Most matched AI incidents lacked specific disclosure in SEC filings

Only four of 307 artificial intelligence incidents that could be matched to U.S.-listed companies were specifically identifiable in subsequent securities filings, according to a pre-registered study of externally documented AI events. A broader measure that also counted filings describing a directly related legal or regulatory consequence identified seven incidents, representing 2.3% of the sample. The remaining 300 cases formed what the researchers called an “AI incident disclosure shadow,” accounting for 97.7% of the selected incidents. This percentage applies to incidents recorded in the AI Incident Database, or AIID, and successfully matched to U.S.-listed domestic filers; it is not an estimate for all corporate AI incidents.

The investigation began with a snapshot of AIID taken on 27 July 2026. Of 1,389 records dated from 2019 through 2026, the researchers retained 307 incidents involving 21 U.S.-listed domestic issuers. Each AIID entry was reviewed to identify organizations described as developing, deploying, operating or otherwise directly associated with the implicated system. Organizations were then mapped to listed registrants, with dated ownership records used to connect subsidiaries, products and platforms to their corporate parents. The analytical sample was concentrated among large technology firms: Alphabet contributed 86 incidents, Meta 81, Tesla 36 and Microsoft 35.

For every matched event, investigators searched the issuer’s Forms 8-K, 10-K and 10-Q filed from the incident date through the following 12 months. The search combined terms tied to the particular event, system or product with terms describing the relevant AI application and type of harm. Candidate passages were read in context rather than classified merely by keyword occurrence. Reviewers also examined the Risk Factors and Legal Proceedings sections of the first annual report after each incident, even where searches did not initially reveal an event-specific match.

Each incident was assigned to one of four disclosure tiers. Tier 1 represented an incident-specific disclosure that identified the event with enough factual detail to link it to the AIID record, even if the filing did not explicitly use the term “artificial intelligence.” Tier 2 covered lawsuits, investigations, regulatory proceedings, settlements or other formal legal consequences linked to the incident but not described as the underlying AI event. Tier 3 consisted of generic risk language naming the same technology or application family or the same harm family without identifying the event. Tier 4 meant that no related language was located in the specified forms.

Generic risk language was the dominant result. It accompanied 278 of the 307 incidents, or 90.6% of the sample, while 22 incidents, or 7.2%, had no related filing language found under the protocol. A post-hoc analysis divided the generic-language group according to how closely it matched the realized event. Eighty-four incidents had language covering both the incident’s technology or application family and its harm family. The other 194 covered only one of those dimensions. Under this stricter interpretation, 216 incidents—70.4% of the full sample, with an exact 95% confidence interval of 64.9% to 75.4%—had at most weakly related language. The presence of AI-related wording therefore did not necessarily let an investor reconstruct the external incident record.

The seven incidents with substantive disclosure were concentrated among events connected to financial-statement effects or formal legal and regulatory channels. Zillow reported approximately $304 million in charges to wind down its algorithm-driven business of buying and selling homes, while General Motors reported a $478 million Cruise restructuring adjustment associated with the suspension and restructuring of its autonomous-vehicle operations. Other positive cases involved litigation, regulatory proceedings, investigations or related contingencies. These observations show an association between disclosure and established reporting channels, but they do not demonstrate that accounting recognition, litigation or regulatory action caused an issuer to disclose the underlying incident.

Several incident categories produced no substantive disclosures. These included 70 misinformation or content-related incidents and 57 generative-AI error incidents. An exploratory severity analysis also found no detectable increase in disclosure as incidents became more severe: substantive disclosure occurred in two of 42 severe cases, one of 50 moderate cases and four of 215 limited cases. A Monte Carlo exact permutation test yielded p = 0.61, but the analysis had only 23.3% power to detect a threefold severe-versus-limited difference and would have required a severe-group rate near 13% for 80% power against the observed 1.9% limited-group rate. The result therefore means that no gradient was detectable, not that severity and disclosure were shown to be unrelated.

The principal estimate was stable across the study’s robustness checks. The shadow rate ranged from 92.5% to 99.0% across specifications, including six-, 12-, 18- and 24-month filing windows, an issuer-clustered bootstrap, removal of the five largest incident contributors, corrected entity mappings, alternative issuer tie-breaks and exclusion of platform-venue or merely mentioned issuers. Removing the five largest contributors still left a 92.5% shadow estimate. Restricting the analysis to incidents with complete follow-up produced 97.2%, while the pre-registered issuer-clustered bootstrap gave 97.5%, with a 95% interval of 93.9% to 99.6%. The result was also unchanged when the three legal-consequence cases were adjudicated differently.

Independent checks supported the retrieval and coding procedures while revealing their limits. A blind second coder re-derived issuer identities for a deliberately difficult sample of 80 incidents, agreeing in 82.5% of cases; all disagreements involved multi-candidate incidents, and none concerned a substantive disclosure. A second disclosure-coding pass produced 85.3% raw agreement, Cohen’s kappa of 0.73 and Gwet’s AC1 of 0.82. The legal-consequence-only tier was the notable weakness because the second coder assigned all three initial cases differently, so the combined seven-case substantive estimate was treated as an upper bound. In a separate search-independent audit, researchers read every relevant filing for 40 randomly selected non-substantive incidents and found no missed Tier 1 or Tier 2 disclosure. With no misses in 40 cases, however, the exact one-sided 95% upper confidence bound on the underlying miss rate remained approximately 7.2%.

The findings describe a limited form of filing visibility rather than a complete measure of what investors knew. The study did not search earnings calls, investor presentations, non-filed press releases, regulator announcements, corporate websites, conference communications or litigation dockets outside SEC filings, so an event communicated through one of those channels but not repeated in the studied forms was counted as filing-invisible. The denominator was also selected: AIID is media-derived and may omit internal failures or events that attracted little attention, while 1,082 of the 1,389 dated records were excluded because they involved private companies, unresolved organizations, foreign-listed issuers, delisted issuers or actors that could not be conservatively linked to a domestic filer. The researchers also make no legal determination about materiality, disclosure duties or compliance, and the absence of event-specific language cannot establish that information was withheld. Their baseline instead shows a sharp informational gap between broad acknowledgment of AI risks and identifiable reporting of realized incidents, a gap that future AI-specific reporting regimes can be measured against.

Subject of Research: Incidence-level analysis of AI incident disclosure in U.S. securities filings

Article Title: The AI incident disclosure shadow: tracking AI incidents into U.S. securities filings

Article References: Chincholikar, S., & Chawla, R. (2026). The AI incident disclosure shadow: tracking AI incidents into U.S. securities filings. Frontiers in Artificial Intelligence, 9, Article 1969275. https://doi.org/10.3389/frai.2026.1969275

Image Credits: AI Generated

DOI: 10.3389/frai.2026.1969275

Keywords: artificial intelligence, AI incidents, SEC filings, securities disclosure, corporate transparency, AI governance, risk factors, algorithmic accountability, investor information, incident reporting, incident, disclosure