In 2023, The Guardian reported an asylum case in which a machine translation turned a refugee’s singular “I” into “we,” and a judge rejected her claim. One incident isn’t a statistic, but it shows how a silent shift can decide a real person’s future. Since then, a 2025 hospital study and a wave of court sanctions have pointed the same way. So the real question isn’t whether to use AI. It’s which documents AI can touch, and who signs off before anyone relies on the result.
Can You Use AI Translation for Regulated Industries Safely?
Yes, but only if you route content by risk. AI works well for internal, non-binding material and poorly for anything with legal or clinical consequences. Our Four-Tier Safe Routing Model matches each document to a review level, a data environment and a named sign-off.
According to a July 2026 Maryland State Bar Association analysis of Damien Charlotin’s database, U.S. court filings containing AI-hallucinated content numbered 524 in 2025, and 97 of them led to monetary sanctions. Those were fabricated citations, not translation errors, but the failure is the same: fluent machine output, relied on without checking.
In Johnson v. Dunn (N.D. Ala., July 2025), the court disqualified three attorneys over fabricated citations, reportedly generated with ChatGPT, and referred them to bar regulators, finding that monetary sanctions alone wouldn’t be enough. The firm itself wasn’t sanctioned, reportedly helped in part by its written AI policy.
What Counts as a Regulated Industry for Translation Purposes?
A regulated industry, for translation purposes, is any field where a translated document carries legal weight or affects someone’s rights, health or safety under rules set by a recognised authority. Legal, medical, government and patent work all qualify.
Legal and courts
Judges, opposing counsel and regulators rely on contracts, court filings and evidence. Many courts require certified or sworn translations, though rules vary by jurisdiction. And one mistranslated clause can change who owes what to whom.
Medical, pharma and life sciences
In the US, the HHS Section 1557 rule (45 CFR 92.201, effective 5 July 2024) allows machine translation, but it requires review by a qualified human translator when content is critical to rights, benefits or meaningful access, when accuracy is essential, or when the source text is complex or technical.
Government and public sector
In March 2025, Executive Order 14224 designated English the official language of the United States and revoked the 2000 language-access order. But statutory duties such as Title VI and Section 1557 remain, so agencies still need dependable government translation services for notices residents have to act on.
Patents and IP
The European Patent Office offers free machine translation in 32 languages through Patent Translate, which is best treated as a search and information aid. Filings are a different matter: the claims define what you own, and patent offices set their own language rules. Patent teams can see how Ulatus pairs machine speed with human accountability in its AI translation services.
Where Does AI Translation for Regulated Industries Go Wrong?
AI translation fails in four main ways. It leaks confidential data through public tools, produces fluent text that quietly changes meaning, drifts from jurisdiction-specific terminology, and leaves no record of who checked what.
Confidentiality and data leakage
In a January 2025 survey of about 1,000 US employees at large companies, commissioned by a digital services firm, 57% said they had entered confidential information into public generative AI tools. A November 2025 cybersecurity vendor survey of 2,000 workers found that 49% use AI tools without employer approval. Both are self-reported and cover AI generally, but pasting a contract into a free translator is exactly this behaviour.
Hallucination and silent meaning shifts
A September 2025 JAMA Network Open study, run at a single children’s hospital, compared AI-translated paediatric discharge instructions with professional translations in four languages. AI performed about as well as professionals for Spanish, but worse for Simplified Chinese, Somali and Vietnamese, and the authors warned of inequities for speakers of lower-resource languages. Fluent isn’t the same as faithful.
Terminology and jurisdiction drift
A “motion” in one legal system isn’t a “motion” in another, and a general-purpose engine may not know an approved drug name or statutory term. Without a locked glossary, one source term can come out several different ways in a single contract.
Missing audit trail
If you can’t show which version was machine-generated, who reviewed it and when, you can’t defend it. An auditor will typically want the source, raw machine output, edits, reviewer credentials and sign-off date, and many free tools keep no job-level record of any of it.
The Four-Tier Safe Routing Model for AI Translation in Regulated Industries
The model sorts content by the consequence of an error and its legal status. Tier 1 is AI only, Tier 2 adds light post-editing, Tier 3 adds full post-editing and independent review, and Tier 4 is human-led, certified translation.
