Why RAG without citations is worthless
RAG is not a miracle cure for hallucination. Without verifying the source, you get a model that lies convincingly. This is the difference between a demo and a production system.
Ask any vendor about their AI product today and within a minute you'll hear the word RAG — Retrieval-Augmented Generation. It's the promise against hallucination: the model would no longer make things up, because it checks your documents first. Sounds airtight. It isn't.
What RAG actually does
RAG consists of three steps. Retrieval: on a question, relevant chunks of text are pulled from a knowledge base. Augmented: those chunks are handed to the language model as context. Generation: the model formulates an answer. The assumption is that the model sticks neatly to the sources it's given.
That assumption often holds — but not always. And "not always" is exactly the problem in work where it counts.
Where it goes wrong
There are two silent failure modes. The first: retrieval pulls the wrong or incomplete chunks, and the model fills the gaps with what it "knows" — that is, with plausible- sounding fabrications. The second, meaner one: the model does cite a source, but the claim isn't actually in it. The number checks out, the substance doesn't.
A model that cites a source and misrepresents it is more dangerous than a model that honestly says it doesn't know.
In a demo this never shows up. In production — for a legal question, a medical file, a policy document — it's the reason nobody trusts the system anymore the moment the first error surfaces.
The missing step: citation verification
The difference between a demo and a system you can build on is one extra step most vendors skip: verify that every claim is actually present in the cited source. Not "looks like it", but demonstrably. Claims that fail this test get removed — not smoothed over with nicer phrasing.
Only then does a source card mean something. The user can click, read the original, and see that it's correct. That's not a nice-to-have; it's the whole point.
Good retrieval is half the work
Verification only helps if the right sources were retrieved in the first place. That's why we combine semantic search (vectors, for meaning) with keyword search (for exact terms, names and numbers) and add a reranking step on top that puts the truly relevant passages first. Pure semantic search misses exact references; pure keyword search misses intent. The combination wins.
Measure, don't hope
How do you know it works? By measuring it. A fixed set of controlled questions with known, correct answers — a golden set — reruns on every change. That way you can see whether a change improves quality or silently degrades it, and keep the hallucination rate as a hard number below that of market leaders.
And the data?
One last point that isn't a technical detail but a precondition: for sensitive data, the whole pipeline belongs in a place you trust. On-prem, or in a GDPR-proof environment in the Netherlands. The best citations are worthless if the question and the document leak to a foreign cloud along the way.
Conclusion
RAG isn't a switch you flip. It's a chain — retrieval, reranking, generation, verification, evaluation — and the chain is only as strong as the step everyone skips. So don't ask a vendor whether they do RAG. Ask how they verify the source is correct, and how they measure it. The answer to that question separates the demo from the system.