AI governance in finance: what 10-K and proxy filers disclose on policies, committees, owners and frameworks

Public companies are governing AI in finance mostly through their boards, and their filings say little about the controls underneath: in a seeded sample of 150 DEF 14A proxy statements that name artificial intelligence, 48 assign oversight of AI to the board or a board committee, while 13 describe an AI policy, 8 a management committee or council and 5 an executive owner by title.¹ The 10-Ks say less, with 16 of 150 sampled annual reports disclosing any of those elements, and none of the 300 filings describes validating an AI model.¹

The counts come from reading each filing on sec.gov and coding it by published rules, then checking every match by hand. They measure what companies chose to write in two documents, not what they run. A company with a mature AI program may describe none of it in a 10-K; a company that wrote one line about an acceptable use policy counts the same as one that described a committee, a charter and a reporting line.

What governance means in the regulators' documents

Three documents written for the financial sector set out what AI governance looks like, and none of them is addressed to a public company's annual report.

FINRA's 2026 Annual Regulatory Oversight Report, published 2025-12-09, has a section on generative AI that is new for the year. It says FINRA's rules, "which are intended to be technologically neutral", continue to apply when firms use GenAI "just as they apply when firms use any other technology or tool."² Under Supervision & Governance it lists "Establishing a supervision, governance or model risk management framework that establishes clear policies and procedures to develop, implement, use and monitor GenAI, while maintaining comprehensive documentation throughout."² It also names "formal review and approval processes" staffed by "both business and technology experts", robust testing, and monitoring that may include "validation and human-in-the-loop review of model outputs, including performing regular checks for errors or bias."² Its list of additional resources ends with the NIST AI Risk Management Framework (AI RMF 1.0) of January 2023.²

The U.S. Treasury's report on AI in financial services, announced on 2024-12-19, summarized 103 comment letters on its request for information and recommended next steps.³ One of them is a governance step in plain terms: that "Financial firms prioritize their review of AI use cases for compliance with existing laws and regulations before deployment and that they periodically reevaluate compliance as needed."³ Another asks for collaboration "to promote consistent and robust standards for uses of AI in the financial services sector."³

The Federal Reserve has no rule on AI governance for issuers, but its governors have described one. Governor Lisa D. Cook said on 2025-07-17 that "A central tenet of good governance should be the mindset that humans are in the loop, because it ensures that people guide AI rather than allow AI to guide us."⁴ On 2026-05-27 she concluded that "alongside experimentation, strong governance and risk management must be our foundation."¹⁹

The plan for this article named a fourth document, IOSCO's AI Supervisory Toolkit of 2026-05-25. IOSCO's site refused the request when this article was researched on 2026-11-12, so the toolkit is not quoted here; its entry is in the site's IOSCO tracker, with FINRA's documents in the FINRA tracker and Treasury's in the Treasury tracker.

Method: the sample and the codebook

The frame is every filing that EDGAR full-text search returns for the phrase "artificial intelligence" in two windows, searched one calendar month at a time and paged to the end.¹ For 10-Ks the window is 2025-07-01 to 2026-06-30, the twelve months that hold fiscal 2025 annual reports; it returned 4,032 documents, and after keeping main documents only (no amendments) and one filing per filer, 3,842 filers. For proxy statements the window is 2025-01-01 to 2026-11-11, so it covers two proxy seasons; it returned 2,726 documents from 1,645 filers.¹

From each frame a seeded random draw took 150 filers (seed 20261112 for 10-Ks, 20261113 for proxies). Each main document was read on sec.gov and split into sentences; the sentences that name artificial intelligence, generative AI, GenAI, machine learning, AI or agentic were kept. Five of the 10-Ks and 25 of the proxies had no such sentence the reader could isolate in the main document, usually because the AI mention sat in a table, an exhibit or a PDF; they stay in the denominator.¹

Five governance elements were coded, each present when any AI sentence matches its rule:

• Policy. An AI policy, acceptable use policy, guidelines or principles of the filer's own.
• Board oversight. The board or a board committee oversees, reviews or is responsible for AI, tested on the 250 characters either side of each AI term, because proxy statements list committee duties without full stops.
• Committee. A management committee, council, working group or center of excellence for AI.
• Owner. An executive named by title who leads, chairs, heads or reports to the board on AI.
• Framework. A named AI framework or standard: the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 23894 or the OECD AI Principles.

