it produced. The paper’s own review found that no Sun-Times journalist looked at the section before it ran, and that it ran without telling readers it came from outside the newsroom.
None of that mattered to the people holding the paper. The masthead said Chicago Sun-Times.
The paper said so itself. It called the failure to disclose where the section came from “unacceptable,” stopped buying special sections from that partner, and pulled the section from its archive. That is what owning it looks like after the fact. The more useful question is what owning it looks like before.
The same chain, again and again
A government review. In December 2024, Australia’s Department of Employment and Workplace Relations commissioned Deloitte to review the IT system behind its welfare compliance framework. The review cost A$440,000 and was published in July 2025. A University of Sydney academic, Chris Rudge, then found references to reports that do not exist and a quote attributed to a federal court judgment that the judgment does not contain. An updated version disclosed that part of the work used a generative AI tool chain built on Azure OpenAI GPT-4o. Deloitte repaid the final installment of its fee. The department said the substance and recommendations of the review were unchanged.
One detail makes this case useful rather than just embarrassing. According to the disclosure, the tool was licensed by the department and hosted in the department’s own cloud. The buyer owned the tool. The public record of how its contractor had used it arrived only in the corrected version, after an outsider read the footnotes.
A drugstore chain. In December 2023, the Federal Trade Commission alleged that Rite Aid had used facial recognition in hundreds of stores between 2012 and 2020, and that the system flagged customers as matches to a watchlist when they were not. According to the FTC, one vendor’s contract stated, in capital letters, that it “MAKES NO REPRESENTATIONS OR WARRANTIES AS TO THE ACCURACY AND RELIABILITY OF THE PRODUCT,” and Rite Aid never asked that vendor whether the system had been tested. Rite Aid agreed to a five-year ban on using facial recognition for surveillance, and said it “fundamentally disagree[s] with the facial recognition allegations.”
Set the dispute aside and look at the paperwork. The vendor did not hide the limit. It wrote it down. What nobody can show is who on the buying side owned reading it.
A legal research startup. ROSS Intelligence wanted to build an AI research tool to compete with Westlaw. It hired a vendor, LegalEase, which worked with a subcontractor, Morae Global, to write roughly 25,000 training memos. The memo writers used thousands of Westlaw headnotes to frame the legal questions, because the headnotes offered “an easy way” to do it. On September 29, the Third Circuit ruled against ROSS on fair use. In footnote 2, the court notes that ROSS “is not challenging” that “LegalEase and Morae Global’s actions are attributable to ROSS.” Two links down the chain, ROSS did not try to put distance between itself and the people doing its work.
The court also named why the shortcut was taken. The court opinions themselves are public. The headnotes were easier. In the court’s words: “Unlike necessity, ease is not a justification for copying.” ROSS announced in December 2020 that it was shutting down, citing the cost of the lawsuit. The case outlived the company.
The wrong default
The default is that responsibility travels with the work. You hire a syndicate, a consultant, a vendor or a data contractor, and the judgment about whether the work is good enough goes out the door with it.
It does not. The work moves. The decision to accept the work stays with the organization whose name goes on the result. In every case above, that decision was made. It just was not made by anyone who knew they were making it. A section ran unread. A disclaimer sat in a contract nobody questioned. References went out unchecked. A data method went unexamined. Each was a decision to accept, made by default.
Call it the last link. Every supply chain ends at the name the public sees, and putting your name there is a choice. It is the moment you accept the work. The only question is whether anyone on your side made that choice on purpose.
What this is not
It is not a case against outsourcing. Every organization here had good reasons to buy expertise, content or technology it did not build itself. That is how most organizations should work.
It is not only about AI. Rite Aid’s program began in 2012. The Sun-Times errors came from one freelancer’s unchecked draft. What AI changes is the speed and cost of the shortcut, and how plausible the result looks when it arrives.
And it is not legal advice. Who is liable for what is a question for your counsel, and the answer differs by country, by contract and by court. The governance question is narrower and comes first: does anyone in your organization own the decision to accept what the chain hands you?
Five questions for the chain
1. Can you name who actually produced the work or the data you rely on, including the subcontractors?
2. Is that answer written down somewhere you control, or does it live in the vendor’s sales deck?
3. Has anyone on your side read what the vendor put in writing about accuracy, testing and limits, and acted on it?
4. Who signs off before a vendor’s work goes out under your name?
5. If an outsider found a problem tomorrow, would your own process have found it first?
So own it
Look at how each of these came to light. Reporters exposed the reading list. An academic flagged the footnotes. A federal regulator laid out the facial recognition. The company whose content was copied took the training data to court. In all four, the problem surfaced through someone outside the organization, not through its own review.
That is the cost of leaving the last link unowned. Not that a shortcut gets taken; shortcuts are going to get taken. It is that when one surfaces, you are the last to know and the first to answer for it.
If you want a quick read on where your own organization stands, the free Decision Ownership Check takes about two minutes: ten questions and an AI Governance Exposure score from 0 to 100. It is a directional read, not a validated diagnostic. fellowshipintelligence.com/decision-ownership-check
Sources
• Chicago Public Media review of the King Features special section, reported by WBEZ, May 30, 2025: https://www.wbez.org/media/2025/05/30/special-section-king-fake-book-list-errors-sun-times-review
• Fortune, report on the King Features freelancer and the fake book list, May 22, 2025: https://www.fortune.com/2025/05/22/ai-king-features-newspaper-writer-fake-book-list
• Yahoo News, “Chicago Sun-Times features non-existent books, people: How it happened,” May 2025: https://www.yahoo.com/news/chicago-sun-times-features-non-204050790.html
• Department of Employment and Workplace Relations, Targeted Compliance Framework Assurance Review, Final Report, updated September 26, 2025: https://www.dewr.gov.au/assuring-integrity-targeted-compliance-framework/resources/targeted-compliance-framework-assurance-review-final-report
• Accounting Times, “Deloitte to refund government after using AI in $440k report,” October 9, 2025: https://www.accountingtimes.com.au/technology/deloitte-to-refund-government-after-using-ai-in-440k-report
• Malay Mail, report on Deloitte’s partial refund, citing The Guardian, October 7, 2025: https://malaymail.com/news/world/2025/10/07/deloitte-to-pay-partial-refund-to-australian-govt-for-report-using-ai/193773
• TechSpot, “Deloitte admits AI hallucinated quotes in government report, offers partial refund,” October 7, 2025: https://www.techspot.com/news/109758-deloitte-admits-ai-hallucinated-quotes-government-report-offers.html
• Federal Trade Commission, “Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards,” December 19, 2023: https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without
• Federal Trade Commission, complaint, FTC v. Rite Aid Corporation, December 2023 (paragraphs 51 and 52): https://www.ftc.gov/system/files/ftc_gov/pdf/2023190_riteaid_complaint_filed.pdf
• CNN, report on the Rite Aid settlement and Rite Aid’s statement, December 20, 2023: https://edition.cnn.com/2023/12/20/tech/rite-aid-ai-ftc-settlement
• U.S. Court of Appeals for the Third Circuit, Thomson Reuters Enterprise Centre GmbH v. ROSS Intelligence Inc., No. 25-2153, September 29, 2026: https://chatgptiseatingtheworld.com/wp-content/uploads/2026/09/Thomson-Reuters-v.-ROSS-Intelligence-252153p.pdf
• LawSites, report on ROSS shutting down, December 2020: https://www.lawnext.com/2020/12/legal-research-company-ross-to-shut-down-under-pressure-of-thomson-reuters-lawsuit.html
