SEC AI Disclosures in 10-K Filings: A 2026 Compliance Guide for In-House Counsel

Why AI Disclosures Matter Now

If your company mentions AI in earnings calls, investor decks, or board materials, the SEC expects your 10-K and 10-Q filings to reflect that reality—with the same specificity, balance, and reasonable basis that apply to any other material disclosure. The gap between what companies say about AI and what their filings actually disclose has become an enforcement target. In 2024 and early 2025, the SEC brought its first AI-washing enforcement actions, issued dozens of comment letters probing AI-related disclosures, and an SEC advisory committee formally recommended standardized AI disclosure requirements. For in-house counsel at public companies—and for GCs at IPO-ready growth-stage startups preparing their first S-1—the message is clear: AI disclosure is no longer optional, and getting it wrong carries real legal risk.

We've written about the broader AI-washing litigation landscape for public-company GCs and about drafting AI disclosures for the 10-K with materiality in mind. This guide focuses on what the SEC's evolving guidance and enforcement record actually require in Item 1 business descriptions, Item 1A risk factors, and MD&A—and how to describe AI capabilities without overclaiming.

The SEC's Enforcement Track Record on AI-Washing

The SEC's first explicit AI-washing enforcement actions came on March 18, 2024, when the Commission settled charges against two investment advisers—Delphia (USA) Inc. and Global Predictions Inc.—for making false and misleading statements about their use of AI. Delphia claimed in press releases, website copy, and Form ADV filings that it used machine learning and client data to power its investment algorithms. In reality, Delphia had never incorporated client data into any AI or machine learning technology. The SEC ordered Delphia to pay a $225,000 civil penalty and Global Predictions to pay $175,000. The Commission charged both with violations of Sections 206(2) and 206(4) of the Investment Advisers Act and the Marketing Rule for disseminating advertisements containing untrue statements of material fact. (Mayer Brown, April 2024)

The SEC's second public-company AI-washing action followed in January 2025, targeting Presto Automation Inc., a restaurant-technology company that had gone public via SPAC. The SEC charged that Presto made materially false and misleading statements about its flagship AI product, "Presto Voice," which used AI-assisted speech recognition to automate drive-thru order taking. According to the SEC's order, Presto failed to disclose that the AI technology powering its commercially deployed units was actually owned and operated by a third party—not developed by Presto. Once Presto did begin using its own technology, it claimed the product "eliminated the need for human order taking," when in fact "substantial human involvement" was required. The SEC imposed a cease-and-desist order, though it declined to assess a civil penalty given Presto's financial condition. (Cooley PubCo, January 2025; SEC Administrative Proceeding 33-11352-S)

Then-SEC Chair Gary Gensler and Enforcement Director Gurbir Grewal had been telegraphing this enforcement direction for months. Gensler warned in February 2024 that "if a company is raising money from the public, [it] needs to be truthful about its use of AI and associated risk," and that "AI washing, whether it's by companies raising money or financial intermediaries, may violate the securities laws." Grewal similarly cautioned companies to ask whether their AI representations "accurately reflect what we are doing or are they simply aspirational." (Cooley PubCo, January 2025)

What Belongs in Item 1: Business Descriptions and AI Capabilities

Item 1 of Form 10-K requires companies to describe their business, including products, services, and competitive positioning. When AI is integral to a company's products or operations, the business description should address it—but with precision. Based on SEC comment letter trends, here's what the staff expects:

Define What You Mean by AI

Approximately 17% of SEC AI-related comment letters addressed terminology and definitions. The staff has asked companies to define terms like "AI," "generative AI," "deep learning," "large language models," and "neural networks," and to "explain how your software is properly characterized as AI or machine learning, rather than as an algorithm." If your company uses the term "AI" in its business description, be prepared to specify what technology you're actually describing. (TheCorporateCounsel.net, January 2025)

Describe Current Capabilities, Not Aspirations

Approximately 30% of SEC comment letters addressed unsupported or unqualified AI statements. The staff has asked companies to "revise" disclosures to "clarify, if true, that these are not yet products or services the company provides, and are instead areas of research or are aspirational." The line between a roadmap item and a shipping product matters enormously. If your AI capability is in development, say so. If it's deployed, describe how it works and what it actually does. The Presto enforcement action underscores this point: claiming a product "eliminates the need for human order taking" when substantial human involvement is required is a materially misleading statement. (TheCorporateCounsel.net, January 2025; Cooley PubCo, January 2025)

Disclose Third-Party Dependencies

The Presto action highlights a critical disclosure gap: failing to reveal that a flagship AI product is powered by a third party's technology rather than proprietary systems. If your company's AI capabilities depend on third-party models, APIs, or infrastructure, Item 1 should disclose that dependency. The SEC comment letters have also probed "the involvement of third parties" and "how the AI was developed"—including whether models were built in-house or sourced externally. (TheCorporateCounsel.net, January 2025)

