SEC Intensifies Scrutiny on AI Risk Disclosures in Filings

The U.S. Securities and Exchange Commission (SEC) is ramping up oversight of how public companies disclose artificial intelligence (AI) risks and use in financial filings, warning firms not to exaggerate AI capabilities as year-end reporting approaches Reuters Bloomberg. This signals heightened regulatory attention on AI transparency and investor protection.

On June 5, SEC Chair Gary Gensler publicly cautioned public companies to ensure their financial disclosures accurately reflect both the risks and real-world capabilities of AI technologies, emphasizing that misleading or overstated claims could trigger enforcement actions Reuters. The SEC’s Division of Corporation Finance is actively reviewing 10-K and 10-Q filings for AI-related statements, focusing on whether companies are providing material, specific, and balanced information about how AI is used and what risks it introduces Bloomberg. This move directly affects all U.S.-listed companies, particularly those in highly regulated sectors like finance, healthcare, and technology.

The SEC’s intensified scrutiny comes as AI adoption accelerates across regulated industries, raising concerns about “AI washing”—the practice of overstating or misrepresenting AI capabilities to investors Reuters. For enterprises subject to SEC oversight, this development underscores the need to align AI-related disclosures with existing regulatory frameworks, including the SEC’s 2018 guidance on cybersecurity risk disclosures and the recently finalized rules on climate and ESG reporting SEC. The SEC’s focus dovetails with global regulatory trends, such as the EU AI Act’s transparency requirements and the NIST AI Risk Management Framework, both of which emphasize accurate risk communication and governance NIST.

CTOs, CISOs, and Compliance Officers should immediately review all AI-related statements in upcoming financial reports, ensuring that claims about AI capabilities are substantiated and that risk disclosures are specific, balanced, and tailored to actual enterprise use cases. In the next 30-90 days, expect increased SEC comment letters, potential enforcement actions for misleading disclosures, and a higher bar for internal controls around AI governance and reporting Bloomberg. Companies should also monitor for additional SEC guidance or interpretive bulletins clarifying disclosure expectations as AI adoption expands.

What This Means for Enterprise AI

Public companies must ensure that all AI-related disclosures in 10-K, 10-Q, and other SEC filings are accurate, specific, and free from exaggeration. Overstating AI capabilities or underreporting risks could result in SEC enforcement actions, reputational damage, and increased litigation risk Reuters. This is especially critical for regulated industries—such as financial services and healthcare—where AI-driven decisions can materially impact compliance with sector-specific laws like HIPAA, the SEC’s own regulations, and emerging global standards like the EU AI Act NIST.

Operationally, CTOs and CISOs should coordinate with legal and compliance teams to audit all public statements about AI, implement robust internal review processes, and document the basis for any claims made in filings. Compliance Officers should benchmark disclosures against the SEC’s 2018 cybersecurity guidance and the NIST AI RMF to ensure consistency and defensibility SEC. Enterprises should also prepare for possible SEC inquiries by maintaining detailed records of AI system capabilities, limitations, and risk assessments.