Inditex’s modern slavery statement for the year to 31 January 2026 is an arithmetic document. It declares 6,684 non-exclusive factories across all tiers in 49 markets, and records 10,709 traceability audits and 6,039 social audits in the period. The numbers are the argument. Strip them out and a pledge remains, and a pledge is not evidence.

A paper posted to arXiv on 7 August measures how well a language model grades that class of file. IntelliAudit takes a control and a corpus of evidence, retrieves the relevant artefacts, assesses them, and challenges its own adverse findings before issuing a recommendation. It runs on Claude Sonnet 4.6. Whatever the results show, they are not the ceiling of a cheap model.

The study is about IT security, not garment sourcing. Its benchmark covers 14 ISO/IEC 27001 controls across four simulated organisations, scored by practising auditors and cybersecurity-informed users.

The auditors graded the system on two axes that came apart precisely where it counts. Factual accuracy scored 3.75 out of 5. Evidence fulfilment — whether retrieved artefacts satisfy the control — scored 3.20. The system reads a document competently; whether the document is enough, it judges less well, and that is the only question an audit exists to settle.

The correction data is what a general counsel should read first. Six auditors engaged the system’s adjudicator across 27 case reviews, and 15 of those reviews changed status. Thirteen of the 15 moved away from a more permissive verdict. Nine had begun as compliant, and none ended there.

An error that always runs the same way stops being an error rate and becomes a disposition.

The paper names the mechanism, and anyone who has read a supplier list will recognise it. On an asset-management control the system “generalized from part of the asset inventory and missed other asset categories” — a witness who read the first page of the register and swore to the rest. Spreadsheet evidence scored lowest of any artefact type among the audit-readiness reviewers, 3.47 against 4.10 for PDFs. A supply chain map is a spreadsheet, and 6,684 factories are rows.

Inditex’s own filing already contains the judgment in question: 410 factories entered corrective action plans during the year, following on-site social audits and a human sufficiency call. Automating that call does not retire it; it hands the work to the capability the newest measurement puts at 3.20.

The products sold into apparel supply chains are pitched at the wrong end of that gap. osapiens tells buyers its CSDDD solution “fully automates initial and annual risk analysis” and builds a risk score for each supplier from country and industry data. Scoring is retrieval with a number attached. The statement a director signs turns on whether what was found was sufficient.

The vendors say a human stays in the loop; the research prices that claim rather than refutes it. A reviewer who rewrites the verdict in more than half the cases they open is not supervising a system. They are auditing, with a draft in hand, which is a different job at a different salary.

Brussels has handed the industry three years to buy the wrong thing. Omnibus I moved CSDDD compliance to 26 July 2029 and lifted the threshold to 5,000 employees and €1.5 billion in turnover, cutting the in-scope population by an estimated 70%. Inditex, with 163,047 employees, sits well inside it. The delay reads as relief; it is a purchasing schedule.

The authors are candid about what their system is for. It should “remain decision-support” rather than an autonomous certification system, and in their study, humans did the calibrating. In the paper, six auditors did that work over 27 cases; in apparel, a sustainability team of fixed size faces 6,684 factories. The software is priced as a saving. Nobody quotes for the people who have to overrule it, and somebody has to sign underneath.