Item 1A: AI-Specific Risk Factors

Risk factors are where most companies first encounter AI disclosure obligations, and they're also where the SEC staff has focused the majority of its comment letters. Based on the Orrick survey of 92 AI-related comments to 56 companies, approximately 61% requested that companies clarify how AI is or is intended to be used, along with attendant risks. (TheCorporateCounsel.net, January 2025)

Effective AI risk factors should be particularized to the company, not boilerplate. Gensler himself emphasized that "investors benefit from disclosures particularized to the company, not from boilerplate language." The staff has specifically asked companies to "provide a more balanced discussion of AI" that includes "potential limitations, obstacles, and uncertainties associated with AI adoption, use, and commercialization." (Cooley PubCo, January 2025)

Key AI risk factor categories to consider:

• Operational risks: Model accuracy, hallucination, bias, and failure modes specific to your use case
• Competitive risks: Whether competitors' AI adoption could erode your market position, or whether your AI claims create expectations you can't meet
• Regulatory risks: Evolving state, federal, and international AI regulations that could impose compliance costs or restrict deployment
• IP and data risks: Training data provenance, potential IP infringement claims, and data privacy obligations
• Cybersecurity risks: AI-specific attack surfaces, including model theft, data poisoning, and adversarial inputs
• Reputational risks: The risk that AI-washing claims could lead to enforcement actions, shareholder litigation, or reputational damage—yes, this is now a cognizable risk factor category

The SEC has also flagged materiality consistency—asking companies to assess whether AI discussions in board meetings, earnings calls, and investor presentations suggest materiality and, if so, to provide corollary disclosures in SEC filings. If your CEO is telling analysts that AI will "drive growth," your risk factors and business description need to reflect that materiality. (TheCorporateCounsel.net, January 2025)

MD&A: AI Impact on Operations

Management's Discussion and Analysis (Item 7) requires companies to discuss known trends and uncertainties that are reasonably likely to have a material effect on operations. If AI is materially affecting your cost structure, revenue drivers, or operational efficiency, MD&A should address it. The SEC's Investor Advisory Committee specifically recommended in December 2025 that issuers disclose "the impact of AI on human capital such as workforce reductions or upskilling, financial reporting, governance, and cybersecurity risks" on a materiality-informed basis. (Crowell & Moring, December 2025)

For consumer-facing AI, the IAC recommended disclosing "the investment into AI and its integration within products"—for example, a medical firm reporting on regulatory impacts from AI use, or a financial firm disclosing R&D spending on AI-driven platforms. While this recommendation has not been adopted as a formal rule, it signals where the disclosure landscape is heading and provides a practical framework for what investors and regulators expect. (Crowell & Moring, December 2025)

SEC Comment Letters: What the Staff Is Asking

The SEC's Division of Corporation Finance has been actively issuing comment letters on AI disclosures since at least 2021. According to an Orrick survey, the staff issued 92 separate AI-related comments to 56 companies across industries including technology, biopharmaceuticals, healthcare, real estate, retail, and financial services. The comments cluster around five themes: (TheCorporateCounsel.net, January 2025)

1. Materiality—Is AI material enough to warrant the disclosure you've made? The staff has asked companies to "revise your business section to more fully discuss the current state of AI and the potential obstacles to broad-based AI adoption."
2. Immateriality—Conversely, the staff has questioned why certain AI programs are included in disclosures "especially considering the early stage of such programs." If you disclose AI, be prepared to justify why it's material.
3. Reasonable basis—Do your AI claims have a reasonable basis? The staff has asked companies to clarify whether AI-related claims describe actual products or "areas of research or aspirational" initiatives.
4. Specificity and balance—Does your AI disclosure provide balanced information? The staff has asked for "a more balanced discussion of AI" including limitations and obstacles.
5. Definitions—What do you mean by "AI"? The staff has asked companies to define AI-related terminology and explain how their technology qualifies.

For IPO-ready startups, these comment letter trends are especially important. Companies preparing S-1 registrations should anticipate that the SEC will scrutinize AI claims in prospectuses with the same rigor. Building defensible AI disclosure language into your registration statement from the start is far less costly than responding to comment letters after filing.

The IAC's December 2025 Recommendation

On December 4, 2025, the SEC's Investor Advisory Committee voted to advance a recommendation that the agency issue guidance requiring issuers to disclose information about the impact of AI on their companies. The IAC cited a "lack of consistency" in contemporary AI disclosures, noting that only 40% of the S&P 500 provide AI-related disclosures and just 15% disclose board oversight of AI, while 60% of S&P 500 companies view AI as a material risk. (Crowell & Moring, December 2025)

The IAC recommended a three-part framework: (1) require issuers to define what they mean by "AI," (2) disclose board oversight mechanisms for AI deployment, and (3) if material, report on how AI is being deployed and its effects on internal operations and consumer-facing products. The committee suggested integrating this guidance into existing Regulation S-K disclosure items—Items 101, 103, 106, and 303—rather than creating a new subchapter. (Crowell & Moring, December 2025)