Three placement questions decide where a document lands:
- Is it legally binding?
- Can a patient, litigant or citizen act on it?
- Does it contain confidential or personal data?
Questions 1 and 2 set the tier. A “no” to both means Tier 1 or 2, a “yes” to either means at least Tier 3, and a “yes” to both usually means Tier 4. Question 3 sets the data environment instead, so a “yes” requires a private, no-training or on-premise setup, even for Tier 1 work.
Tier 1 (Inform): AI only
For internal, non-binding content where you only need the gist, such as triaging foreign-language documents. Never send the output out as a deliverable.
Tier 2 (Assist): AI plus light post-editing
For internal content people use but don’t rely on legally. ISO 18587:2017 describes light post-editing as correcting errors that change meaning, without polishing style.
Tier 3 (Verify): AI plus full post-editing and independent review
For consequential content that doesn’t need certification. A qualified subject-matter linguist edits for meaning and style, then a second person reviews. ISO 18587:2017 defines full post-editing as aiming for quality comparable to human translation. Teams needing Tier 2 or 3 support can see how Ulatus structures its machine translation post-editing (MTPE) service.
Tier 4 (Certify): human-led, certified translation
For court filings, immigration records and similar documents. A human translator leads and certifies the work. AI may support terminology in a controlled environment, but a person owns every line.
A worked example: the informed-consent form
Take a clinical-trial informed-consent form. Is it legally binding? Yes, it records a participant’s agreement. Can a patient act on it? Yes, they decide whether to enrol. Does it contain personal data? Signed copies do. So it lands in Tier 4: a certified translator leads, AI handles terminology only, the work stays in a controlled environment, and a certified translator and clinical lead sign off.
Risk Tier by Content Type: A Comparison Table for Legal, Medical, Government and Patent Content
Most contracts, patient-facing materials, regulatory submissions and filings belong in Tier 3 or 4, while triage, search and internal reading sit in Tier 1 or 2.
Four-Tier Safe Routing Model: tier by content type
| Content type | Tier | AI role | Human review | Data environment | Sign-off |
| Legal e-discovery triage | 1 | Gist translation | Spot checks | Private, approved tool | Review lead |
| Commercial contracts | 3 | First draft | Full post-edit, independent review | Private or on-premise | Legal translator, counsel |
| Court filings, evidence | 4 | Terminology only | Human-led, certified | Controlled, on-premise | Certified translator |
| Patient leaflets | 3 | First draft | Full post-edit, review | Private, no-training | Medical reviewer |
| Consent forms | 4 | Terminology only | Human-led, certified | Controlled | Certified translator, clinical lead |
| Regulatory submissions | 3 (4 if filed as a formal translation) | Draft, locked terminology | Full post-edit, independent review | Private or on-premise | Regulatory affairs lead |
| Government internal policy summaries | 2 | First draft | Light post-edit | Private, approved tool | Named reviewer |
| Citizen notices | 3 | First draft | Full post-edit, review | Private | Agency language officer |
| Patent prior-art search | 1 | Search translation | Spot checks | Approved tool | Search analyst |
| Patent filings | 4 | Terminology, drafts | Human-led, certified where required | On-premise | Patent translator, attorney |
How to read the table
Read across the row, not just the tier. A patient leaflet and a consent form both involve patients, but the consent form is a legal record, so it rises to Tier 4. Legal teams can see this in Ulatus’s legal translation work, and life-science teams in its medical translation services. Jurisdiction matters too: one court may accept a translator’s declaration where another requires a sworn translator, so check local rules before finalising any tier.
What Does a Compliant AI Translation Workflow Look Like?
A compliant workflow has five steps, each with an owner and a record an auditor can inspect.
- Classify and protect sensitive data. The content owner assigns a tier using the three placement questions and masks personal data where possible. Evidence: a classification record.
- Choose the data environment. The security lead picks a private, custom or on-premise setup and confirms the engine doesn’t train on your files. Ulatus explains its approach on its data security Evidence: environment and access logs.
