We asked Gerty: “Perform a detailed analysis and write an article to discuss how AI should affect companies’ SEC 10-k disclosures. Use recent events and emerging AI regulations to justify your recommendations. Conclude with whether 10-K disclosures provide any value.”
THIS ARTICLE IS NOT MEANT TO PROVIDE LEGAL ADVICE. IT’S A WORK OF AI.
An analysis of recent market events, enforcement actions, and emerging AI regulation — and what they demand of the annual report.
Executive Summary
- AI has become a first-order disclosure issue. More than half of Fortune 500 companies (56%, or 281 firms, up 473.5% year-over-year) now cite AI as a risk factor in their 10-Ks (Arize AI, CIO Dive), the four hyperscalers are on track to spend roughly $700–725 billion on capital expenditures in 2026 (Forbes), and single AI-related news items can now erase hundreds of billions of dollars of market value in a day (Washington Post).
- There is no dedicated SEC AI-disclosure rule, and there may never be one. AI facts reach investors through existing Regulation S-K Items 101 (Business), 105 (Risk Factors), 303 (MD&A), and Item 1C (Cybersecurity), governed by materiality (Deloitte DART).
- “AI washing” has matured from a warning into an enforcement theory. SEC actions against Delphia and Global Predictions (2024) and Presto Automation (January 2025), plus parallel criminal charges against the founder of the Nate shopping app (April 2025), establish that overstated AI claims are securities fraud (SEC, SEC, DOJ).
- A fragmenting global AI-regulatory map — the EU AI Act, Colorado, Texas, and California — creates material compliance costs and disclosure triggers that belong in the 10-K today, not after enforcement begins.
- The verdict of this article: 10-K disclosures do provide value, but conditional value. They are the authoritative, liability-anchoring layer of the information stack; AI raises the value of particularized disclosure while rendering boilerplate worthless — and litigation data show markets and plaintiffs’ lawyers can tell the difference.
1. A Market Suddenly Pricing AI Reality
The best argument for AI disclosure reform is the market’s own behavior in the last two years.
On January 27, 2025, news that Chinese startup DeepSeek had trained a frontier-class model at a fraction of assumed U.S. cost triggered a global tech selloff. Nvidia fell roughly 17%, erasing about $589 billion in market capitalization — the largest single-day value loss of any company in stock-market history — and the Nasdaq dropped about 3% (Washington Post, Forbes). The proximate cause was not fraud or mismanagement; it was an information shock about AI economics that no annual report had prepared investors to evaluate.
The stakes have only grown. The four hyperscalers — Microsoft, Alphabet, Amazon, and Meta — are projected to spend between $700 and $725 billion in capital expenditures in 2026, up roughly 75% from about $410 billion in 2025 (Forbes, Statista). Credit markets have flagged AI-infrastructure debt and “neocloud” financing as warning signals (Uvik Software), and even a model delay now moves prices: Alphabet shares fell after a July 16, 2026 report that its flagship Gemini 3.5 Pro model was months behind schedule (CNBC) — a move that plaintiffs’ firms promptly converted into a securities-fraud class action in October 2026 (PR Newswire).
The litigation wave is measurable. Cornerstone Research and the Stanford Securities Class Action Clearinghouse report that securities class action filings surged in the first half of 2026, with AI-related cases representing “a modest share of total filings but an outsized share of alleged investor losses” in the words of Stanford’s Joseph Grundfest (Cornerstone Research, Bloomberg Law). Recent filings target AppLovin (a ~20% drop tied to alleged misrepresentations about its AI-based business model) (PR Newswire) and SES AI (filed May 2026 after a 37% decline) (Launch Legal). These complaints remain allegations, not findings — but they demonstrate that AI narratives, once priced into stocks, are being litigated when they disappoint.
Implication for the 10-K: when a single AI headline can move a trillion-dollar index, the annual report’s job is no longer to announce that AI matters. It is to give investors the structure to price AI claims: what is being spent, what is owned, what is assumed, what could go wrong, and who is accountable.
2. The Disclosure Baseline: No AI Item, Plenty of Obligation
There is no line item on Form 10-K for artificial intelligence. As of late 2026, no dedicated AI disclosure rule exists; instead, AI facts are governed by the classic materiality-driven framework: Regulation S-K Item 101 (Business), Item 105 (Risk Factors), Item 303 (MD&A and “known trends and uncertainties”), and Item 1C cybersecurity disclosure under Item 106, which captures AI-related security threats and governance (Deloitte DART, Finrep).
