TLDR: A systematic analysis of over 30,000 SEC 10-K filings reveals a sevenfold increase in companies disclosing AI-related risks between 2022 and 2024. While legal and competitive risks dominate, attention to societal risks like cyberattacks and technical limitations is growing. However, many disclosures remain generic, prompting calls for more specific regulatory guidance from the SEC.
A recent study delves into how seriously companies are addressing the potential downsides of Artificial Intelligence. As AI becomes more ingrained in business operations, regulators worldwide are pushing for greater transparency in how companies identify, report, and manage AI-related risks. The U.S. Securities and Exchange Commission (SEC) has repeatedly cautioned against “AI-washing,” emphasizing the need for accurate disclosures, backed by recent enforcement actions and litigation against misleading AI claims. Similarly, new laws in the EU, such as the AI Act and Digital Services Act, have introduced additional rules for AI risk reporting and mitigation.
The research, titled “Are Companies Taking AI Risks Seriously? A Systematic Analysis of Companies’ AI Risk Disclosures in SEC 10-K forms,” conducted by Lucas G. Uberti-Bona Marin, Bram Rijsbosch, Gerasimos Spanakis, and Konrad Kollnig from the Law and Tech Lab at Maastricht University, provides the first large-scale systematic analysis of AI risk disclosures. The team examined over 30,000 SEC 10-K filings from more than 7,000 public companies over the past five years, combining both quantitative and qualitative analysis. These 10-K filings are annual reports required by the SEC, detailing a company’s business, operations, risks, and financial performance, and are legally binding, ensuring a generally high quality of disclosure.
A Dramatic Rise in AI Risk Awareness
The study’s findings reveal a significant shift in corporate awareness of AI risks. The percentage of companies mentioning AI risk in their 10-K filings surged from a mere 4% in 2020 to over 43% in the most recent 2024 filings. This sevenfold increase since 2022 highlights AI’s growing prominence as a material risk for businesses. Interestingly, the study found that more companies now describe AI as a material risk (43%) than as a core part of their main business operations (only 23%). This disparity might reflect the SEC’s increased scrutiny on “AI washing” – exaggerated or misleading claims about AI.
Beyond just the number of companies, the average number of unique AI-related sentences per filing has also steadily increased, indicating a deeper engagement with the topic in corporate disclosures. While mentions of AI in the Business section of filings have also grown, reflecting AI’s expanding role in operations, the dramatic rise in AI risk disclosures in the Risk Factors section is particularly noteworthy.
Common and Overlooked AI Risk Categories
When it comes to the types of AI risks disclosed, legal and competitive risks are the most frequently mentioned. These cover concerns about regulatory uncertainty, increasing compliance burdens, potential legal actions, liability, and intellectual property issues. Competitive risks often revolve around the rapid pace of AI development, the need for large and uncertain investments to stay competitive, and the fear of falling behind in the AI race.
The research also identified growing attention to societal AI risks. Companies are increasingly mentioning issues such as misuse by external actors (e.g., cyberattacks or fraud enabled by AI) and internal privacy and security concerns stemming from AI use. Technical limitations of AI systems, including opacity, bias, and robustness, are also being acknowledged, sometimes more frequently by non-tech companies. For instance, an energy technology company noted that “Cyberattacks are expected to accelerate on a global basis in both frequency and magnitude as threat actors become increasingly sophisticated in techniques and tools (including artificial intelligence).”
However, the study points out several critical societal AI issues that remain largely absent from corporate disclosures. These include the environmental impact of AI, its effects on the labor market (socioeconomic displacement), the risks associated with dangerous AI capabilities, multi-agent risks, and the pollution of the information ecosystem, particularly through generative AI content.
The Challenge of Generic Disclosures
A significant finding is that many AI risk disclosures remain generic, vague, or lack specific details on mitigation strategies. This “boilerplate language” is common across all company groups studied. Top tech firms, in particular, often tend to externalize societal AI risks, attributing them to third-party misuse or faulty datasets, rather than acknowledging their own role in developing and deploying systems that might contribute to these risks. While some companies do offer more concrete acknowledgments of AI’s technical limitations and related societal risks, providing details on mitigation strategies, these are less common.
The authors suggest that these patterns mirror long-standing trends observed in cybersecurity disclosures, where firms often rely on generic language until regulatory efforts force greater transparency. This highlights the limitations of 10-K filings as a sole source for understanding companies’ full stance on AI risks, as firms are only required to disclose risks material to their business or investors, potentially leaving broader societal harms undiscussed.
Also Read:
- Predicting Public Acceptance of AI: A Moral Framework Revealed
- US States and Federal Government Bolster AI Oversight with New Regulations in August 2025
Implications for Policy and Future Research
The study’s findings underscore the need for the SEC’s continued push for more truthful and tailored AI disclosures. The authors recommend that more specific rules and guidance, similar to those introduced for cybersecurity, could significantly improve the quality of AI risk reporting. This includes encouraging companies, especially those central to AI development, to detail their risk mitigation strategies.
To support further research in this evolving area, the study’s authors have publicly released a web-based tool for easily extracting and analyzing keyword-based disclosures across SEC filings. You can find the full research paper here: Research Paper.
Future work could delve deeper into the quality and specificity of these disclosures, potentially developing metrics to assess how detailed and actionable they are. Comparative analyses with EU data would also be insightful, especially given the new AI risk assessment and reporting requirements introduced by recent EU regulations.