The current SEC leadership has responded tepidly. Chair Paul Atkins urged the Commission to "resist the temptation to adopt prescriptive disclosure requirements for every 'new thing' that affects a business," and Commissioner Hester Peirce questioned whether AI disclosures need to "force conformity." With a Republican-majority Commission, formal rulemaking is unlikely in the near term. But the IAC framework provides a practical blueprint for what current best practices look like—and the absence of formal rules does not mean the SEC will stop enforcing existing antifraud and disclosure provisions against AI-washing. (Crowell & Moring, December 2025)

Marketing Claims vs. Defensible Disclosure Language

The single most common AI-washing risk is the gap between marketing language and legally defensible disclosure. When your marketing team says "AI-powered" or "machine learning-driven," securities counsel needs to ask: What specific technology does that refer to? Is it deployed in production or still in development? Is it proprietary or licensed? Does it actually perform the function described, or does it require substantial human intervention?

The Delphia enforcement illustrates how marketing claims can persist long after the company knows they're false. Delphia admitted to SEC staff in July 2021 that it had not used client data or AI in its algorithms—yet it continued publishing press releases through 2023 claiming to "combine the data invested by its members with commercially available data, to make predictions across thousands of publicly traded companies." The SEC found these statements false and misleading because Delphia "simply did not possess the capabilities it claimed to have." (Mayer Brown, April 2024)

Practical guidance for bridging this gap:

• Implement a disclosure review protocol for AI claims: Every public statement about AI—press releases, website copy, investor presentations, earnings call scripts—should be reviewed against the company's actual AI capabilities before publication.
• Use precise, verifiable language: "AI-assisted" is different from "AI-powered." "In development" is different from "deployed." "Uses third-party AI technology" is different from "proprietary AI."
• Maintain consistency across channels: If your 10-K says AI is in early-stage development, your investor relations materials shouldn't claim it's a mature competitive advantage.
• Document the reasonable basis for every claim: If you say your product uses AI to automate a process, be able to substantiate that claim with technical documentation, and be prepared to disclose material limitations (like human oversight requirements).

The Caremark Intersection: Board Oversight of AI

SEC disclosure obligations and board oversight duties intersect in ways that create overlapping risk for GCs. Under Caremark and its progeny, directors have a fiduciary duty to implement and monitor reasonable information and reporting systems for mission-critical risks. As we've discussed in our guide to board oversight of AI and cybersecurity risk under Caremark and McDonald's, Delaware courts have made clear that boards must actively oversee mission-critical risks—not merely acknowledge them.

The IAC's December 2025 recommendation explicitly called for issuers to "disclose whether the Board of Directors or a board committee is responsible for overseeing aspects of AI deployment." This creates a dual obligation: the board must actually oversee AI risk (Caremark), and the company must disclose how it does so (SEC disclosure). If a company's 10-K describes AI as a material risk but the board has no documented oversight process, that gap is both a Caremark exposure and a potential SEC disclosure deficiency. (Crowell & Moring, December 2025)

For in-house counsel, this means your AI disclosure strategy and your board governance strategy need to be aligned. If you're disclosing AI as a material risk factor, your board should have a documented oversight mechanism—whether that's a dedicated AI committee, inclusion in an existing risk committee charter, or regular board-level reporting on AI deployment and risk management.

Actionable Next Steps

1. Conduct an AI Disclosure Audit

Inventory every public statement your company has made about AI—10-K, 10-Q, 8-K, earnings calls, investor presentations, website copy, press releases—and map each claim to the underlying technology. Flag any statement that (a) describes capabilities the company doesn't actually have, (b) uses undefined AI terminology, or (c) describes aspirational initiatives as current products.

2. Close the Marketing-Disclosure Gap

Implement a review process where securities counsel signs off on AI claims before they go public. Ensure that the language used in SEC filings is consistent with—and no more aggressive than—the language used in marketing materials. Where marketing uses expansive AI claims, either substantiate them in filings or tone them down.

3. Draft Particularized AI Risk Factors

Replace any boilerplate AI risk factors with company-specific disclosures that address your actual AI use cases, limitations, third-party dependencies, regulatory exposure, and competitive risks. Include both upside and downside—the SEC has specifically asked for "balanced" AI discussions.

4. Verify Board Oversight Mechanisms

Document how your board oversees AI risk. If there's no formal oversight process, work with the board to establish one—whether through a committee charter, regular reporting cycles, or a dedicated AI governance framework. Align the board's actual practices with what you disclose about board oversight.

5. Prepare for SEC Comment Letters

Review the five themes the SEC staff has focused on—materiality, immateriality, reasonable basis, specificity and balance, and definitions—and pressure-test your current disclosures against each. If you can't answer "how is your software properly characterized as AI rather than as an algorithm," the SEC staff will ask you to.

6. For IPO-Ready Startups: Build AI Disclosure Into Your S-1

If you're preparing to go public, integrate defensible AI disclosure language into your registration statement from the outset. The SEC will scrutinize AI claims in your prospectus with the same intensity it applies to existing public companies. Building a disclosure framework now—before the comment letter process begins—saves time, reduces legal risk, and signals maturity to regulators and investors alike.