Securities Law for AI Companies: What the SEC Actually Asks About Your Technology Claims

Why the SEC Is Paying Attention to AI Claims

The SEC has made clear through enforcement actions, staff speeches, and comment letter patterns that it views AI capability claims in securities filings with heightened scrutiny. When I served as a Staff Attorney in the SEC Division of Enforcement, technology companies that overstated their capabilities were among the most common enforcement targets. The AI industry is following the same pattern, with an important difference: the gap between marketing claims and actual capabilities is often wider in AI than in any previous technology sector.

The core issue is that AI companies routinely use promotional language in securities filings that would be appropriate for marketing materials but creates enforcement exposure in the securities disclosure context. When a company states in its Form 10-K that its AI system will transform an industry or deliver unprecedented accuracy, the SEC staff evaluates that claim under the antifraud provisions of the securities laws, not under advertising standards. The legal standard is whether the statement is materially accurate and whether a reasonable investor would be misled.

The SEC's attention to AI disclosure is not speculative. The Commission has brought enforcement actions against companies that claimed to use AI-driven analytics when they were actually using manual processes, against companies that fabricated AI performance metrics in offering materials, and against companies that described development-stage technology as commercially validated in securities filings. These actions establish a clear precedent that AI misrepresentation is treated with the same severity as financial statement fraud.

MD&A Disclosure for AI Technology

The Management Discussion and Analysis section of periodic filings is where AI companies create the most disclosure risk. MD&A requires a discussion of the company's results of operations, financial condition, and known trends and uncertainties that are reasonably likely to affect future results. For AI companies, this means the MD&A must honestly address the current state of the technology, its actual commercial performance, and the uncertainties that could affect future technology development and revenue generation.

The most common MD&A failure for AI companies is the use of promotional technology descriptions that do not align with the company's actual operational reality. When the MD&A describes AI capabilities in the same aspirational language used in investor presentations, the SEC staff will compare those claims against the financial results reported in the same filing. If the AI system is described as commercially transformative but the revenue from AI products is negligible, the disconnect creates a comment letter and potential enforcement exposure.

AI-Specific Risk Factors

Risk factor disclosure for AI companies must go beyond generic technology risk language. The SEC staff expects AI companies to disclose specific risks including algorithmic bias and the potential for discriminatory outputs, model accuracy limitations and the consequences of inaccurate AI decisions, dependency on training data that may be of uncertain provenance or legality, regulatory actions in multiple jurisdictions that could restrict AI deployment, competitive risk from rapidly evolving technology and open-source alternatives, and the risk that current AI capabilities may not translate to commercial viability.

Each risk factor should be connected to its specific impact on the company's business and financial condition. A risk factor stating that AI regulation could adversely affect operations is insufficient. The disclosure should identify which specific regulations or regulatory proposals affect the company, how they affect operations, what compliance costs are anticipated, and what the consequences of non-compliance would be. The Division of Enforcement looks for risk factors that are specific enough to demonstrate that management has actually evaluated the risk, not generic enough to be copied from another company's filing.

Technology Claims vs Securities Disclosure

The fundamental tension for AI companies is that the language that attracts investors and customers is not the language that satisfies securities disclosure requirements. Marketing describes potential. Securities disclosure describes reality. When a company's investor presentation states that its AI platform processes millions of data points with 99.7% accuracy, and that same claim appears in the S-1 or 10-K without qualification, it becomes a representation that the SEC can test against actual performance data.

Based on my experience reviewing these cases, the companies that create the most enforcement exposure are those that use identical language in their securities filings and marketing materials. This creates a direct comparison document that enforcement attorneys use to evaluate whether the company applied the appropriate legal standard to its disclosure. Companies should maintain separate disclosure processes for marketing and securities filings, with securities counsel reviewing all technology claims before they appear in SEC filings.

Data Governance and Privacy Disclosure

AI companies depend on data, and the disclosure obligations surrounding data governance are expanding rapidly. SEC filings must address the sources and legality of training data, compliance with privacy regulations across all jurisdictions where the company operates or has customers, data security measures and breach notification obligations, the consequences of losing access to key data sources, and any pending or threatened regulatory actions related to data practices.

The EU General Data Protection Regulation, the California Consumer Privacy Act, and emerging state and federal privacy laws create disclosure obligations that many AI companies are not adequately addressing. When a company's AI system depends on data that may have been collected in ways that violate privacy laws, the disclosure must address both the legal risk and the business risk of being required to delete or stop using that data. Issuers often misunderstand this obligation because they view data governance as an operational issue rather than a securities disclosure issue.

Intellectual Property Disclosure

AI intellectual property disclosure requires more specificity than most AI companies provide. The SEC staff evaluates IP disclosure to determine whether the company's claims of proprietary technology are supported by actual intellectual property protections. This means disclosing the number and scope of patents, the status of patent applications, the nature of trade secret protections, the company's use of open-source components and the license obligations that attach, and the competitive defensibility of the technology stack as a whole.

A common disclosure failure is claiming proprietary AI technology while relying heavily on open-source models, frameworks, or datasets. The SEC staff can and does investigate these claims, and the discovery that a company's claimed proprietary technology is built primarily on open-source components creates enforcement exposure for misleading disclosure and undermines the company's valuation narrative.

The Emerging Regulatory Landscape

The regulatory environment for AI is evolving rapidly across multiple jurisdictions. The EU AI Act establishes a comprehensive regulatory framework that classifies AI systems by risk level and imposes corresponding obligations. In the United States, executive orders, agency guidance, and proposed legislation are creating a patchwork of AI regulation that companies must monitor and disclose. State-level AI regulations, particularly in areas like employment discrimination, healthcare, and financial services, add additional complexity.

For SEC disclosure purposes, AI companies must identify the specific regulations that affect their operations, assess the compliance costs and timeline, disclose the risk of enforcement actions by multiple regulators, and update this disclosure with each periodic filing as the regulatory landscape changes. The pace of regulatory development means that risk factor and MD&A disclosure that was adequate six months ago may be materially incomplete today.

Enforcement Trends in AI Disclosure

The SEC's enforcement approach to AI disclosure is following a predictable pattern that mirrors its approach to previous technology waves. Initial enforcement actions target the most egregious cases, companies that fabricated AI capabilities or made demonstrably false claims. As the enforcement program matures, actions extend to subtler disclosure failures including inadequate risk factors, inconsistent technology descriptions, and failure to update disclosure as technology capabilities change.

For AI companies filing with the SEC today, the practical implication is that disclosure standards will tighten over the next several years. Companies that adopt conservative, specific, and factual AI disclosure now will be positioned to meet evolving standards without the costly disclosure revisions and potential enforcement exposure that accompany late adoption of adequate disclosure practices. Securities counsel with experience in both SEC enforcement and AI industry disclosure is essential for navigating this evolving landscape.