That framework is more demanding than most filers treat it:
- SEC staff are already reading AI disclosures closely. A survey of SEC comment letters found at least 92 AI-related comments issued to 56 different companies between 2021 and October 2024, spanning technology, biopharma, healthcare, real estate, retail, and financial services (Harvard Law School Forum on Corporate Governance). At the 2024 AICPA Conference, SEC Corporation Finance Deputy Director Cicely LaMothe noted the rising presence of AI references in MD&A and risk factors and urged disclosure of AI risk “when appropriate” (Deloitte DART).
- The market backdrop (export controls, chips, energy) is now a 10-K issue. Companies increasingly address semiconductor and AI export controls, data flows, and compliance costs in MD&A and risk factors (Gibson Dunn).
- But actual disclosure quality lags. Arize AI’s study of 2024 10-Ks found that while 56% of Fortune 500 companies flagged AI as a risk factor, most did so in generic, near-identical terms; companies with the largest AI exposure were often among those with the least specific discussion (Arize AI, SSRC). The SSRC’s AI Disclosures Project, analyzing over 7,800 AI-related 8-K filings, found roughly two-thirds were overwhelmingly positive and avoided negative news — a one-way disclosure ratchet (SSRC).
The gap, in short, is not a missing rule. It is that filers use a materiality-based framework as a ceiling rather than a floor.
3. Enforcement: AI Washing Is Now a Securities-Fraud Theory
The enforcement trajectory has been unusually fast:
- December 2023 — the warning. SEC Chair Gary Gensler cautioned that “when new technologies come along, we’ve also seen time and again false claims to investors by those purporting to use those new technologies,” urging companies not to “AI wash” (SEC, Jones Day).
- March 2024 — the first charges. The SEC charged two investment advisers, Delphia Inc. and Global Predictions Inc., with making false and misleading statements about their use of AI in investment processes (SEC). The message was explicit: if you claim to use AI, “you need to ensure that your representations are not false or misleading.”
- January 2025 — a public company. The SEC charged Presto Automation with making materially false and misleading statements about its flagship AI product, Presto Voice — including claims that it eliminated the need for human order-taking when “substantial human involvement” was required (SEC, Cooley).
- April 2025 — criminal exposure. The DOJ indicted Albert Saniger, founder of the Nate shopping app, alleging that the “AI-powered” app in fact relied on hundreds of human contractors in a Philippine call center; the SEC filed parallel civil charges (DOJ, DLA Piper, TechCrunch).
Former enforcement director Gurbir Grewal’s accompanying message was that executives who overstate AI capabilities face heightened personal liability absent proactive compliance (Norton Rose Fulbright). And the scrutiny is institutionalized: the SEC’s Division of Examinations listed identification and mitigation of new risks associated with AI (including AI-enabled polymorphic malware) among its 2026 exam priorities (Harvard Law School Forum on Corporate Governance), while the agency’s own August 1, 2025 AI Task Force focuses internally on deploying AI across the SEC’s operations (SEC).
The through-line for 10-K drafters: the enforcement theory is not that AI is dangerous — it is that AI claims are cheap to make and hard to verify, which is exactly the asymmetry disclosure law exists to correct.
4. The Regulatory Tide Outside the SEC
Even as the SEC has moved toward principles-based restraint under Chair Paul Atkins — who launched a Regulation S-K reform initiative in January 2026 built on “rationalization, simplification, and modernization” and a “minimum effective dose of regulation” (Sidley, Thomson Reuters, SEC) — a fragmented body of AI law is accumulating around issuers, and it is itself disclosable:
- EU AI Act. The world’s first comprehensive AI statute took effect in 2024, with prohibitions applying from February 2025, general-purpose AI obligations from August 2025, and transparency obligations (Article 50 — including deepfake and synthetic-content disclosure) taking effect August 2, 2026 (EU AI Act Portal). The July 2026 Digital Omnibus (Regulation (EU) 2026/1744) deferred the Annex III high-risk compliance deadline to December 2, 2027 and Annex I to August 2, 2028 (ActuIA, Technology.org) — deferred, not cancelled. Penalties reach €35 million or 7% of worldwide turnover for prohibited practices, and up to €15 million or 3% for most other violations including high-risk non-compliance (EU AI Act Portal).
