S&P 500 / THE 2026 DISCLOSURE STUDY
AI is now in
the risk disclosures.
Nearly every extracted S&P 500 risk section mentions AI. Far fewer business descriptions do. We read the filings to measure the gap.
AI is in almost every
extracted risk section.
Latest 10-K filed by 22 October 2026. Automated extraction.
01 / THE BRIEFING
The finding.
Not the inference.
This is a study of what companies disclose. It does not measure AI adoption, exposure or incidents.
Read the methodologyBefore you cite: the manual review of 30 sentences is not yet complete. Figures report automated extraction. Verification & limits
95.2%
AI appears in 458 of 481 extracted latest risk sections.
458 of 481 registrants with extractable Item 1A, newest 10-K filed by the 22 Oct cutoff
60.6%
All-filer AI mentions rose from 5.9% in 2019 to 60.6% in 2026.
3,724 of 6,142 documents dated 1 Jan to the 22 Oct cutoff; 368 of 6,285 in 2019
25.6%
Generative AI language appears in one in four 2026 filings.
1,572 of 6,142 annual reports in 2026; 55 of 6,794 in 2023
57.1%
Business sections mention AI less often than risk sections.
267 of 468 filers for Business and 446 of 468 for risk factors, same 10-Ks
83.0%
AI and security or fraud appear together in risk sentences.
380 of 458 registrants with AI in Item 1A
02 / INSIDE THE FILINGS
Three views of
the disclosure gap.
Each view answers a different question.
Keep its population and denominator attached.
What the headline number means
We read the risk factors in the latest 10-K for 481 large US filers. Our search found artificial intelligence in 458 of them. Two years earlier, the same test hit 315 of 471 filings.
Most companies that were silent two years ago have since written AI into their risk factors. Of the 156 that had no AI language then, 132 added some.
This counts mentions, not exposure. A single sentence counts as much as a full page. Think of the number as a record of what companies chose to tell investors in writing.
From two-thirds to almost all.
S&P 500 filers mentioning AI in their risk factors
28.3 percentage points separate the two readings. Extraction bases differ; this is not a fixed-panel change estimate. Latest filing cutoff: 22 October 2026.
The extraction bases differ: 315 of 471 older risk sections and 458 of 481 latest risk sections. Both use the 23 October 2026 constituent list, not the historical index membership.Source: Paloren analysis of newest and older annual reports for index constituents (Wikipedia snapshot, 23 Oct 2026).
View exact values
| Category | Value (%) |
|---|---|
| About 2 years earlier | 66.9% |
| Latest 10-K | 95.2% |
The wider filing population
We zoomed out to every 10-K, not just the index. Mentions climbed from 5.9% of annual reports in 2019 to 60.6% this year. Generative AI wording barely existed in 2023 and now turns up in a quarter of 10-Ks.
Strip out asset-backed trusts and blank-check shells and the picture gets sharper, from 6.6% to 72.6%. These counts come from EDGAR's search engine, which matches phrases. It doesn't read what the sentence says.
AI language has moved into the mainstream.
Share of all 10-K filings mentioning artificial intelligence
The largest annual step is in 2024: 16.5% to 34.8%, a rise of 18.3 percentage points. Endpoint counts: 368 of 6,285 filings in 2019; 3,724 of 6,142 in 2026.
The chart includes asset-backed trusts and blank-check firms. Excluding them, the share runs from 6.6% in 2019 to 72.6% in 2026. These are phrase matches from EDGAR search, not a manual review of every sentence.Source: EDGAR full-text search counts and EDGAR full index, all 10-K filings dated 1 Jan to 22 Oct of each year.
View exact values
| Category | Value (%) |
|---|---|
| 2019 | 5.9% |
| 2020 | 7.7% |
| 2021 | 10.4% |
| 2022 | 14.2% |
| 2023 | 16.5% |
| 2024 | 34.8% |
| 2025 | 49% |
| 2026 | 60.6% |
Risk is written more often than the business
Across 468 registrants where we could pull both sections, about 57% mention AI in the business description. Nearly all of the same firms, 95.3%, mention it in the risks.
