Risks, regulations and responsible use

The four failure modes that matter

1. Hallucinated numbers

The single most dangerous thing a research bot does is invent specific numbers. Asked for a company's revenue in 2023, the bot will produce a confident figure. Sometimes the figure is right. Sometimes it is the right shape but the wrong year, or the right year but for a slightly different metric (revenue versus net revenue versus operating revenue). Sometimes the figure is entirely made up.

The mitigation is the one we have already built in: the bot must cite every figure to a specific source. If you cannot trace it back to a document, it does not exist. Treat unsourced numbers from the bot the same way you would treat a financial claim from a stranger in a bar.

2. False confidence

The model produces fluent text. Fluent text reads as authoritative. Authoritative text persuades. This chain is what makes the bot dangerous when it ventures outside what it actually knows.

Specific patterns to watch for: the bot using the present tense for a past event ("the company is launching" when the launch is months old), the bot stating a market position confidently ("they are the leader in" when they are actually third or fourth), the bot describing strategy ("their strategy is to" when it is summarising old material).

The mitigation is calibration. The bot should distinguish "the document says X" from "I infer X from the document" from "I am guessing X". Push back any time the model collapses these.

3. Drift from research to recommendation

This is the slow failure. You start using the bot for research, as designed. After a few weeks you find yourself asking it adjacent questions: "Is the management team competent?" "Is the strategy realistic?" "Are the risks manageable?" These look like research questions. They are starting to be opinion questions. Within a month, you may find yourself asking the bot what it would do — and getting an answer that sounds informed even though it is not.

The personal rule you wrote in Lesson 1 is what stops this. Re-read it occasionally. The drift is gradual and the brake is psychological, not technical.

4. The third-party problem

So far we have assumed you are using the bot for your own research. If you start sharing the bot's outputs with other people — a colleague, a client, a relative — the regulatory and ethical landscape changes immediately. Anything that looks like a recommendation made to another person can be construed, under various jurisdictions, as unlicensed financial advice.

The mitigation is: when sharing the bot's output, always describe it as the bot's output, never as your view; never include the bot's prose unedited in client work; never use the bot's output to support a recommendation to anyone else without independent verification.

The regulatory frame, slightly deeper

Lesson 1 covered the basics. Two specific points are worth knowing in more detail.

The EU AI Act and financial AI. The Act came into force in August 2024. It classifies AI systems used in financial decision-making — credit scoring, insurance, fraud detection — as "high-risk". High-risk systems must meet transparency, documentation, human-oversight, and record-keeping requirements. A consumer research bot used personally is below this threshold. A product that markets itself as helping users make investment decisions is closer to the threshold. A product that gives binding recommendations or executes trades is above it. The trajectory of the regulation is to tighten over time.

Insider information and the bot. If you give the bot access to non-public material — for example, you are an employee and you paste in unreleased internal numbers — then any decision you make is potentially in breach of insider trading rules. This applies regardless of whether the bot is involved. The point: the bot does not change the underlying legal rules. If a piece of information would be insider information in your hands, it remains insider information when you paste it into a bot.

What this means for you. For personal research using public sources, you are fine. For anything that touches non-public information, talks to other people's money, or markets itself as decision support, you need to talk to a qualified compliance specialist before you do anything else.

How a serious investor uses tools like this

To take some of the pressure off, here is roughly how a serious investor — an analyst at a hedge fund, a portfolio manager at an asset manager, a corporate development team at a strategic acquirer — uses AI tools today.

• Triage of public material. The same use you are building — reading, summarising, comparing, characterising sentiment. AI saves human time on the first pass.
• Document discovery. Searching across very large document sets to find specific things. AI is genuinely good at this.
• Cross-checking. Asking the AI to find counter-arguments to a thesis the human has formed. AI is useful here precisely because it has no skin in the game.
• Drafting. First drafts of internal memos, due diligence summaries, board notes. AI does the boilerplate; humans do the judgement.

What they do not do:

• They do not ask the AI for buy/sell decisions.
• They do not let the AI write external client material unedited.
• They do not let the AI access non-public information without a compliance-cleared workflow.
• They do not believe AI-generated numbers without verification.

You are not running a hedge fund. But the discipline these institutions show is the same discipline that keeps a personal research workflow honest.

Your use policy

What you have learned

Across five lessons, you have built a market research bot that summarises, compares, and characterises real material; you have stress-tested its refusal of the dangerous questions; you have learned the difference between pattern and prediction; you have understood where this tool fits in a serious researcher's workflow; and you have written your own use policy.

This is enough to use AI seriously and safely in your own research. It is not enough to deploy a research tool as a product, to advise others, or to handle non-public information. Those are different bodies of skill, and they need different training.

Looking ahead

The wrap-up page tells you where in the Integrated AI Program the deeper material on these topics sits, and how to stay in touch if you would like to know more.