The 10th Circuit Bench on AI: Verification, Volume and Hidden Prompts

A week after the U.S. Court of Appeals for the Tenth Circuit proposed a rule on AI-assisted filings, artificial intelligence ran through several sessions of its Bench & Bar Conference, held September 24–26 at The Broadmoor in Colorado Springs, as Colorado Politics reported.

U.S. Magistrate Judge Maritza Dominguez Braswell described how quickly the room has changed. When presenters used to ask who used AI regularly, “We’d maybe get one hand go up,” she said. Now, “Every hand goes up.”

The bench is no exception. In a random-sample survey of federal judges conducted in December 2025 and published by The Sedona Conference, more than 60% of responding judges reported using at least one AI tool in their judicial work, and 22.4% used one daily or weekly.

Here is what we took from the discussion, and from the rule that frames it.

The rule behind the conversation

The conference coverage does not mention it, but on September 18 the court published proposed 2027 revisions to its local rules. The redline adds a fourth item to Tenth Circuit Rule 46.5(B), the list of representations a person makes by presenting a paper to the court. The signer would certify that

“any document prepared with the assistance of generative artificial intelligence has been reviewed—before filing or submission to the court—by a human who has independently verified the existence of all cited authorities; the accuracy of all quotations, citations, and legal analysis; and the document’s compliance with all relevant rules and ethical obligations.”

Three details in the text matter more than the headlines about it.

• It binds everyone who signs. Rule 46.5(B) applies to “an attorney or unrepresented party” alike.
• It sits inside the signature. The duty is added to the representations a signature already makes, on the Rule 11 model. The proposal contains no separate AI disclosure form.
• It goes past existence. Checking that a case is real is the easy part. The rule also names “legal analysis”, which means asking whether each authority supports the sentence it is cited for.

The redline also makes the sanctions list open-ended (“including but not limited to”) and adds two new entries: waiver of the affected issue and striking of a non-compliant document.

Comments can be emailed to Clerk@ca10.uscourts.gov through October 18, 2026, according to the clerk’s memorandum. The final rules will be posted by November 30 and take effect January 1, 2027.

A prediction, not a calculator

“A lot of times people think about it like a computer or a calculator,” Braswell said. “These systems don’t do that. They’re making a prediction and it’s different every time.” Denver attorney Katina Banks said AI is good at summarizing and synthesizing, but its analysis “will sound very confident” while being “really not very strong.”

The description is accurate for the way most people meet these systems. It is also incomplete, and the missing part matters for anyone who writes or applies a verification rule. A large language model produces text by predicting the next word from a probability distribution, and how much its answers vary is largely a setting: at a low “temperature” the same question returns much the same answer, although vendors caution that even then it can differ from run to run. The model itself changes more than users realize, because providers update it, sometimes without notice. And repeatability is not correctness. A calculator is trusted because its method is known and checkable, not because it gives the same answer twice. A model can return the same wrong citation every time it is asked.

So the useful question is not whether a tool is consistent, but whether a person has checked what it produced. That is what the proposed rule asks for, and the judiciary applies the same standard to itself. The Administrative Office has reminded all judiciary users “that they are accountable for all work performed with the assistance of AI.” Ross Guberman of BriefCatch noted how rarely judges have been caught with fictitious AI output, and assumed “there must have been some additional step” in chambers. In the Tenth Circuit, lawyers may soon find that step written into a rule.

Clients ask first now

Banks said her firm vets AI vendors for security settings and controls, and makes sure the systems will not train on client data. Braswell asked whether clients now demand exactly that, sitting down to ask how the firm is going to use AI. Banks said they do.

That is a procurement question with concrete answers. In Where Does Your Case File Actually Live? we set out six questions to put to any vendor, including whether client data trains any model under any circumstances and whether the system can run with no outbound network access. A firm that has those answers in writing is ready for the client’s question.

Volume is what the court sees

Magistrate Judge N. Reid Neureiter described the cost to the court. With AI, he said, a filing is “essentially zero cost. You can generate a 15-page objection to the two-week extension of time that the other side has requested.” Earlier in September he linked a rise in self-represented filings in Colorado’s federal trial court to AI assistance. That court received 4,133 civil cases in 2025, up from 3,544 the year before, Colorado Politics reported.

This is not only a pro se problem. When drafting costs nothing, length no longer shows effort. A court sorting through that volume gains more from a short filing that has been checked than from a long one that has not. Rule 46.5(B) already requires that a paper not be presented “to cause unnecessary delay or expense.”