If you read only the business section, you'll miss most of the story. Anyone using these documents to judge strategy should read both halves.
The risk section tells a different story.
AI mentions in two sections of the same 468 annual reports
A 38.2-point gap within a matched sample. This is a comparison of disclosure, not a measure of AI use. Latest filing cutoff: 22 October 2026.
It's a rough cut. We find each section by its line-start heading, which will miss some sections, and the comparison covers 468 companies in our sample.Source: Paloren analysis of newest annual reports, index companies with both sections extracted.
View exact values
| Category | Value (%) |
|---|---|
| Item 1 Business | 57.1% |
| Item 1A Risk factors | 95.3% |
Ninety-five percent of the S&P 500 now mention AI in their risk factors, but only about half mention it when they describe the business. Companies have written down what AI could do to them faster than what it does for them.
Aaron AgiusCo-founder, Paloren
Risk language often sits next to security and fraud
We counted that roughly four in five filers that mention AI in their risks (380 of 458) put it in the same sentence as a cybersecurity or fraud term at least once.
That pairing shows the two topics sit together on the page. It tells you nothing about how seriously the company takes the threat or whether anything has happened.
What boards should ask for
A risk paragraph costs an afternoon. A working inventory of AI systems, a data boundary and a named owner take much longer.
The filings don't show which companies have done that groundwork. Board members and reporters can ask for it directly.
03 / ACROSS THE INDEX
Not just
a tech story.
The latest risk-section share is at least 75% in every sector. The bars show older and latest readings, not a measure of risk severity.
Sectors follow the 23 October 2026 index snapshot. Extraction bases differ between periods.
AI risk language reaches across the index.
Share mentioning AI in risk factors, by sector
Every extracted latest report in financials, consumer staples and information technology mentions AI in its risk factors.
* Energy has only 19 extracted latest reports. Older and latest extraction bases differ. Both use the 23 October 2026 constituent snapshot, not historical index membership.Source: Paloren analysis of SEC EDGAR annual reports; sectors from the Wikipedia index snapshot, 23 Oct 2026.
View all sector counts and denominators
| Sector | Latest 10-K: AI in risk factors | Older 10-K: AI in risk factors | Companies extracted (latest) |
|---|---|---|---|
| Communication Services | 21 of 22 (95.5%) | 19 of 20 (95.0%) | 22 |
| Consumer Discretionary | 44 of 45 (97.8%) | 31 of 45 (68.9%) | 45 |
| Consumer Staples | 32 of 32 (100.0%) | 23 of 32 (71.9%) | 32 |
| Energy (small sample) | 15 of 19 (78.9%) | 7 of 19 (36.8%) | 19 |
| Financials | 69 of 69 (100.0%) | 55 of 68 (80.9%) | 69 |
| Health Care | 54 of 58 (93.1%) | 37 of 57 (64.9%) | 58 |
| Industrials | 76 of 79 (96.2%) | 42 of 77 (54.5%) | 79 |
| Information Technology | 74 of 74 (100.0%) | 64 of 72 (88.9%) | 74 |
| Materials | 18 of 24 (75.0%) | 9 of 23 (39.1%) | 24 |
| Real Estate | 28 of 29 (96.6%) | 15 of 29 (51.7%) | 29 |
| Utilities | 27 of 30 (90.0%) | 13 of 29 (44.8%) | 30 |
04 / THE AUDIT TRAIL
The method.
And its limits.
Two analyses, kept separate. Public sources. No estimates for missing filings.
Manual sentence review pending.
What we analysed
We ran two checks, and we kept them separate. Analysis A counts 10-K annual reports filed from 1 January to 22 October in each year from 2019 to 2026, using EDGAR full-text search for the phrases. Analysis B reads the latest and an older 10-K for each S&P 500 constituent, then extracts Item 1 (Business) and Item 1A (Risk factors) from the filing text.
