In short: a citation list tells you what a legal AI read. It doesn't tell you how those texts relate: which law governs, which article was repealed, which ruling narrowed the provision the answer relies on. An evidence map is a legal knowledge graph built around one question. Every link between a law, an article, a decision and a legal concept has a type, a basis in the primary text, and a status: verified by a named lawyer, or proposed and awaiting review. Below: why lists fail, how the map works, five use cases worked through on real GCC and EU texts (starting with a DIFC firm moving client files to Saudi Arabia), and a six-point check you can run on any tool that claims to show its evidence.
A citation list is a pile, not an argument
Legal AI tools that cite their sources still get things wrong. In May 2024, Stanford's RegLab and HAI tested the research tools lawyers pay for. They found that Lexis+ AI and Ask Practical Law AI "produced incorrect information more than 17% of the time", and that Westlaw's AI-Assisted Research "hallucinated more than 34% of the time". These tools are built on retrieval-augmented generation, which was supposed to fix the problem. The authors' verdict: "even RAG systems are not hallucination-free."
The cost now shows up in court. Damien Charlotin's database of AI hallucination cases counted 1,240 U.S. filings by 27 July 2026, according to the Maryland State Bar Association: 11 in 2023, 37 in 2024, 524 in 2025 and 668 in 2026 to that date. We keep our own record in our AI hallucination cases tracker.
Invented cases get the headlines, and we showed how one fake citation can pass every check. The more common failure is quieter: a real citation to a real law, in the wrong version or in the wrong relationship. We covered the version problem in Primary Sources Decide Whether Lawyers Trust Legal AI. This post covers the relationship problem.
Lawyers build arguments as chains. This law governs the client, it contains this article, this court read the article narrowly, and that rule replaced the old one last year. A citation list flattens the chain into a pile. To check an answer, you have to rebuild the chain yourself, which is the work you hoped the tool would save.
What is a legal evidence map?
An evidence map lays the law out in four lanes:
- Instruments: laws, regulations, treaties and their consolidated versions.
- Provisions: the articles and paragraphs inside them.
- Decisions: judgments, regulator decisions and official guidance.
- Concepts: the doctrines that tie them together, such as "adequate protection" or "appropriate safeguards".
Most of the value sits in the lines between the lanes. Each line is a typed link, and the type says what kind of legal relationship it is.
| Link | Meaning | Example |
|---|---|---|
| contains | An instrument holds a provision | The DIFC Data Protection Law 2020 contains Article 27 |
| governs | A rule applies to a person or situation | DIFC law, not the federal PDPL, governs a DIFC entity's processing |
| interprets | A decision reads a provision | Schrems II reads GDPR Article 46 |
| implements | A measure puts a provision into practice | The 2021 EU standard contractual clauses implement Article 46 |
| codifies | A provision writes a concept into law | Article 27 codifies "appropriate safeguards" |
| amends | A later text changes an earlier one | DIFC Laws Amendment Law No. 1 of 2025 amends the 2020 law |
| repeals | A text ends another | The 2020 law repeals DIFC Law No. 1 of 2007 |
Every link carries its own evidence
A link is only as good as what supports it. On an evidence map, each link opens to a short record:
The status field is what keeps the map honest. A link that a lawyer has checked against the primary text is marked verified, with their name and the date. A link the AI inferred and no one has checked yet stays proposed, drawn as a dashed line. You can see at a glance which parts of an answer stand on checked ground and which still need a lawyer.
Evidence map vs legal knowledge graph
The two are related but not the same. A legal knowledge graph models a whole body of law: every instrument, article and decision a system knows about, and the relationships between them. It powers search and retrieval behind the scenes. An evidence map is the small part of that graph that answers one question, drawn for a lawyer to read and check.
| Legal knowledge graph | Evidence map | |
|---|---|---|
| Scope | A whole corpus of law | The links behind one answer |
| Who reads it | The system | The lawyer |
| What a link needs | A type | A type, a basis, a source, a version and a status |
| Its job | Find the relevant law | Show the answer follows from it |
Five ways lawyers use an evidence map
1. Checking a cross-border transfer: a DIFC firm and a Saudi cloud
The question: a law firm registered in the Dubai International Financial Centre wants to host client files with a cloud provider in Saudi Arabia. Can it?