- Translate with locked terminology. The project manager loads approved glossaries and translation memory so a term always comes out the same way. Evidence: the glossary version used.
- Post-edit and review independently. A post-editor corrects the output and a second linguist reviews it. ISO 18587:2017 covers post-editor competences, and ISO 17100:2015 covers translation services generally. Evidence: reviewer credentials and change records.
- Log, sign off and archive. A named approver signs, and the file keeps source, machine output, edits and final version together. Evidence: a retrievable record of who did what and when.
Step 5 matters most for Tiers 3 and 4, because regulators may ask which content a qualified human reviewed, particularly where Section 1557 applies.
Which Regulations Shape AI Translation Decisions?
The EU AI Act, data protection laws, health regulators’ guidance and court and patent office rules matter most. None bans AI translation outright, but together they set how much oversight and documentation you need.
EU AI Act: what changed on high-risk deadlines
The Digital Omnibus, a package of amendments adopted as Regulation (EU) 2026/1744 and in force since 27 July 2026, pushed back high-risk deadlines under the EU AI Act. According to the European Commission and Council of the EU, Annex III systems (standalone high-risk uses such as employment and law enforcement) now face obligations from 2 December 2027, and Annex I systems (AI built into regulated products such as medical devices) from 2 August 2028.
Article 50 transparency duties weren’t delayed and have applied since 2 August 2026. As of November 2026, a grace period to 2 December 2026 still covers marking outputs of generative systems already on the market. The Act doesn’t single out machine translation, so ask counsel how it applies to your use case.
HIPAA, GDPR and data handling
In the US, HIPAA requires a business associate agreement before protected health information goes to a vendor, translation providers included. A proposed Security Rule overhaul, published in January 2025, is still only a proposal on HHS’s fall 2026 agenda, with final action projected for July 2027. Under GDPR, sending personal data to a translation tool raises controller and processor questions (who decides how the data is used, and who handles it on their behalf), and your provider contract should answer them.
Sector rules: EMA, FDA, courts and patent offices
The European Medicines Agency’s reflection paper, finalised in September 2024, warns that generative models can produce plausible but wrong output when drafting or translating product information. That calls for close human supervision, and the drug companies holding the marketing authorisation stay responsible. The FDA’s draft guidance, published in January 2025, proposes a risk-based credibility framework for AI but doesn’t address labelling translation. Courts and patent offices set their own certification and filing-language rules.
How Do You Choose a Translation Partner You Can Defend to an Auditor?
Choose a provider that can show, in writing, where your data lives, who edits it, which standards they follow, what evidence they keep and how they handle incidents. If they answer with promises rather than documents, an auditor won’t accept the answer either.
Five questions to ask any provider
- Where is our data processed and stored, and is it ever used to train models?
- Who are the reviewers, and what qualifications and subject expertise do they hold?
- Which standards apply (for example ISO 17100, ISO 18587, ISO 27001)?
- What evidence do you retain per job, and for how long?
- What is your incident response process if confidential content is exposed?
Red flags
How a provider answers matters as much as what they say. Be wary of vague claims like “enterprise-grade security” with no detail, no named reviewer on deliverables, refusal to explain how the AI engine handles your data, and pricing that ignores content risk.
Putting the Model to Work: Your First 30 Days
You can put the Four-Tier Safe Routing Model into practice in a month, starting low-risk and moving upward.
Week 1: inventory and classify
List every document type your team translates and every tool people actually use. With 49% of workers using unapproved AI tools (cybersecurity vendor survey, November 2025), shadow tools are probably already in play. Then run each content type through the three placement questions and assign a tier.
Weeks 2 to 3: pilot Tier 1 and 2
Run one or two low-risk content types through an approved environment with locked terminology. Have a linguist review the output and log errors by type, so you build your own evidence.
Week 4: set metrics and review cadence
Track error categories, turnaround time and how often documents get re-tiered. Review quarterly so your tiers keep pace with rules like the EU AI Act dates above.
Not sure which tier your documents belong in? Send Ulatus one sample of each document type you translate, and we’ll place it in the Four-Tier Safe Routing Model, with the review level, data environment and sign-off it needs.
