Theory
Fluent output is not evidence
A generated security assessment reads better than a human one and is harder to doubt. Readability and correctness are unrelated properties. The risk is that AI output raises confidence faster than it raises capability, so every generated claim should carry its source record.
The risk
Claim: inference
The specific danger is that AI output raises confidence faster than it raises capability. An organisation can end up with better-written reports about the same unmeasured controls.
Require every generated claim to carry its source record so the reader can check it directly.