The answer runs through at least two regimes, possibly three. Here is the path the map draws, link by link.
- Which law governs the firm? The DIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020). The federal UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, does not apply to "companies that are established in free zones which have introduced their own respective data protection regulations", with the DIFC and ADGM as the main examples.
- Which version is in force? The DIFC law came into force on 1 July 2020 (Article 4) and "repeals and replaces" the 2007 law (Article 1(2)). The current consolidated version is dated July 2025 and reflects DIFC Laws Amendment Law No. 1 of 2025.
- Is the destination adequate? Under Article 26(1), a transfer out of the DIFC may take place only if the destination ensures "an adequate level of protection" or the transfer follows Article 27. Under Article 26(2), the Commissioner of Data Protection decides which jurisdictions are adequate, weighing the rule of law, public authority access to data, effective data protection law and an independent supervisory authority. So the first check is the Commissioner's current adequacy list.
- If not, which safeguard? Article 27 allows transfers with appropriate safeguards, including the Commissioner's standard data protection clauses and binding corporate rules. It also lists narrow derogations, such as explicit consent given after the data subject has been told the risks.
- What applies on the Saudi side? Saudi Arabia's Personal Data Protection Law came into force on 14 September 2023, and its grace period ended on 14 September 2024. It governs the provider's processing in the Kingdom. If the data later moves on from Saudi Arabia, SDAIA's transfer regulation, amended on 1 September 2024, applies. It recognises three safeguards: standard contractual clauses, binding common rules and a certificate of accreditation.
As a citation list, that answer is a dozen documents in no order. On the map it is one path with five links. You can see where the path is solid and where it rests on a proposed link, and the proposed link is where your billable hour should go.
2. Catching the amendment before your client does
Laws change while matters are open. The DIFC's own data protection law shows how often: the 2020 law replaced the 2007 law, a consolidated version followed the 2022 amendments, and another followed in July 2025. An AI that reads the 2022 PDF will cite the right article number from the wrong version, and the citation will look perfect.
On an evidence map, each matter pins the provisions it relies on. When a new amends or repeals link lands on one of those provisions, the matter is flagged. You see which memo cites which changed article, and you can update the advice before the client finds the change first. For why "enacted" and "in force" are different dates, see our primary sources test.
3. Seeing how a provision is actually read
The text of an article starts the analysis. What a court or regulator has said it means usually finishes it. Take GDPR Article 46, the basis for most EU transfers on standard clauses.
- In Schrems II (Case C-311/18, judgment of 16 July 2020), the Court of Justice invalidated the EU-US Privacy Shield. It held that standard contractual clauses remain valid, but that the exporter must check whether the destination's law lets the clauses work in practice.
- The European Data Protection Board's Recommendations 01/2020 on supplementary measures, adopted in final form in June 2021, explain how to run that check.
- The Commission's Implementing Decision (EU) 2021/914 issued the current standard contractual clauses.
Interprets and implements links put all three next to the article, so a litigator can see whether the reading they plan to rely on is the mainstream one or an outlier. Links can also cross jurisdictions. Article 26(3) of the DIFC law lets the Commissioner base an adequacy finding on decisions by other data protection authorities, and the map can draw that link too.
4. Mapping a new market for a client
A client expanding from Dubai into Riyadh doesn't need a forty-page memo on day one. It needs to know which rules apply and where they differ. Start from the client's activity and follow the governs links outward.
| Where the entity sits | Governing law | Regulator | Transfer route out |
|---|---|---|---|
| UAE mainland | Federal Decree-Law No. 45 of 2021 (PDPL) | UAE Data Office | Adequate country, contract, explicit consent, or contract necessity |
| DIFC | DIFC Data Protection Law 2020 | Commissioner of Data Protection | Commissioner's adequacy list (Art. 26), safeguards or derogations (Art. 27) |
| Saudi Arabia | Personal Data Protection Law (Royal Decree M/19, as amended) | SDAIA | Adequacy, or SCCs, binding common rules or accreditation, with a risk assessment where a safeguard is used |
These rows are the top layer of the map. Under each cell sit the provisions and their sources, and the whole map becomes the outline of the memo. The client can follow the reasoning, and a junior can fill in the detail without starting from a blank page.
