AI in the controls section: what filers put under Item 4 and Item 9A

In the filings the desk searched, AI rarely appears in the controls section of a 10-K or 10-Q, and the two that name it there describe a tool added while remediating control weaknesses. The searches, run over 10-K and 10-Q filings dated 2025-10-29 to 2026-11-01, found those two filings naming AI under Item 4 or Item 9A, Controls and Procedures; this page reads them closely and sets them beside the risk-factor and business passages where other companies draw a line around AI and their financial reporting. It does not assess any company's controls and is not accounting or legal advice.

Two filings that put AI under Controls and Procedures

TOMI Environmental Solutions' 10-Q filed 2026-08-14 describes control deficiencies that management "has determined" constitute material weaknesses, and then lists its remediation progress.¹ One of the listed actions reads: "Integrated AI-assisted technical research tools to support complex U.S. GAAP research and financial statement disclosures."¹ The same list includes updated close procedures, monthly physical inventory counts and a 13-week rolling cash flow forecast, so the AI item is one action among several. The filing says the remediation actions "are fully disclosed in our previously filed Form 10-K."¹

Brownie's Marine Group's amended 10-Q filed 2026-08-24 is more specific about what the tool does. The company says it believes "weaknesses in our financial reporting review and verification processes contributed to the errors requiring the restatement" of financial statements in its 10-Q for the quarter ended June 30, 2026.² Among the measures it lists is "technology-assisted financial review procedures, including AI-enabled analytical testing, as a supplemental control designed to identify period inconsistencies, mathematical discrepancies, unusual variances, internal inconsistencies and other potential reporting anomalies for further human review."² The next item requires that exceptions found this way "be investigated and resolved prior to authorization of applicable SEC filings."²

Three details in that wording matter to a reader. The AI testing is called "supplemental", so the filing does not present it as the primary control. Its output goes "for further human review", so a person decides what an anomaly means.² And the procedure sits before filing authorization, which places it in the review step rather than in the preparation of the numbers.

Boundaries drawn elsewhere in the filing

Other companies make statements about AI and financial reporting outside the controls section, usually in risk factors or the business description. Oil-Dri's 10-K filed 2026-10-08 says "we do not currently utilize artificial intelligence ("AI") technologies within our financial reporting or internal control over financial reporting functions," while it uses AI elsewhere in its business.³ Linkhome Holdings' 10-K filed 2026-03-26 says "we've yet to utilize AI within our financial reporting or internal control over financial reporting functions."⁵

Lightbridge's 10-K filed 2026-02-26 draws a narrower line. It says its AI tools "do not replace the professional judgment of our management, engineers, or other technical personnel," and that the company "does not rely exclusively on AI-generated content or recommendations for any material regulatory submissions, safety decisions, or financial reporting."⁴ Saying not exclusively is a different claim from saying not at all: it allows AI output to inform financial reporting while saying it is not the only basis.

ARMOUR Residential REIT goes the other way in its 10-K filed 2026-02-18, listing financial reporting among the business processes in which the company, its manager or third-party service providers use AI, alongside "data analysis, investment modeling, risk management, financial reporting, and cybersecurity."⁸

Oversight and missing controls as a stated risk

Celestica's 10-K filed 2026-02-27 describes its Audit Committee's mandate as covering risks "related to AI" and the systems to manage such risks "as they relate to financial reporting integrity and disclosure controls."⁶ Medpace's 10-K filed 2026-02-10 names the opposite condition as a risk: "insufficient human oversight of AI or a lack of controls and procedures monitoring the use of AI in day-to-day operations."⁷

What regulators have said about the same questions

Governor Lisa D. Cook of the Federal Reserve Board said on 2025-07-17: "A central tenet of good governance should be the mindset that humans are in the loop, because it ensures that people guide AI rather than allow AI to guide us."⁹ The Brownie's Marine wording, with anomalies sent "for further human review", is one concrete form of that idea in a filing.²

SEC Chairman Paul S. Atkins said on 2026-03-04 that the SEC's materiality-based approach should inform how a public company discloses developments concerning AI, "just as it guides disclosures about any other development."¹⁰ None of the filings above says why it placed its AI statement in one section rather than another, and this page does not guess.

Where to find more

Each passage above has an entry in the filings stream under its kicker, with the section and dates. The earlier explainer on AI and internal control over financial reporting collects the risk-factor statements on the same subject, and the regulation tracker lists the speeches cited here.