How to read an AI risk factor

An AI risk factor that touches the finance function usually says one of three things: that AI output could be wrong and the error could reach the financial statements, that the company does or does not use AI in its reporting and controls, or that criminals use AI to impersonate people who can move money. Reading one well means asking which of those it says, how specific it is, and where in the filing it sits. This page uses passages from the filings stream as examples; it describes them and does not grade them.

Start with where it sits

In the filings quoted here, risk factors sit under the heading Item 1A, Risk Factors, in both 10-Ks and 10-Qs.²⁹ The same subject can appear elsewhere: in Item 1, Business, where a company describes what it sells; in Item 1C, Cybersecurity, where it describes how it manages cyber risk; or in management's discussion and analysis. Each entry on this site names the item heading the passage sits under, read from the filing's own headings, so the same words can be weighed in context.

Question 1: is the risk about AI output reaching the numbers?

Some companies now name financial reporting among the places a faulty AI output could do harm. Super Micro Computer's 10-K filed 2026-08-31 says AI technology "may also produce inaccurate, incomplete, biased, misleading or fabricated responses that could lead to errors in our decision-making, solution development, financial reporting, compliance activities" and other activities.² Winnebago Industries' 10-K filed 2026-10-21 lists "forecasting, financial reporting processes, compliance activities" among the functions unreliable AI outputs could adversely affect.³

What to notice: both name financial reporting inside a longer list. Neither passage, as quoted, says the company uses AI in its close or its controls; it says outputs could cause errors in areas that include reporting. A reader who wants to know whether AI touches the ledger has to look for a separate statement of use.

Question 2: does the company say whether it uses AI in reporting or controls?

A few filings answer directly. LendingTree's 10-K filed 2026-03-09 says: "In the future, we may increasingly use automated tools, including AI and machine learning technologies, in connection with data analysis, financial reporting processes, and internal controls."⁴ That is a statement about possible future use, in a risk factor. Linkhome Holdings' 10-K filed 2026-03-26 says the opposite for the present: "we've yet to utilize AI within our financial reporting or internal control over financial reporting functions," while using AI in its application and in certain agent activities.⁵

UMB Financial's 10-K filed 2026-02-26 treats AI as a control area in its own right, saying the company must "develop and maintain information, financial reporting, disclosure, privacy, data protection, data security, artificial intelligence, and other controls."⁶ Upstart's 10-Q filed 2025-11-04 lists "AI models and technology" beside "disclosure controls and procedures, internal control over financial reporting" as areas its ability to improve could be strained.⁹

What to notice: tense and modality. "We may increasingly use" (LendingTree), "we've yet to utilize" (Linkhome) and "must successfully develop and maintain" (UMB) are three different statements, and the risk factor heading alone does not tell them apart.

Question 3: is the risk about impersonation and payments?

The most concrete finance-function passages concern fraud. TriplePoint Venture Growth BDC's 10-K filed 2026-03-04 names "AI-generated impersonations of senior executives to authorize fraudulent wire transfers."⁷ Verano Holdings' 10-K filed 2026-03-12 says: "We have seen a global rise in cyber-enabled fraud, where bad actors use AI to impersonate executives or vendors to authorize fraudulent wire transfers."⁸ These describe a mechanism that runs through accounts payable and treasury: a forged instruction from someone with authority to pay. The explainer on deepfakes and payment fraud sets out what regulators have said about the same pattern.

Question 4: is it specific to the company?

On 2024-02-13 SEC Chair Gary Gensler said that when disclosing material risks about AI, "investors benefit from disclosures particularized to the company, not from boilerplate language."¹ That is one official's view, not a rule, but it is a useful test. Phrases that recur across many filings, such as long lists of AI-enabled attack types, say less about one company than a sentence that names its own process, product or past experience. Verano's "we have seen" is a statement about the company's own observation; a list of threats that could apply to anyone is not.

What a risk factor cannot tell you

A risk factor states that something could happen. It does not say the event has happened, how likely it is, or how large it would be, unless the company says so. Nothing on this page is a view on any company's securities. Each example above is footnoted to its filing on sec.gov and has an entry in the filings stream; the companies index groups companies with more than one entry.