5. Making AI answers checkable, link by link
This is the use case that matters most. When an AI answers a legal question, the evidence map shows the path it took: which provisions it relied on, which decisions it read, and which links are verified or only proposed. You don't have to take the answer on trust, because you can check it link by link.
When a link is wrong, you dispute it. When one is missing, you propose it. A second reviewer confirms the change, and the map records who confirmed it, when, and against which version of the text. The next lawyer who asks a similar question starts from a map that is a little more reliable than the one you started from.
How to judge any tool that shows its sources
Every legal AI vendor now says it cites its sources. These six questions separate a map you can check from a list you have to redo. Run them alongside our five trap questions and the GCC buyer's checklist.
| Ask | A good answer | A warning sign |
|---|---|---|
| Does each citation open the primary text? | The official text, at the exact article | A blog post, summary or search result |
| Which version did it read? | The version in force on today's date, labelled | No date, or an old consolidated PDF |
| Are relationships typed? | Governs, interprets, amends, repeals | A flat list of sources |
| Is each link verified or proposed? | Status shown on every link | Everything looks equally certain |
| Who verified it, and when? | A named reviewer and a date | "Verified by our team" |
| Can you dispute a link? | Yes, and the fix reaches later answers | Feedback goes to a form and disappears |
HAQQ's take
Trust in legal AI won't come from answers that sound more confident. It will come from answers that show their reasoning in a form lawyers already use: laws, articles, rulings, and the relationships between them. A dashed line shown honestly beats a solid line nobody checked.
Here is what HAQQ does today, as described on haqq.ai. Our legal research feature searches statutes, regulations and case law alongside a firm's own knowledge, and returns a structured answer with inline citations you can open and verify. It does not draw an evidence map, so run the six checks above on our answers too.
Building in public. The diagrams in this post come from a prototype evidence map we built on GDPR, DIFC and Saudi transfer rules. It is a research prototype, not a HAQQ feature. We are testing it with lawyers before deciding whether it belongs in the product.
HAQQ AI kostenlos testen
Erleben Sie KI-gestützte juristische Recherche und Entwurf
Key takeaways
- A citation list shows what an AI read. An evidence map shows how those texts connect, so you can check the reasoning as well as the sources.
- Each link carries a type, a basis, a source, a version and a status. Proposed links stay dashed until a named lawyer verifies them.
- For a DIFC entity, the DIFC Data Protection Law 2020 governs, not the federal PDPL. Transfers out turn on Articles 26 and 27.
- Pinning matters to provisions turns every new amends or repeals link into an alert on the matters it affects.
- Before you buy, ask any vendor the six questions above.
Sources & further reading
- DIFC Data Protection Law, DIFC Law No. 5 of 2020, consolidated version July 2025
- Stanford HAI: AI on Trial, legal models hallucinate in 1 out of 6 (or more) benchmarking queries (23 May 2024)
- Maryland State Bar Association: Confronting the hard numbers behind lawyers, AI and phantom precedents (27 July 2026)
- Simmons & Simmons: UAE Personal Data Protection Law FAQs (December 2021)
- Al Tamimi & Company: Data protection, data transfers
- Clyde & Co: Saudi Arabia's Personal Data Protection Law becomes enforceable (September 2024)
- Mayer Brown: Updates to Saudi Arabia's personal data protection regulations (9 October 2024)
- CJEU, Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (16 July 2020)
- HAQQ: Primary sources decide whether lawyers trust legal AI
- HAQQ: AI hallucination cases tracker
- HAQQ: How to test a legal AI, 5 trap questions
This article is general information, not legal advice. Laws and regulator lists change. Check the current official text and take advice on your own facts.