- Colorado. The first comprehensive U.S. state AI law (SB 24-205, 2024) was delayed, then substantially rewritten and scaled back by SB 189, signed May 14, 2026, with an effective date of January 1, 2027 (Hunton, Norton Rose Fulbright).
- Texas. The Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) took effect January 1, 2026, prohibiting certain intent-based AI uses with Attorney General enforcement (Texas Attorney General, Latham & Watkins).
- California. SB 53, the Transparency in Frontier Artificial Intelligence Act, signed September 29, 2025, requires large frontier developers to publish a frontier AI framework, release transparency reports for new or substantially updated models, and report incidents (Governor of California, CA Legislature).
Meanwhile, pressure for affirmative AI disclosure is arriving at the SEC through official channels:
- The SEC’s Investor Advisory Committee issued a formal recommendation on December 4, 2025 that companies disclose how they define “artificial intelligence,” their board oversight mechanisms for AI deployment, and — where material — how they are deploying AI and its effects on operations and consumers (Akin Gump, SEC).
- Proxy advisor Glass Lewis included AI deployment, risk, and governance disclosure recommendations in its 2026 policy guidelines (Akin Gump).
- Rulemaking petitions have been filed. Petition 4-882 (February 9, 2026) asks the Commission to mandate standardized AI governance and risk-management disclosure in public filings (SEC, petition). Petition 4-910 (July 7, 2026) requests standardized supplemental disclosure for registrants making material investments in AI compute infrastructure — asset aging by vintage, useful-life and depreciation sensitivity, utilization, retirements and impairments, and, where measurable, economic yield reconciled to GAAP segments (SEC, petition).
- Board-oversight liability is no longer theoretical. Scholarship and practice notes warn that Delaware’s Caremark oversight duty — now extended to officers — applies to algorithmic systems: directors must ensure reporting systems reasonably surface AI-related compliance risks (Oxford Business Law Blog, Harvard JOLT, Akin Gump).
- The SSRC’s AI Disclosures Project has proposed a materiality-first regime modeled on the SEC’s 2023 cybersecurity rule: guidance clarifying what a “material” AI risk is, a dedicated AI-incident item on Form 8-K, a standing 10-K section on AI strategy, governance, risk, and dependencies, and continued AI-washing enforcement (SSRC).
Implication: issuers are being regulated on AI from Brussels, Austin, Sacramento, Denver — and by their own shareholders. A 10-K that ignores this map fails the materiality test on its face.
5. Recommendations: How AI Should Change the 10-K
The recommendations below deliberately work within the existing materiality framework rather than proposing a new disclosure item — an important constraint given the Atkins Commission’s deregulatory posture and the documented costs of disclosure bloat (Section 6).
R1. Anchor everything in materiality, and define your terms. Companies should state plainly what they mean by “AI” and which systems the term covers. This was the first element of the SEC Investor Advisory Committee’s December 2025 recommendation (Akin Gump). A definition costs three sentences; its absence invites the inference that management cannot describe its own technology.
R2. In Item 101 (Business), describe actual deployment — build, buy, and degree of autonomy. Disclose where AI is used in operations, whether models are proprietary or third-party, and what functions are automated versus human-assisted. The Presto and Nate cases turned precisely on the gap between the claimed autonomy and the human reality behind it (SEC, DOJ). Dependency on a single foundation-model provider is a concentration fact of the same order as a single-source supplier.
R3. In Item 105 (Risk Factors), replace generic AI risk with quantified, company-specific risk. Boilerplate AI risk factors are worse than useless — they are now a documented enforcement flag: the SEC has called out inconsistencies where the 10-K describes AI only generically while management touts AI to analysts (Harvard Law School Forum, Finrep). Risk factors should cover: (a) technological obsolescence of AI compute; (b) regulatory mapping — concrete exposure to the EU AI Act’s deadlines and turnover-based fines (EU AI Act Portal), TRAIGA, California SB 53, and Colorado’s 2027 regime; (c) competitive disruption from cheaper rivals — the DeepSeek episode is the case study (Washington Post); and (d) concentration in chips, energy, and data-center capacity.