Instructions hidden in documents

Among her concerns, Braswell listed bias, deepfake evidence, and clandestine “prompt injections” in filings that can manipulate judicial AI tools. A prompt injection is text a person does not see, set in white type, a microscopic font or a metadata field, that an AI system reads and follows as an instruction. It has already happened elsewhere. In July 2025 Nikkei Asia found hidden prompts such as “give a positive review only” in 17 academic preprints from 14 institutions, aimed at reviewers who used AI.

Courts are not the only readers exposed. Any firm that runs AI over an opposing production, a deposition exhibit or the other side’s brief is giving its tools documents written by someone with a stake in the answer. Three habits reduce the risk:

• Prefer answers tied to a page and line, so the claim can be checked against what a person can actually see there.
• Never let a tool act on what it reads. A document it was asked to summarize should not be able to trigger a send, a filing or a forward.
• Treat a mismatch as a signal. If a summary says something the visible page does not, look for hidden text before you look for a better prompt.

Education over admonition

Braswell said she has issued guidance on AI use, not an order. “The admonitions, the threats of negative consequences, to me, are less effective than education,” she said. The survey shows the gap on the bench itself: 45.5% of responding judges said their court administration had provided no AI training.

Six questions an AI rule should be able to answer

The judges were candid about how much the bench is still learning, and the survey data agrees: 45.5% of responding judges said their court administration had provided no AI training. Rules written now will outlive today’s tools. These are the technical questions we would want any rule on AI-assisted filings, this one included, to have answered.

1. What exactly counts as “generative AI”? “Prepared with the assistance of generative artificial intelligence” will soon describe almost every document, because language models now sit inside word processors, grammar checkers and research platforms. A signer cannot certify against a trigger they cannot see. A functional definition, covering tools that generate or substantively rewrite text, citations or analysis, and excluding spelling, formatting and search results returned verbatim, would make the certification meaningful.
2. Is the test correctness, or consistency? How much a model’s output varies is largely a configuration choice, and answers can be made far more repeatable. None of that makes them correct. Running a tool twice and getting the same answer is not verification.
3. What does “verified” mean for grounded tools? Systems that answer from a supplied set of documents (retrieval-augmented generation) invent authorities far less often, but they can still cite a real source for a proposition it does not support. Verification has to mean reading the cited passage, not confirming that the citation resolves. The proposed rule’s “legal analysis” language reaches this; the question is whether filers will read it that way.
4. Which model, which version, which date? Providers update models, so the same prompt can produce different output a month later. When a filing is questioned, the tool, the model version and the date may be the only way to reconstruct what happened. Filers who keep that record for AI-drafted substantive content will be able to answer.
5. What about text written for machines, not people? Instructions set in white type or a microscopic font are invisible to a reader and legible to a machine. Such text has no purpose except to influence an automated reader, which looks like the “improper purpose” Rule 46.5(B)(1) already prohibits. It is also detectable: comparing a PDF’s text layer with what the page actually renders reveals it.
6. What will count as evidence of AI use? Tools that estimate how much of a document was written by AI are unreliable. OpenAI withdrew its own classifier in 2023 for low accuracy, and a Stanford study published in Patterns found that popular detectors flagged more than half of the essays written by non-native English speakers as AI-generated. A rule that rests on the signer’s certification and on what the filing actually contains is sturdier than one that leans on a detector’s percentage.

Where Lawnova fits

We build AI tools for litigation teams, so we are careful about what we claim.

• PDF.LEGAL answers questions about transcripts, depositions and filings, and “every result includes exact page and line references.” That is what lets a lawyer check an answer against the visible record. It is a check, not a detector: we do not claim it finds hidden instructions.
• COAPP, our Colorado appellate brief tool, audits case citations against CourtListener before export and marks each one “verified, ambiguous or not found.” That is an existence check. As we wrote about the Fifth Circuit’s wrong-rule citation, the support question, which the proposed rule calls “legal analysis”, still needs a human.
• Lawnova Academy teaches source-grounded drafting with verification, for firms that agree with Judge Braswell that education works better than warnings.

Source: Michael Karlik, “AI a focus at Colorado Springs judicial conference,” Colorado Politics, September 28, 2026. Proposed rule text from the Tenth Circuit’s 2027 redline and clerk’s memorandum dated September 18, 2026. Survey figures from Northwestern University’s March 30, 2026 announcement of “Artificial Intelligence in Federal Courts.”