BUSINESS SPEED
WHY YOUR AI WON'T READ
THE CODIFICATION
What the controller is about to see
asc.fasb.org to verify against the current authoritative codificationPart 6 of this series showed that across five frontier AI surfaces, all five claimed to have verified ASC 842 guidance, and the substance behind those claims varied catastrophically. The strongest verification observed — Surface D, which retrieved an FASB amendment document directly and quoted from it — still fell short of the authoritative source. The amendment PDF shows what changed in December 2025. It does not show ASC 842 as it stands today with that amendment incorporated.
The current authoritative GAAP literature — the codification that auditors will reference, that the SEC will check against, that a controller's memo conclusion ultimately rests on — lives at asc.fasb.org. Zero of the five frontier AI surfaces tested reached it.
This is not a model-capability gap. It is a structural gap, sitting at the intersection of two constraints the controller cannot see from inside the AI's response. This article names those two constraints, explains the legal context driving the larger one, and tells the controller what to do about it in May 2026 without waiting for the law to settle.
The two constraints behind every AI verification claim
When an AI's verification stops short of the authoritative source, the cause is one of two constraints — sometimes both. They look identical in the AI's response. They are very different in what the controller can do about them.
Constraint 1 — Publisher-side access control
The party that publishes the authoritative source decides who can read it and under what terms. For FASB-issued guidance, the access map looks like this:
- fasb.org (the standards-setter's main site) — public, but increasingly behind anti-bot protection. In the multi-vendor test, one AI surface attempted a direct fetch of an FASB project-listing page and received an HTTP 403 from the publisher's anti-bot layer. That block applies to many automated agents, not selectively to one vendor.
- storage.fasb.org (where amendment PDFs live) — public, no registration required. One AI surface in the test reached an amendment PDF here directly.
- asc.fasb.org (the current authoritative codification) — license-terms click-through required for Basic View; account registration required for Professional View features. The Financial Accounting Foundation eliminated the former paid Professional View subscription in favor of free enhanced Basic View access. Browsers landing on asc.fasb.org are prompted to accept license terms before reading the codification. The click-through is a UI interaction step, not a paywall — but AI agents typically do not execute interactive click-through agreements as part of their fetch behavior, and the Professional View's deeper search/copy functions still require account registration. None of the five frontier surfaces tested navigated either gate.
The asymmetry: the controller can accept the license-terms click-through at asc.fasb.org for Basic View in seconds, and register for free Professional View features in under two minutes. The AI typically does neither. For technical accounting research specifically, the most important authoritative source is gated by a UI interaction step only a human routinely performs.
For broader technical accounting sources, the access map varies:
- SEC EDGAR (filings, comment letters): open, no registration, AI-fetchable.
- AICPA technical guidance, professional standards: largely registration-gated.
- Big-4 audit firm publications (Deloitte DART, PwC Viewpoint, KPMG, BDO Insights): mixed — some open access, many login-gated, some paid.
- Subscription codification tools (Thomson Reuters Checkpoint, Wolters Kluwer CCH, RIA): subscription-only, not AI-accessible.
A controller asking an AI to "check the codification" against the authoritative source is, in May 2026, asking for something none of the five surfaces tested actually performed. The codification access requires a UI interaction (license-terms acceptance) that AI agents typically do not execute in their default fetch behavior. Whether this constraint changes as AI surfaces evolve is unsettled. What is settled — at least across the five-surface test — is that controllers should not assume AI has performed a Level 1 codification check unless the AI provides verifiable ASC paragraph evidence with subtopic-paragraph citation.
Constraint 2 — Vendor-side retrieval policy
Even when the publisher's gate is open, the AI's vendor decides whether the model's harness will attempt the fetch. This is the constraint that has shifted measurably in the legal climate of 2024–2026, and the constraint a controller cannot see from inside a single AI session.
The legal climate is documented. As of May 2026:
- NYT v. OpenAI (S.D.N.Y., filed December 2023) remains active in pretrial discovery. A federal judge rejected OpenAI's motion to dismiss in March 2025; the court ordered OpenAI to produce 20 million anonymized ChatGPT logs in a January 5, 2026 ruling.
- In re OpenAI Copyright Infringement Litigation (MDL No. 1:25-md-03143) consolidates multiple copyright suits brought by news organizations, authors, and content creators in the Southern District of New York. The MDL Panel's April 3, 2025 transfer order centralized twelve cases initially; secondary sources have reported additional actions joining the MDL since. The current docket count should be verified against the SDNY case management system before publication.
- Advance Local Media et al. v. Cohere, Inc. (No. 1:25-cv-01305, S.D.N.Y., Feb 13, 2025) directly targets retrieval-augmented generation and alleged paywall bypass — the most legally relevant case for the question of AI primary-source fetch.
- Bartz v. Anthropic (settled 2025) and Kadrey v. Meta (June 25, 2025) produced record-specific fair-use rulings for AI training — Bartz leaving piracy/acquisition claims outside the fair-use protection (with the eventual $1.5 billion class-action settlement covering those acquisition-side claims), Kadrey turning on the summary-judgment record and plaintiffs' failure to prove market harm at that procedural posture. Both rulings addressed training, not real-time retrieval of copyrighted authoritative sources at query time.
- The U.S. Copyright Office's Part 3 report (May 9, 2025) explicitly flags paywall bypass for retrieval-augmented generation as an unsettled legal question.
The behavioral pattern in May 2026 frontier AI surfaces is consistent with — though not provably caused by — the legal climate above. In the five-session test:
- Two surfaces did not attempt primary fetch at all (stopping at search snippets or secondary commentary).
- One surface ran tool-use theater on local files rather than reaching for publisher sources.
- One surface attempted a direct primary fetch and was blocked by publisher anti-bot protection — declared the block openly.