R4. In Item 303 (MD&A), treat AI capex as a “known trend or uncertainty” — with numbers. Where AI infrastructure is material, MD&A should disclose: capex devoted to AI compute; useful-life and depreciation assumptions for accelerators and servers, with sensitivity analysis (a one-year reduction in useful life changes depreciation by how much?); utilization trends; and retirements and impairments. This is essentially Petition 4-910’s ask (SEC), and it is a reasonable one: with ~$700 billion of 2026 hyperscaler capex riding on assets that may obsolete in three years, useful-life assumptions are among the most consequential numbers in the filing (Forbes). Energy and grid-access constraints tied to data centers belong here too.
R5. In Item 1C (Cybersecurity), disclose AI-specific security posture. The 2023 cybersecurity rule’s materiality framework already captures AI-enabled threats; the SEC’s 2026 exam priorities single out AI and polymorphic malware (Harvard Law School Forum). Companies using AI in security operations or facing model-poisoning and prompt-injection exposure should say so concretely rather than by implication.
R6. Disclose governance — board oversight, management roles, and reporting systems. The Investor Advisory Committee’s recommendation and Glass Lewis’s 2026 guidelines converge here (Akin Gump). Caremark doctrine makes this self-interested, not merely responsive: a board without a reasonably designed reporting system for AI risks may face oversight claims if an AI failure causes corporate loss (Oxford Business Law Blog). Governance disclosure in the 10-K (and proxy) is evidence the system exists.
R7. Enforce claim consistency through disclosure controls and procedures. The same internal-controls discipline that governs financial reporting should govern AI claims across earnings calls, investor decks, and the 10-K. The 2024–2025 enforcement actions and the 2026 class action wave (Alphabet, AppLovin, SES AI) all involve alleged gaps between narrative and reality (PR Newswire, PR Newswire). Every AI claim should be traceable to evidence management can substantiate.
R8. Support the SEC in a middle path: materiality guidance plus an incident-reporting analog — not a new mega-item. The SSRC’s proposal is directionally right: SEC guidance on what makes an AI risk material, a defined 8-K AI-incident item, and a standing but concise 10-K AI section — a cybersecurity-rule analog (SSRC). A prescriptive one-size-fits-all AI item would repeat the mistakes of disclosure accretion documented below.
6. The Counterweight: Disclosure Overload and the Atkins Agenda
A candid analysis must acknowledge the case against expanding the 10-K — because it is strong and it currently holds the Commission.
The empirical record shows the 10-K has been growing for decades: Dyer, Lang, and Stice-Lawrence documented that 10-K filings roughly doubled in length between 1996 and 2013, with risk-factor, fair-value, and internal-control disclosures exhibiting high redundancy, stickiness, and boilerplate, and low readability (Dyer et al., JAE 2017). Researchers continue to find that mandatory risk disclosure can impose real costs — one recent study links expanded risk-factor disclosure to measurable information overload and even chilling effects on risky corporate activity (ScienceDirect). The Committee on Capital Markets Regulation’s April 2026 report on optimizing Regulation S-K argues for rationalizing disclosure to reduce information overload (CCMR). Chairman Atkins has been explicit: reforms should be grounded in “financial materiality,” scaled to company size and maturity, and aimed at the “minimum effective dose of regulation” (Thomson Reuters, SEC).
This is why the recommendations above are framed as better use of existing items rather than new mandates. The failure mode of securities regulation is not under-disclosure of AI in principle — it is a thousand pages of generic AI risk factors that no investor can distinguish from one another, which is roughly what the Arize and SSRC data show we already have (Arize AI, SSRC). The discipline of materiality — “what really matters is the materiality of what to tell investors, not the periodicity,” as FCLT Global’s Sarah Williamson put it (quoted in the SSRC paper) — is the right filter.
7. Conclusion: Do 10-K Disclosures Provide Any Value?
Yes — but not the value their critics attack, and not unconditionally.
