AI and internal control over financial reporting, in filers' words

Few companies say outright whether AI is part of their internal control over financial reporting, but those that do fall into four groups: some say it is not, some say it may become so, some say AI projects could affect their controls, and some say who oversees AI risk. This page collects those statements from the filings stream in the filers' own words. It does not assess any company's controls and is not accounting or legal advice.

"Not yet" and "not dependent"

Two filings state a boundary. Linkhome Holdings' 10-K filed 2026-03-26, in its risk factors, says that notwithstanding its use of AI in its application and in certain agent activities, "we've yet to utilize AI within our financial reporting or internal control over financial reporting functions."¹

OLB Group's 10-Q filed 2026-08-14 describes AI agents in development for invoice processing, reconciliation and routine close activities, and then says: "Human review and oversight remain in place for underwriting, risk, compliance and financial reporting activities, and our internal control over financial reporting is not dependent on these tools."²

Both are statements of the company's present position. Neither filing says the position will last, and the site records them as made on the dates shown.

"May increasingly use"

LendingTree's 10-K filed 2026-03-09 looks ahead: "In the future, we may increasingly use automated tools, including AI and machine learning technologies, in connection with data analysis, financial reporting processes, and internal controls."³ The sentence sits under Item 1A, Risk Factors. It names internal controls as a possible place for AI, which is different from saying AI is already part of them.

AI projects as a risk to controls

Other companies connect AI initiatives to their controls through the projects themselves. Cardinal Health's 10-K filed 2026-08-11 says that if initiatives, including "initiatives related to artificial intelligence and machine learning, are not successfully or efficiently implemented or maintained," it could experience negative impacts on its business, financial results "and our internal control over financial reporting."⁴

UMB Financial's 10-K filed 2026-02-26 names AI as a category of control in a list that also includes financial reporting and disclosure: the company "must successfully develop and maintain information, financial reporting, disclosure, privacy, data protection, data security, artificial intelligence, and other controls adapted to the Company's reliance on outside platforms and providers."⁵

Upstart's 10-Q filed 2025-11-04 puts its AI models in the same sentence as its controls, saying fluctuations in its business "will strain our ability to develop and improve" areas including "AI models and technology, disclosure controls and procedures, internal control over financial reporting."⁶

World Acceptance's 10-K filed 2026-06-04 approaches controls from the other side: it says malicious actors "may exploit AI to create convincing false identities or manipulate internal controls and/or verification processes."⁹

Who oversees it

Two filings place AI risk with the board or its audit committee. ABM Industries' 10-K filed 2025-12-19, under Item 1C, Cybersecurity, says its board oversees its cybersecurity and AI programs, including "the Company's disclosure controls and procedures with respect to material cybersecurity or AI-related risks and incidents."⁷ Olaplex Holdings' 10-K/A filed 2026-04-30 lists among its Audit Committee's responsibilities assisting the Board in overseeing the company's internal control over financial reporting and its risk management practices, including risks related to "the development, deployment or use of artificial intelligence."⁸

A point on wording

On 2024-02-13 SEC Chair Gary Gensler said that investors "benefit from disclosures particularized to the company, not from boilerplate language" when companies disclose material AI risks.¹⁰ The passages above differ in exactly that respect. Linkhome and OLB say what the company does and does not do; LendingTree, Cardinal Health and UMB say what could happen or what must be maintained. Both kinds are useful to a reader who keeps them apart.

Where to find more

Each statement above is footnoted to the filing on sec.gov and has an entry in the filings stream with its section and dates. For how the same companies describe AI in the close and in payables, see AI in the close, payables and planning; for how to weigh the wording of a risk factor, see how to read an AI risk factor.