The latest filing is the newest 10-K dated on or before the 22 October cutoff. The older one is the filing closest to two years earlier, and it only counts if it falls within six months of that target. A company missing either filing drops out of that comparison. We don't estimate its numbers.
The company list is the index snapshot taken on 23 October 2026. Firms that left before then aren't in the sample.
Primary records & constituent list
- 01EDGAR full-text search
- 02EDGAR full index (form.idx)
- 03EDGAR submissions (SIC codes and filing lists)
- 04Wikipedia, list of S&P 500 companies (snapshot 23 Oct 2026)
Definitions and exclusions
Each share is a count divided by the number of companies or filings in the stated sample. Companies or filings that could not be read are excluded, never estimated.
What this cannot tell you
- Analysis A counts EDGAR search hits for each phrase. It doesn't re-check every hit against the document text, so false positives are possible.
- Mention is not exposure. We don't rate how seriously a company takes an AI risk, and we don't know whether it has suffered an incident.
- Text extraction relies on line-start headings. Where a section couldn't be extracted, that company drops out of the comparison. The failure list is in the downloads.
- The list is a snapshot, so registrants that left the index before 23 October 2026 aren't included. Energy has only 19 firms extracted in the latest annual reports, which makes its share a small sample.
How we verified
An independent script recomputed every number on this page from the cached EDGAR files. A separate reviewer checked the results, and all 68 checks passed.
The manual review of 30 extracted sentences isn't finished. The reviewer verdict column is still blank, so this study reports automated extraction only.
05 / OPEN DATA
Every number.
Yours to inspect.
Download the source tables. Each chart also has SVG and PNG exports, including its source and sample notes.
06 / FOR THE NEWSROOM
A source,
not a sales pitch.
Use the findings with credit to Paloren Research. Retain the sample and methodology notes when reporting a figure.
Request commentA risk factor tells investors someone is watching the risk. The question for boards is whether there is an inventory, a data boundary and a named owner behind that paragraph, or just the paragraph.
Aaron AgiusCo-founder, Paloren
Media enquiries
aaron@research.paloren.aiAaron Agius, co-founder of Paloren, is happy to talk through the numbers. Write to aaron@research.paloren.ai to book a slot.
How to cite this study
Aaron Agius (2026). S&P 500 AI risk disclosures, 2026. Paloren Research. Analysis of SEC EDGAR 10-K filings dated 1 January to the 22 October cutoff. https://paloren.ai/research/sp500-ai-risk-disclosures-2026
Paloren Research is a small team that measures how firms adopt and describe AI, using public records. We publish the data and the limits with every number.
BEFORE YOU REPORT
Worth
distinguishing.
How many filers went into the risk factor comparison?
458 of 481 companies with extractable risk factors in their latest 10-K mention AI. That is 95.2%.
Does mentioning AI in risk factors mean a company is at risk from AI?
Not by itself. We count mentions and don't rate severity. Around 83.0% (380 of 458) of the registrants that mention AI also pair it with cybersecurity or fraud in one risk sentence. That shows the topics sit together, not how big the exposure is.
How were the 10-Ks chosen?
We took the newest 10-K dated on or before the 22 October cutoff. The older one sits closest to two years earlier, within six months of that target. Among those older documents, 315 of 471 mention AI.
Why does the all-filer figure differ from the index figure?
We would not line those counts up. The all-filer count covers 6,142 10-K filings dated 1 January to the 22 October cutoff, matched by EDGAR search. The S&P 500 figure reads the risk section of 481 large firms. Those shares are 60.6% and 95.2%.
Can I cite these figures?
Yes, please do. Use the citation below, credit Paloren analysis of SEC filings, Oct 2026, and link to the study. The method section lists four limitations, and any quote should carry them.