- One surface successfully retrieved an amendment PDF directly.
The variance suggests vendor-level differences in tool-use policy. Without published policy documentation from each vendor — which is not uniformly available — the causation is observable, not proven. What is observable is that primary-source retrieval is not a default behavior of frontier AI surfaces in May 2026. It is a behavior that varies by vendor, varies by surface, and cannot be assumed.
Why the legal context matters for the controller. A controller does not need to read pretrial pleadings to act on this. The practical implication is one sentence: in 2026, AI vendors face active, expensive litigation over how their tools retrieve copyrighted authoritative content, and primary-source retrieval behavior varied widely across the five-surface test — whether the legal climate is causing the variance or merely coincides with it is not provable from public materials. The controller's reliance posture has to take observed primary-source retrieval as variable, vendor-specific, and not a default behavior. Whether the variance is driven by litigation risk, vendor policy choice, or technical constraint is a question for vendor-side transparency, not for the controller to resolve from inside an AI session.
The verification distance hierarchy
Combining the two constraints produces a hierarchy of what AI verification can actually reach for technical accounting work in May 2026. From closest to authoritative GAAP, to furthest:
Level 1 — Current authoritative codification (asc.fasb.org). License-terms click-through required for Basic View; account registration for Professional View. Zero of five frontier AI surfaces tested reached this. This is the source a workpaper conclusion ultimately rests on.
Level 2 — Amendment registry and amendment documents. The FASB ASU issuance list (fasb.org/standards/accounting-standard-updates) and individual amendment PDFs (storage.fasb.org/ASU%20XXXX-XX.pdf). One AI surface in the test retrieved a PDF here; one accessed the issuance list. Neither is the current consolidated codification — these show what changed, not what currently is.
Level 3 — Publisher-managed reference pages. FASB project pages, post-implementation summaries, news releases. Sometimes accessible to AI agents, sometimes anti-bot blocked. One test surface attempted access here and was 403-blocked.
Level 4 — Audit firm professional commentary. Deloitte DART, PwC Viewpoint, KPMG, BDO. Generally login-gated. AI surfaces typically can read open-access summary pages but not full content behind firm logins. Several test surfaces relied on these as the highest-quality source they reached.
Level 5 — Third-party alerts and summaries. News articles, accounting trade press, individual firm bulletins, search engine snippets. Always AI-accessible. One test surface anchored its entire verification claim on Level 5 content while reporting the result as if it were Level 1.
A controller cannot distinguish among Levels 1 through 5 by reading the AI's deliverable. The five test memos all wore identical surface language. The difference only becomes visible when the controller asks: Quote what source you checked. That single interrupt forces the AI to disclose which level its verification rests on.
What the controller does in May 2026
Three controls — applied together — operate at the structural constraint, not the surface symptom.
1. Treat AI verification as Level 2 maximum, by default
Unless the AI produces a quoted source with locator information from Level 1 or Level 2 — and even Level 1 is unreachable across all five test surfaces — assume AI verification stops at the amendment registry, the publisher's reference pages, or below. This is not a pessimistic posture; it is the empirical finding across five frontier surfaces in May 2026. The controller's workpaper should record AI verification as "AI confirmed against [Level 2 / Level 3 / Level 4 / Level 5] source" — with the level explicit — rather than as "AI verified."
2. Open the asc.fasb.org gate yourself
The codification access page at asc.fasb.org presents a license-terms click-through before delivering the Basic View; deeper Professional View features (advanced search, copy/paste) require a free user account. Both steps take under two minutes; both are no-cost. The click-through alone is what AI agents typically do not navigate. For any memo conclusion that will appear in a financial statement, a footnote, or an audit deliverable, the controller's workpaper should include the controller's own Level 1 check — citation with subtopic, paragraph, and the date the codification was accessed. This is the layer that converts AI-assisted research into auditable conclusion.
3. Build the dual-layer architecture into standard practice
For every AI-assisted technical accounting memo, the workpaper carries two artifacts, not one:
- AI artifact: the request as written, the AI's verification statement, the AI's response to the source-quote follow-up (from Part 6's controls).
- Controller artifact: independent Level 1 check at asc.fasb.org, with citation and access date, performed by a named human reviewer.
The AI artifact accelerates research. The controller artifact carries authority. Combining them produces a workpaper that survives auditor and regulator review and documents the work the AI actually did. Separating them prevents the two from being conflated — which is the failure mode that produces a memo signed off on AI verification that never reached the codification.
The deeper question
The legal climate is unsettled. NYT v. OpenAI has no trial date. The Cohere RAG case is in early proceedings. The Copyright Office's Part 3 explicitly states no prejudgment of outcomes. Five frontier AI vendors are operating with varying degrees of caution while the law is in motion.
The controller cannot wait for the law to settle. The May 2026 close, the next 10-K, the next memo on the next lease all require authoritative verification that will not be delivered by AI alone for the foreseeable future — and may not be delivered by AI alone after the law settles either, given the click-through gate at the codification level that sits outside the legal landscape.
What changes between May 2026 and whenever the legal landscape resolves is unlikely to be whether AI reaches the codification. The click-through gate is structural. What changes is whether AI vendors expand or contract their tool-use policies around the levels below the codification — Levels 2 through 5. Those changes will be invisible to the controller from inside any single AI session. The dual-layer architecture above does not depend on which way they go.
The architecture question for any AI tool the controller is evaluating is the one that survives the unsettled legal landscape: does this tool clearly disclose what level of source its verification reached, and does the workpaper architecture around it cleanly separate AI proxy work from authoritative controller verification? If the answer is no, the controller is the only thing standing between AI-assisted research and a workpaper that does not survive audit. That is a position controllers should not be in by accident.