Introduction
In 2025, companies should not assume the SEC created a standalone AI disclosure form or a universal AI reporting rule. It didn't. But existing materiality-based obligations still apply whenever AI affects the business, financial condition, risks, products, or investor decisions.
Boards and disclosure teams struggle with that gap. AI now shows up in earnings calls, 10-K risk factors, and product pages, often with different wording in each. Roughly 72% of S&P 500 companies now flag AI as a material risk, up from 12% in 2023, according to The Conference Board.
This article is for US public company boards, audit and risk committees, executives, legal teams, finance leaders, and technology and cybersecurity leaders. It separates binding requirements, SEC scrutiny signals, and recommended governance practices.
This is general information, not legal advice. SEC rules, staff positions, and enforcement priorities change, so consult qualified securities counsel before making filing decisions.
Key Takeaways
- Using AI doesn't trigger a separate SEC filing; materiality and accuracy drive disclosure.
- Assess AI's effect on strategy, revenue, costs, cybersecurity, IP, and third-party dependencies.
- Make AI claims specific, supportable, balanced, and consistent across every channel.
- Board oversight, AI inventories, and evidence trails reduce disclosure surprises.
Are There New SEC AI Disclosure Requirements in 2025?
No AI-specific issuer form or Regulation S-K item took effect in 2025. The SEC Investor Advisory Committee's own December 2025 recommendation notes the absence of public rules specifically addressing AI disclosures.
Binding, Signal, or Recommendation?
| Category | What it is | Weight |
|---|---|---|
| Materiality standard (TSC Industries, Basic v. Levinson, SAB 99) | Would the fact significantly alter the "total mix" of information for a reasonable investor? | Binding |
| Exchange Act Section 10(b)/Rule 10b-5, Securities Act Section 17(a) | Antifraud provisions covering misstatements and omissions | Binding |
| Exchange Act Rule 12b-20 | Add material information needed to keep required statements from misleading | Binding |
| Gensler, Gerding, and Grewal remarks (2024); exam priorities for FY2025 and FY2026 | Expectations on reasonable basis, definitions, and accurate AI representations | Staff and enforcement signals |
| IAC recommendation, December 4, 2025 | Define AI, describe board oversight, report material deployment effects | Nonbinding |
Two scope points matter. The predictive data analytics proposal was withdrawn in June 2025, and it targeted broker-dealer and adviser conflicts, not issuer disclosure. Exam priorities apply to examined entities such as advisers and broker-dealers, not corporate issuer rulemaking.
Where Exposure Arises
Review any investor-facing document:
- 10-Ks, 10-Qs, and 8-Ks
- S-1 and S-3 registration statements
- Proxy statements and earnings materials
Foreign private issuers use Form 20-F and 6-K, and are exempt from Exchange Act proxy rules.
The absence of a dedicated rule does not eliminate liability. Misleading statements, omissions, unsupported claims, and inconsistent disclosures all remain actionable.
The 2023 cybersecurity rules (Regulation S-K Item 106, Form 8-K Item 1.05) are separate from AI. They still matter when an AI system is involved in a material cyber incident, because the four-business-day clock runs from the materiality determination.
What AI-Related Information May Need to Be Disclosed?
Start with a materiality assessment. Ask how AI affects:
- Revenue and growth assumptions
- Operating costs and capital spending
- R&D and workforce
- Customer relationships and competitive position
Document the conclusion, including why something was left out.
Business and Strategy (Regulation S-K Item 101)
- Define what "AI" means in your company
- List current use cases
- Separate deployed capabilities from planned or aspirational ones
- Describe how AI actually supports products or operations
MD&A (Item 303)
Item 303 calls for known events and uncertainties reasonably likely to make reported results materially different. Consider:
- Changes in expenses, productivity, and investment
- Effects on margins and demand
- Implementation timelines and workforce impacts
Confirm the right item and filing context with counsel.
Risk Factors (Item 105) and Legal Proceedings (Item 103)
Risk factors must be material and company-specific. Candidates include:
- Cybersecurity, privacy, and data provenance
- Intellectual property exposure
- Model errors, bias, and hallucinations
- Regulatory compliance and operational resilience
- Vendor concentration and reliance on third-party models or infrastructure
- Material pending AI-related litigation
Governance and Operational Effects
Where relevant, explain:
- Board or committee oversight and management accountability
- Model validation, monitoring, and access controls
- Incident response
Also consider whether you can measure AI outcomes at all.
AI Deployed by Others
Material effects can come from suppliers, platforms, or competitors. Chegg's October 2025 8-K exhibit attributed a significant decline in traffic and revenue to "the new realities of AI and reduced traffic from Google." The company also announced a restructuring affecting 388 roles, about 45% of its workforce, though not attributed solely to AI.
Not every outside AI development requires disclosure. The test remains materiality to your business.
How Can Companies Avoid AI Washing and SEC Scrutiny?
AI washing means overstating, mischaracterizing, or making unsupported claims about AI capabilities, deployment, performance, or competitive advantage. SEC Enforcement Director Grewal said in 2024 that it extends beyond investment firms.