The rules were written to find candidates. A reader then opened every match and removed the false ones: a Utah statute called the Artificial Intelligence Policy Act, a federal "task force" in an executive order, a director's award, sentences that begin "if we are unable to develop" a policy. The reader also added a handful of passages the patterns missed, such as a proxy that says its committee "oversees the Company’s artificial intelligence governance framework". Each decision is recorded with its reason in the site's research file, and the script applies them before counting.

How many filers disclose each element

The two forms tell different parts of the story. Proxy statements are where boards describe their own work, and 48 of the 150 sampled proxies, 32.0%, say the board or one of its committees oversees AI.¹ The 10-Ks rarely say it: 1 of 150. That one is Groupon's, which reported that its board established an Artificial Intelligence Committee "to provide focused Board-level oversight of the Company's artificial intelligence strategy and related risks and opportunities."¹⁰

Below board oversight the numbers fall fast. An AI policy of the filer's own appears in 13 proxies (8.7%) and 8 10-Ks (5.3%); a management committee or council in 8 proxies and 4 10-Ks; an executive owner by title in 5 proxies and 1 10-K.¹ Counted either way, 49 of the 150 proxies (32.7%) and 16 of the 150 10-Ks (10.7%) disclose at least one of the five elements.¹

The policy statements are mostly one sentence long. BitGo's 10-K says: "We have adopted an internal AI Acceptable Use Policy, which establishes guidelines for the responsible and secure use of AI technologies within BitGo."¹⁶ Smith & Wesson's proxy goes further in one respect, with a policy for directors: "We maintain an artificial intelligence use policy for the Board."²²

The committees are described with more detail. Upbound Group's 10-K says it formed a "Data and AI Governance Committee, which includes company executives, to address the risks of AI-based technology use on an ongoing basis", meeting quarterly.¹⁷ Two of the 12 bodies found in the sample are described as reviewing or approving use cases, the step Treasury recommended: LXP Industrial Trust's committee and Portland General Electric's management committee, which "reviews use cases and establishes guidelines on AI governance, use of data and privacy."⁸²¹

The owners are named by title only, and the titles vary. In the sample they are a General Counsel (LXP), a Chief Technology Officer (nVent), a Corporate Vice President for AI and data engineering (Motorola Solutions), a Chief Compliance Officer on a committee (Synchronoss), a Senior Vice President and Chief Information Officer who reports to the audit committee (SBA Communications), and in a 10-K a Chief Digital & AI Officer (eHealth).¹ Synchronoss described an AI Governance Committee made up of its Chief Compliance Officer, a governance, risk and compliance director and two vice presidents, for procurement and engineering, set up "to oversee and enforce the AI Governance policy."²⁰ No sampled filing names a Chief AI Officer.¹

The sector split is flatter than the form split. Wholesale and retail trade (4 of 14), finance, insurance and real estate (19 of 71), manufacturing (26 of 105) and services (13 of 55) all fall between 23.6% and 28.6%; transportation, communications and utilities reach 3 of 27 and agriculture, mining and construction 0 of 12.¹ The finance group is not ahead. Of its 71 filings, 20 come from banks, and 2 of those disclose an element: Capital One's 10-K, on policies, and First Financial Bancorp's proxy, on board oversight.¹ The sample is small at the division level, so a difference of a few filings moves a bar by several points.

Frameworks named, and how often

The framework count is not taken from the sample. Full-text search was run over both whole windows for each framework's phrases, so these are every filing that names one.¹

The NIST AI Risk Management Framework appears in 21 10-Ks and 22 proxy filings, which come from 17 filers because five companies named it in both proxy seasons.¹ ISO/IEC 42001, the management-system standard for AI, appears in 8 10-Ks and 9 proxies; the OECD AI Principles in 1 10-K and 4 proxies; ISO/IEC 23894 in none.¹ Against 3,842 10-K filers and 1,645 proxy filers that name artificial intelligence in those windows, frameworks are a rare disclosure.

What the filers say about a framework also varies. Horace Mann Educators, an insurer, wrote that "we have considered elements of the National Institute of Standards and Technology (NIST) AI Risk Management Framework and evolving regulatory expectations as reference points in shaping our approach."⁷ Paycom reported a certification: "In November 2025, we obtained a certification based on ISO/IEC 42001:2023 criteria".⁹ Tandy Leather Factory folded the AI framework into its cybersecurity program: "We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework)."¹⁸ Considering, certifying and designing against a framework are three different claims, and a count of names treats them alike.