The case that they do. Academic evidence shows mandated disclosure carries real information: risk-factor changes are systematically associated with subsequent return volatility, litigation, and other firm outcomes (Campbell et al., Review of Accounting Studies) (SSRN, University of Arizona), risk disclosures become more specific and less sticky when firms face genuine stress (Nature HSSC), and the prominence firms give risk factors is itself a disclosure choice that moves information (Chin, Contemporary Accounting Research). The 10-K’s distinctive value is not speed — earnings calls, 8-Ks, and sell-side research beat it — but authority and legal anchoring. It is signed by officers, certified by the CEO and CFO, and enforceable under Rule 10b-5. Every AI-washing action and every 2026 class action is, in effect, a dispute over what the annual report should have said. Markets use that anchor: the DeepSeek selloff, the Gemini-delay drop, and the capex repricing are all markets demanding precisely the quantitative AI structure (asset vintages, useful lives, utilization, dependencies) that a modernized 10-K could supply.
The case for humility. That value is conditional on specificity. A 56% AI-risk-factor rate achieved largely by near-identical paragraphs is disclosure theater (Arize AI); two-thirds positive, news-managed AI 8-Ks are marketing, not disclosure (SSRC); and a filing that grows ever longer and less readable taxes every investor who relies on it (Dyer et al.).
The AI-era synthesis. AI paradoxically strengthens the case for the 10-K while exposing its weaknesses. It strengthens the case because AI’s core securities-law problem is verification asymmetry: capabilities are cheap to claim and expensive to confirm, and the annual report is the one channel where claims are certified under penalty of law. The 2024–2025 enforcement actions prove the SEC will police that channel (SEC, SEC, DOJ). It exposes the weaknesses because a boilerplate 10-K provides no verification at all — and machine readers, from regulators’ screening tools to institutional LLM pipelines, now compare filings across thousands of companies, making boilerplate more detectable and specific disclosure more valuable.
Verdict: 10-K disclosures provide real value — as the certification layer of capital markets. That value is realized only when disclosures are material, particularized, quantified, and consistent. For AI above all, the right policy is not more pages; it is numbers (capex, useful lives, utilization), definitions, governance, and regulatory mapping in place of adjectives. A 10-K that does this is worth more in the AI era than at any point in its history. One that doesn’t was never worth much — and, thanks to enforcement and litigation, is now more dangerous than useless.
Methodology
This article synthesizes primary sources (SEC releases, enforcement orders, rulemaking petitions, statutes, and the EU AI Act text), secondary legal and market commentary from major firms (Harvard Law School Forum, Sidley, Gibson Dunn, Norton Rose Fulbright, Akin Gump, DLA Piper, Cooley, Latham, Hunton), market data (Bloomberg, Forbes, CNBC, Cornerstone Research/Stanford), and peer-reviewed academic research (Journal of Accounting and Economics; Review of Accounting Studies; Contemporary Accounting Research). Searches were conducted in October 2026 with emphasis on events from January 2025 through October 2026. Limitations: class action filings cited are allegations, not adjudicated findings; comment-letter counts derive from a law-firm survey (Orrick) rather than an SEC-published tally; and EU Digital Omnibus implementation details reflect sources published through October 2026.
Source Notes
Conflicts and caveats. (1) The Alphabet, AppLovin, and SES AI suits are pending allegations promoted partly by plaintiffs’ firms; no court has found fraud. (2) The “92 comment letters / 56 companies” figure comes from an Orrick survey reported by the Harvard Law School Forum, not an SEC tally. (3) Secondary blogs (Finrep, Launch Legal, Uvik) were used only for corroboration of trends, not as primary support for key claims. (4) The EU Digital Omnibus timeline reflects sources published through October 2026; implementing details may evolve.
Open Questions
- Will the SEC act on petitions 4-882 and 4-910, or fold AI into the broader Reg S-K reform — and if the latter, will “simplification” cut AI content or channel it more efficiently?
- Will the courts treat an AI-specific risk factor as protective or as a hook for liability? Early 2026 class actions test whether generic AI risk factors satisfy the duty to disclose when company-specific AI claims were made elsewhere.
- Should the 8-K, not the 10-K, carry AI-incident reporting (per the SSRC cybersecurity analogy), given that AI incidents are sudden while the 10-K is periodic?
- Will the EU’s December 2027 high-risk deadline hold, or will further Digital-Omnibus-style delays change the compliance math issuers must disclose?
- How will machine consumption change disclosure design? If most 10-K readers are now models, the optimal disclosure may be more structured (tagged, tabular AI-capex data) than prose — a question neither the SEC’s 2026 agenda nor filers have yet answered.