What Enforcement Looks Like
- Presto Automation (January 14, 2025): SEC found misleading claims that AI eliminated human order-taking (most orders still needed people) and failure to disclose third-party tech ownership. Settled without a civil penalty after cooperation and remediation.
- Delphia and Global Predictions (March 2024): Advisers fined $225,000 and $175,000 for false AI claims.
- Nate Inc. founder Albert Saniger (April 2025): Charged by the SEC and DOJ over alleged human-powered "AI" automation. These are allegations, and Nate is a private company.
Beyond these matters, additional 2025 issuer AI-washing actions are not clearly established in primary sources, so treat claims that enforcement is widespread among public companies with caution.
Substantiate Every Material Claim
Document each material claim with evidence on:
- Model or tool and who owns it
- Deployment status and timeline
- Data sources and validation process
- Known limitations and human oversight
- Measurable effect on the business
Then replace vague phrasing. "Industry-leading AI-powered platform" becomes "a third-party language model summarizes support tickets for agents in our US call centers; a human reviews every customer response."
Balance matters too. Disclose the downside case as well:
- Adoption barriers and implementation costs
- Regulatory uncertainty and security risks
- Data restrictions and vendor dependence
- The chance expected benefits will not materialize
Recurring Comment-Letter Themes
Anonymized issuer comments reported by Orrick point to consistent themes. These are staff signals, not an SEC-wide template:
- Materiality: AI discussed on earnings calls or in board materials may warrant filing disclosure
- Reasonable basis for claims about AI prospects
- Definitions of AI, generative AI, and large language models
- Current versus future capabilities
- Data sharing and training with third parties
Run a cross-functional review so filings, earnings scripts, websites, and product descriptions use the same definitions, dates, and evidence. Unreconciled contradictions are the easiest thing for a reviewer to find.
A Practical AI Disclosure Readiness Checklist
- Build an AI inventory. Record systems, models, vendors, datasets, owners, use cases, deployment stage, and customer-facing applications. Pair it with a materiality assessment and written rationale.
- Assign ownership. Define roles for the board, audit or risk committee, legal, finance, technology, cybersecurity, privacy, compliance, and investor relations. Set escalation thresholds for material AI events.
- Keep an evidence file for each material claim: approvals, validation, testing, vendor diligence, data-use permissions, dates, performance measures, and the source of the public statement.
- Review before each reporting cycle and after major deployments, model failures, cyber incidents, litigation, vendor disruptions, acquisitions, or shifts in financial expectations.
- Report to the board plainly. Show risk posture in plain English, what changed since the last briefing, trend metrics, open decisions, owners, and actions due next period.
Document how each internal metric is defined. If a definition changes, disclose that change, especially in 10-K filings.
Boards without internal capacity can bring in outside help. Tyson Martin provides board advisory and fractional CISO support, helping boards set decision rights, escalation thresholds, and a 90-day plan with owners and measurable outcomes. Securities counsel remains responsible for legal disclosure advice.
What Boards and Executives Should Ask
Questions for the Next Meeting
- Where is AI materially affecting the business?
- Which uses are deployed, and which are experimental?
- What changed since the last filing?
- Which financial assumptions depend on AI performance?
- Which third parties create material exposure?
- Can we explain our AI use in plain English and support every material claim?
- Do statements match across filings, calls, websites, and marketing?
- Who owns escalation when an AI issue touches customers, operations, or reporting?
Speed makes this urgent. Teams can add AI to support, marketing, engineering, and analytics in weeks, often faster than oversight adapts. 62% of boards that uncovered AI governance failures learned of them through external events such as media, regulators, or lawsuits.
Do You Need a New AI Committee?
Usually not. The NACD advises leveraging existing committees, and Item 407(h) prescribes no AI committee. Audit and risk committees work when cadence and reporting are strong. A technology committee helps when the roadmap is dense or vendor choices are material.
ISS-Corporate found 31.6% of S&P 500 companies disclosed some form of board AI oversight or competency, but only 11% explicitly assigned it to the full board or a committee. Disclosure does not prove effectiveness.
Frequently Asked Questions
What are SEC disclosure requirements?
Public companies must provide material, accurate, nonmisleading information in required filings and communications. The specific requirement depends on the filing, company status, facts, and materiality.
Do you have to disclose if something is made with AI?
There's no blanket SEC mandate to label everything created with AI. Disclosure may be needed when the AI use is material, creates a material risk, or would otherwise make a statement misleading.
Are there specific SEC rules for AI disclosures in 2025?
No AI-specific issuer rule was adopted. Existing principles-based rules apply, alongside staff comments, enforcement actions, and nonbinding recommendations. Verify current status on SEC.gov.
What is AI washing under SEC rules?
It's unsupported or misleading exaggeration of AI capabilities, use, or results. Keep a reasonable basis and balanced disclosure for any material claim.
Where should AI-related information appear in SEC filings?
Possible locations include the business description, risk factors, MD&A, legal proceedings, proxy governance disclosure, registration statements, and 8-Ks. The right place depends on the facts and the filing.
Does the SEC require companies to disclose board oversight of AI?
Not as a standalone AI requirement. Item 407(h) covers board risk oversight generally, and the IAC's recommendation to describe AI oversight is nonbinding. Oversight may still matter when it explains how material AI risks are managed.
