AI Disclosures to SEC Jump as Agency Warns of Misleading Claims

Allstate Corp., Starbucks Corp., and other major companies are talking more about artificial intelligence in disclosures to investors—and securities regulators are paying close attention.

Just over 40% of S&P 500 companies mentioned AI in their most recent annual report with the Securities and Exchange Commission, according to Bloomberg Law’s review of the disclosures. That continues an upward trend since 2018, when AI was mentioned only sporadically.

Companies as varied as used car dealer CarMax Inc. and CVS Health Corp. highlighted their use of AI in various business initiatives, while others focused on competitive and security risks from the technology.

These discussions about the opportunities, and risks, of AI for businesses are in the SEC’s crosshairs. SEC Chair Gary Gensler and other agency officials have repeatedly warned companies about making misleading AI-related claims, including so-called AI-washing, which could lead to legal action.

“Don’t do it,” Gensler warned at a December conference. “One shouldn’t greenwash and one shouldn’t AI-wash.”

Public companies could also find themselves in hot water if the SEC determines they didn’t do enough to warn investors about AI-related risks. The SEC’s heightened scrutiny follows enforcement actions and shareholder suits in recent years targeting companies for climate-related disclosures and cybersecurity-related risk disclosures.

“AI disclosures should be top of mind in preparing SEC reports,” said P.J. Himelfarb, a Weil, Gotshal & Manges LLP partner and former SEC attorney.

Disclosure Uptick

Rapid advances in AI have fueled optimism among corporations about its potential uses—but also increasing acknowledgment of its risks to their business.

Bloomberg Law reviewed the 10-K annual reports that S&P 500 companies filed with the SEC for mentions of “artificial intelligence,” “AI,” and “A.I.” from 2018 through 2023.

At least 203, or 41%, of the S&P 500 companies mentioned AI in their most recent 10-K report, Bloomberg Law’s review found. That’s up from 35% in 2022 and 28% in 2021. A majority of the disclosures focused on the risks of the technology, while others focused on its benefit to their business.

Companies are also talking more about AI on earnings calls, a recent analysis by financial software company FactSet found. And it isn’t just tech companies. Bloomberg Law found AI was mentioned in 10-Ks filed by a range of businesses, from insurers and automakers to tobacco companies.

“A wide range of companies and industries are dealing with it and addressing it,” said Ropes & Gray LLP partner Jeremiah Williams, who focuses on securities enforcement. “This is something that is going to effect every company in some way or another in the future.”

Securities laws require public companies to disclose information deemed “material” to investors. The SEC is taking a close look at what companies are saying about AI, including the risk it poses to their business, Carolyn Welshhans, associate director of the SEC’s Division of Enforcement, said at a recent securities conference.

Welshhans drew parallels to cybersecurity, where some of the SEC’s early actions against companies alleged a failure to adequately disclose risks. Blackbaud Inc., for example, was fined $3 million last year because the SEC said it made misleading disclosures about a ransomware attack.

“Like cybersecurity, I think it’s something that companies are going to have to deal with because there could be risks posed to companies,” Welshhans said at the Securities Enforcement Forum last year in Washington.

The risk could be “from AI being used by others,” she said.

AI-Washing

Securities regulators are also warning companies not to make bogus or exaggerated claims about their use of AI to investors. The SEC is “on the lookout” for AI-washing, Tejal Shah, an associate regional director in the SEC’s New York office, said during an event for corporate compliance lawyers in October.

The focus mirrors the SEC’s prior warnings about greenwashing, where companies make overhyped climate claims. Allegedly misleading climate statements have led to regulatory actions and lawsuits from investors and others.

Enviva Inc., for example, was hit with a shareholder lawsuit accusing the renewable energy company of overstating the sustainability of its wood pellet production. Enviva has asked a federal judge to dismiss the complaint, which alleges securities fraud.

Companies touting their use of AI could face their own legal headaches if it turns out the technology is “not that transformative or it’s not doing that much to change their operations,” Kevin LaCroix, executive vice president at insurance broker R-T Specialty LLC, said in a recent webinar about top issues for director and officer insurance.

“Time will tell, but I suspect that when we get together next year we will have examples of cases,” LaCroix said.

Opportunities and Risks

Not everyone is talking about AI the same way.

CVS said it was making concerted investments in AI and other emerging technologies “to further automate, reduce cost and improve the experience” for users in its Health Care Benefits segment. Carmax, the used car retailer, similarly said it uses AI to “optimize our business and the customer experience.”

But over half the companies that mentioned AI in their annual report discussed possible risks related to the technology.

“More and more companies are discussing whether they need an AI risk factor,” Himelfarb said.

That’s an easy decision for companies dealing with AI risks that go to the core of their business. Online travel company Expedia Group Inc., for example, said expanded AI capabilities by search engines could hurt Expedia’s business if they negatively affect the company’s search traffic.

Nvidia Corp., which makes computer chips, warned of possible legal and regulatory issues associated with the technology. And Cisco Systems Inc. said its reputation could take a hit if it can’t “identify and mitigate ethical and legal issues” before they arise.

“AI presents risks, challenges, and unintended consequences that could affect our and our customers’ adoption and use of this technology,” Cisco said in its filing.

For other companies, the risks are more remote.

Many cited security threats related to AI. Campbell Soup Co. and Starbucks Corp., for example, each warned the “the rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks.”

Meanwhile, Allstate said it could become less competitive if it isn’t able to deploy technology like AI and machine learning in its underwriting process. Allstate, Campbell Soup, and Starbucks hadn’t mentioned AI in annual reports prior to 2023.

Companies are still finding their footing with AI-related disclosures, including weighing whether to mention certain risks at all. Some have opted for a more conservative approach, choosing to err on the side of inclusion.

“There’s much more risk to omitting something than including it,” Ropes & Gray’s Williams, a former SEC attorney, said.