A language model does not get more reliable because you ask it more politely.

On 13 July 2026 our system published a sentence containing the phrase “one kilowatt per hour”.

Kilowatt is power. Kilowatt-hour is energy. “Kilowatt per hour” is not imprecise, it is wrong, in roughly the way “a hundred kilometres per hour per hour” is wrong. On a channel whose only selling point is that the numbers are right, that is the most expensive sentence you can write.

No prompt would have prevented it. A language model does not know physics, it knows word sequences, and “kilowatt per hour” is a very common word sequence. No human caught it either, because two days earlier we had switched the daily run to unattended. That is exactly what it is built for.

That is this article in one paragraph. Not “AI makes mistakes”, everybody knows that. Rather: the kind of mistake a language model makes cannot be found with the tools most people are using. A second prompt will not find it. A second model taking another look will not find it. And you will only find it yourself as long as you read every single text, which defeats the entire point.

What we measured

Claims are cheap, so here is a measurement from our own operation. In August we ran five video runs to test whether an AI video agent delivers a better look. The prompt said, verbatim: “Do not invent any statistic, number, or on-screen text that is not in the script.”

Five runs, August 2026, our own channel. The prompt explicitly forbade inventing anything.

Four out of five runs put text on screen anyway that appeared nowhere in the script. Always the same type: an invented number with a unit (“2.5 kW”, “680 h”) or a promotional add-on (“TOP DEAL”, “full subsidy”, “expert comparison”). None of it was malice. The model wanted to do the job well, and an ad usually does have “TOP DEAL” on it.

Anyone selling you an AI automation who answers the question about safeguards with “it's in the prompt” has just told you there are no safeguards. That is the core of it, and everything else here is the answer to one question: what takes the place of the request?

The answer: take decisions away from the model

A black box does not become controllable by supervising it harder. It becomes controllable by shrinking what it is responsible for, until all that is left is the one thing a model genuinely does better than a rule: phrasing language. Everything else is decided by something that decides the same way every time.

Here is what that looks like for us. A language model writes the script. After that it touches nothing.

Gate 1: the rule lives in a file, not in the prompt

Before a script goes into production it runs against a rules file. Not a second language model, but a deterministic filter: same text, same result, every time. A model policing a model is not a control, it is a second opinion with the same blind spots.

The practical advantage is not the technology, it is the format. The file is versioned, every change carries a date and a name, and you can print it out and put it on a lawyer's desk. You cannot do that with a prompt, because a prompt gets re-rolled with every model change.

Here it is. An excerpt from the policy of our health channel, shortened, otherwise unchanged:

If you are not a developer: you do not need to read the box below. What matters is that this file exists, that its explanations are in plain language, and that only a human may change it. The text picks up again right underneath.

# --- Check disclosure_present: this exact text must appear in the caption ---
# Two obligations in one string: AI label AND medical disclaimer.
required_disclosure: "Virtual AI character. AI-generated content.
                       Not medical advice, only hints."

# --- Check banned_claims: regex, case-insensitive, against hook, body, caption. ---
# Starting set, sharpened in operation: EVERY INCIDENT BECOMES A PATTERN
# (and a regression test in the engine).
banned_patterns:
  # Diagnosis: the persona determines nothing. No "you have", no
  # "you're intolerant", no "this means you".
  - '\byou\s+(have|got)\b[^.!?]{0,40}\b(intolerance|allergy|condition)\b'
  # Cure, treatment, prevention stated as a promise.
  - '\b(cures?|heals?|treats?|reverses?)\b[^.!?]{0,40}\b(ibs|reflux|disease)\b'
  # Disordered eating: no moralising, no detox promises.
  - '\b(good|bad|clean|dirty|guilt[- ]?free)\s+foods?\b'
  - '\b(detox|cleanse|flush)\s+(your\s+)?(body|gut|system|liver)\b'

# --- Check belege: these units turn a spoken number into a CLAIM. ---
# If this key is missing the gate is fail-closed and EVERY number needs a source.
einheiten: [g, gram, mg, mcg, kcal, calories, %, percent, ml, IU]

Two things about it matter more than the content. First: the comments are in German and the values in English, because they match against English scripts. A rules file nobody can read does not get maintained. Second, the line “every incident becomes a pattern”. This file is not finished on day one. It grows with every mistake we find, and every entry gets a test in the engine so the same mistake never happens twice.

Gate 2: numbers come from a facts file, not from the model

This is the gate that came out of the kilowatt incident. The rule: the model may only speak numbers that exist in a file of their own, with a value, a unit, a source URL and a date. If the filter finds a number in the text that points at no entry, the run stops. No render, no cost.

The source standard is deliberately narrow. For the health channel: the EFSA register, clinical guidelines, Cochrane reviews, official nutrition reference values, national health institutes. No blogs, no single study without peer review, no manufacturer claims.

And one consequence that surprises people and is nonetheless correct: calculated numbers are not facts. “1 kW times 6 hours times 30 days is 180 kWh, at 0.40 euros that is 72 euros” fails, because 180 and 72 appear in no facts file. That is intended. Otherwise the model can derive any number it likes and the gate is wide open again. The calculation may stay in the text, but its result belongs in the facts file as its own entry, researched by a human.