Finance-specific controls named

Four finance-specific measures were coded on the same sentences, and three of them are close to empty.

• Model validation or model risk management of AI, in a sentence without "may", "could", "might", "if" or a law's requirement: 0 of 300.¹
• Human review of AI output, as a control the filer runs, on the same test: 1 of 300, and it describes a product pipeline rather than a finance process.¹
• AI used in accounting, the close or financial reporting: 1 of 300.¹
• AI oversight given to the audit committee: 24 of the 150 proxies, and none of the 10-Ks.¹

The hedge test matters because the words appear often in risk factors. Several 10-Ks name "human oversight" only to say that a law may require it or that its absence could cause harm. Capital One's 10-K mentions validation in the same way, in a risk factor saying its results depend on "our policies, programs, processes and practices governing how data, models and AI are acquired, validated, stored, protected, processed and analyzed".¹⁵ That is a statement that such policies exist and could fail, not a description of a validation step.

The one filing that names AI in financial reporting is Armour Residential REIT's 10-K: "We, our manager, or third-party service providers use, and may continue to use, artificial intelligence (“AI”) in certain business processes, including but not limited to data analysis, investment modeling, risk management, financial reporting, and cybersecurity."¹⁴ The filing does not say what the AI does in reporting or who reviews it.

The audit committee is the finance-specific finding. In 24 proxies AI oversight sits with the committee that also oversees financial reporting, internal control and the external auditor.¹ Two charters tie the two together in words. SI-BONE's audit committee is responsible for "reviewing our guidelines and policies with respect to financial and information security risk management and the use of artificial intelligence impacting financial reporting and internal controls."¹² Accendra Health's audit committee oversees "Artificial intelligence (“AI”) applications and AI’s impact on financial reporting".¹³ Motorola Solutions' proxy says its board "has delegated to the Audit Committee the responsibility to oversee risks related to AI as part of our enterprise risk management program", and that the board and the committee receive updates on AI from, among others, "our executive finance team."¹¹

For a CFO this places AI on the audit committee's agenda at a growing number of companies, with the controls behind it undisclosed. The site's explainer on AI and internal control over financial reporting collects what 10-K filers say about AI in their controls sections.

Excerpts by element

Two 10-K passages show what a disclosure looks like when it carries more than one element. Gallagher's sits in its risk factors:

The sentence that follows in the same 10-K says employees "could violate these policies", which is why the disclosure sits among the risk factors.⁵ Matthews International's passage sits in its cybersecurity item:

The 10-K adds that the council "serves as an extension of its cybersecurity program with a specific focus on artificial intelligence systems."⁶ The governance home for AI in both passages is risk and security, not the finance function.

The proxy that carries the most elements in the sample is LXP Industrial Trust's. It says that "In 2025, LXP adopted a formal Artificial Intelligence Policy governing the use of AI tools across the organization, which was updated in 2026," that the policy establishes an AI Governance Committee "chaired by the General Counsel, which is responsible for evaluating and approving AI use cases, managing associated risks, and ensuring compliance with LXP's security and data protection standards," and that the committee reports to the board's audit and risk committee "on a quarterly basis on the status of approved use cases, any incidents or policy violations, and the results of vendor security assessments."⁸ Policy, committee, owner by title and board oversight are all there; a named framework is not.

Where the regulators' expectations and filers' disclosures meet

Read side by side, the documents and the filings meet on policies and committees and part at the two places closest to finance work.

FINRA's first governance item, a framework with "clear policies and procedures", is the element most often disclosed after board oversight, and still by fewer than 1 in 10 sampled filings of either form.²¹ Its review-and-approval process matches the committees, and the two committees that approve or review use cases match Treasury's recommendation that firms review AI use cases before deployment.²³⁸²¹ FINRA lists the NIST AI RMF as a resource; 43 filings across both windows name it.²¹

The monitoring items are where the filings go quiet. FINRA's "validation and human-in-the-loop review of model outputs" and Governor Cook's "humans are in the loop" have no counterpart in the sample beyond one product pipeline.²⁴¹ And the element filers disclose most, board oversight, is one that neither the FINRA section nor Treasury's release addresses.²³

The sample and the codebook are in the site's repository; the figures are recomputed from the saved research files by scripts/cfonews-ai/articles/governance.mjs, which also prints each count quoted above.