SEC Mandates AI Risk Disclosures, Public Companies Face New Compliance Burden

The SEC has adopted new rules requiring all public companies to provide clear, accurate disclosures about their use of AI and associated risks, effective immediately, to prevent misleading claims and enhance investor transparency SEC Financial Times Reuters.

On June 27, 2024, the U.S. Securities and Exchange Commission (SEC) finalized regulations mandating that all publicly traded companies disclose detailed information about their use of artificial intelligence, including specific risks, governance structures, and the impact of AI on business operations. The new rules, effective for fiscal years ending after December 15, 2024, are designed to prevent misleading or exaggerated claims about AI capabilities and to ensure investors receive accurate, actionable information SEC. The requirements apply to all SEC-registered firms, with particular scrutiny on sectors where AI is material to operations or investor decision-making.

The SEC’s move comes amid mounting concerns about the lack of transparency and potential for “AI washing”—the practice of overstating AI capabilities in public disclosures and earnings calls Financial Times. The rules align with broader regulatory trends, including the EU AI Act’s transparency mandates and the NIST AI Risk Management Framework’s emphasis on governance and risk communication NIST. For regulated industries such as finance and healthcare, the SEC’s action signals an expectation of robust, auditable AI risk management and disclosure processes, with potential overlap for firms subject to HIPAA, FDA, or other sector-specific requirements.

CTOs, CISOs, and Compliance Officers at public companies should immediately review their AI governance and documentation practices, ensuring that all material AI systems are inventoried, risk-assessed, and accompanied by clear, non-misleading disclosures. The SEC has indicated it will scrutinize both annual reports and public statements for compliance, and enforcement actions are likely if disclosures are found to be incomplete or deceptive Reuters. Firms should anticipate investor and auditor questions regarding AI risk controls, model governance, and the operational impact of AI deployments over the next 30-90 days.

What This Means for Enterprise AI

Public companies must now treat AI risk disclosures with the same rigor as financial or cybersecurity reporting, integrating AI governance into existing SEC compliance workflows. This includes documenting how AI systems are used in material business processes, detailing risk mitigation strategies, and providing plain-language explanations of AI limitations and potential harms SEC. The new rules create direct regulatory exposure for misleading or incomplete statements about AI, raising the stakes for compliance teams and increasing the need for cross-functional collaboration between technical and legal departments.

For firms in regulated sectors—such as financial services (subject to SEC and FINRA), healthcare (HIPAA, FDA), and critical infrastructure—the SEC’s requirements may overlap with or exceed existing sectoral AI risk mandates. Companies should map their AI inventory against both SEC and industry-specific disclosure requirements, ensuring consistency and completeness across all regulatory filings NIST. Failure to comply could result in enforcement actions, reputational damage, and increased scrutiny from investors and regulators.

Immediate action items include: updating risk registers to include AI-specific threats, reviewing public statements and marketing materials for potential “AI washing,” and training executives on the new disclosure obligations. CTOs and CISOs should work with compliance to establish clear lines of accountability for AI risk reporting, leveraging frameworks such as the NIST AI RMF to standardize risk assessments and disclosures Financial Times.