Gate 3: the finished artefact is checked mechanically

A text can be clean and the file still broken. So a module inspects the finished video before anything is uploaded: is the duration plausible, is there audio on every segment, is the resolution right, is the first frame not black, is our channel logo in the picture? If one check fails the entry is blocked and nothing goes out, not even unattended.

Gate 4: approval is a decision, not a default

Not every content class needs a human. On our affiliate channel for air conditioning units the machine posts by itself. On the health channel every run ends with a finished video and the question of whether it should go out. That costs five minutes a day, and those five minutes are the price of keeping every mistake deletable.

The point is not that approval is good and automation bad. The point is that it is a deliberate, documented decision per content class, and not a default setting nobody ever touched.

Where our own gates failed

A workshop report in which everything works is advertising. So here are the three places where it went wrong for us, with dates.

That is the question you should put to any vendor, and it costs you thirty seconds: can the system you are building for me change its own rules? Anyone without a clear answer has not built a safeguard, they have built decoration.

The step almost nobody takes

Back to the four out of five runs with invented on-screen text. The obvious reaction would have been to tighten the prompt, or to run text recognition over every frame and go red as soon as it finds something. We could have built either. Neither would have touched the actual cause.

What we did instead: we took responsibility for on-screen text away from the model. Subtitles, logo and end card are now rendered by a video tool, and specifically the lines that already passed gates 1 and 2. There is nothing left to invent, because nothing is being decided at that point any more.

The side effect is how you know it was the right fix: gate 3 can no longer go red for structural reasons, so the videos reliably go live. We did not lower the error rate through tighter control, we lowered it by removing the cause. Of fourteen steps, seven remain; of an average 1.6 paid renders per run, one remains.

And because honest numbers are part of the deal: in the three supervised runs afterwards the picture was text-free three times out of three, including the run that had three numbers in the script. Three runs are not proof. They are a start, and we would rather say so ourselves before somebody else does the arithmetic.

This is not just about text

We learned it on a content channel, because there a mistake only costs us. But the four gates are not tied to content. They are tied to one question: where in the process does a model decide something that somebody else takes to be reliable?

It is always the same blueprint. The model does the phrasing, because it is good at that. Everything that has to be correct is decided by something that decides the same way every time. And you determine where a human looks at it.

Try the first gate

Below is the filter from gate 1, with two profiles: one for an ordinary online shop and our own one for health and nutrition. Type in a sentence you could plausibly have on your own site. You will see immediately whether it passes, and if not, at which point and against which rule it fails.

Switch rules off and watch the result change. That is the whole point: a brake you can configure, and whose configuration you can see.

One example in detail: if you sell online

To keep this from staying abstract, here is one content class spelled out. If you sell online, two dates make the mechanism concrete this year.

Since 2 August 2026 the transparency obligations under Article 50 of the EU AI Act apply. Anyone publishing AI-generated content must label it so a reader can tell it came from a machine. An automation that sometimes sets the label and sometimes forgets is worse than none at all, because it creates the gap and the feeling of being covered at the same time.

From 27 September 2026 the EmpCo Directive applies. Generic environmental claims without recognised evidence become unlawful, as does climate neutrality based purely on offsetting. In Germany the transposition is already in the federal gazette. A language model writing freely about “sustainable” and “climate neutral” will produce violations by the second from that date.

On top of that, the classics that already apply today:

• Reference prices. A price reduction must state the lowest price of the previous thirty days.
• Reviews. If you display reviews, you must state whether and how you verify they are genuine.
• Supplements and cosmetics. If you sell them, the exact same Health Claims Regulation applies to you as to us. Word for word.
• Availability. “Only three left in stock” with nothing behind it is artificial scarcity.
• Ad disclosure. Partnerships and affiliate content need a visible label.

What it costs when it goes wrong is not an open question. Under German unfair competition law the other side's legal costs for a cease-and-desist notice usually run to €800 to €1,200, and your own review adds another €800 to €2,000. It gets expensive after that: once you have signed an undertaking, the next occurrence costs a contractual penalty, per instance. If an automation wrote the same sentence into thirty product pages, that is a different arithmetic. In Luxembourg it runs through an injunction action in summary proceedings, and the court can order the judgment to be published at your expense. The numbers in detail are in our shorter article for shop owners.

Three questions you can put to any vendor

Whether or not we are the ones building it for you:

• Where does the rule live? If the answer is “in the prompt”, there is no rule. What is forbidden belongs in a versioned file you can show a lawyer.
• Can the system change its own check? If it can, the check is decoration.
• What exactly ships without approval? Not everything needs a human. But deciding which content class does is your call, not your tool's.

How we work

We are DigitalAce, an AI operations studio based in Luxembourg. We connect AI to real business processes and build done-for-you workflows for small and mid-sized companies. Not a tool you then have to operate yourself, but a process that runs.

Everything in this article came out of our own products, not a client's. That was deliberate. We could tell you we built it for a customer and it would sound better. In a market the size of Luxembourg, though, that kind of claim is one follow-up question away from falling apart. The riskiest possible version belongs on a product we own, because there a mistake only costs us.