SEC comment letters that mention artificial intelligence: what the staff asked and how filers answered

Yes. From 2023-01-01 to 2026-10-31 the SEC's Division of Corporation Finance released 213 comment letters to 161 companies with at least one comment asking about artificial intelligence in their disclosures, and in 162 of those letters the staff asked the company to describe how it actually uses or develops AI.¹ The other requests repeat across letters: define what the company means by AI, back up or balance an AI claim, describe the risks, and, less often, explain AI revenue, costs or assets in the financial statements.¹

Most of the letters went to companies on their way to market. Of the 213, 102 commented on a draft registration statement, 68 on a filed registration statement and 20 on a Regulation A offering statement; 19 reviewed a Form 10-K or 20-F and 2 a Form 10-Q.¹ A public company that files only periodic reports is a small part of this record, and the letters to them read differently, as the section on 10-K reviews below shows.

How comment letters are released and how to read one

The Division of Corporation Finance reviews filings selectively, and its staff “may provide a company with comments where the staff believes a company can significantly enhance its compliance with the applicable requirements.”³ Those comments may ask a company to provide supplemental information, revise a document on file, add disclosure, or change disclosure in a future filing, and “The Division completes many filing reviews without issuing comments.”³

The letters become public later. The Division posts its comment letters and the company responses on EDGAR “no sooner than 20 business days after it has completed its review of a periodic or current report or declared a registration statement effective.”³ On EDGAR the staff letter is form UPLOAD and the company's reply is form CORRESP; the UPLOAD's filing date is the date of the letter, not the date it was released. A draft registration statement can be under review for months, and its letters appear only after the review closes, so the most recent quarters in any count of these letters are always short.

A letter reads in a fixed order. It names the filing under review, then sets out numbered comments, each under the heading and page of the passage it concerns. Most open with “We note your disclosure” and quote the company's own words back to it, then ask for something. The company's response repeats each comment and answers it below, usually by pointing to a page of the amended filing.

Method: the queries, the windows and the release lag

EDGAR full-text search was run for four phrases, “artificial intelligence”, “machine learning”, “generative AI” and “AI”, in forms UPLOAD and CORRESP, one calendar quarter at a time from 2023-01-01 to 2026-10-31, every page of results read.¹² The search indexes both forms over the whole window. It returned 395 distinct UPLOAD letters and 533 CORRESP letters, counted by accession number.¹²

Every UPLOAD letter was read on sec.gov from the plain-text copy EDGAR keeps beside the PDF, split into its numbered comments, and kept when at least one comment names AI as its subject. That test matters. Of the 395 letters, 180 have no such comment: in 86 the AI comments name it only inside a name (a company, segment, subsidiary or counterparty with AI in it), and in the rest AI appears only in the address, the page headers or a heading. A mention counts when the lowercase phrase is used, or when “AI” stands without a capitalized word on either side (“your AI models”, “AI-powered”, “use of AI”).¹ One letter could be read only as a PDF and one, to a unit investment trust, came from the Division of Investment Management; both are left out. That leaves 213 letters with 349 AI comments.

Each comment was coded by five rules, tested on each sentence that names AI and the sentence after it:

• Define. Asks for a definition, or what the company means by the term.
• Substantiate. Asks for the basis or support for a statement, or to balance, qualify or remove it.
• Risk. Asks for risk disclosure or a risk factor.
• Use. Asks the company to describe, explain or clarify how AI is used, developed, sourced or deployed.
• Finance. Asks about revenue, goodwill, segments, leases, useful lives, metrics or capitalization tied to AI, tested on the AI sentence alone.

A reader then read every comment the rules coded as define, substantiate, risk or finance and every comment with no code, plus every third comment coded as use, and removed 35 codes that did not hold, such as a request to define “efficacious” in a comment that also mentions AI. The decisions are in the research file with a reason for each.¹

For the responses, each CORRESP letter was split at the word “Response”, and a response was kept when the staff comment it repeats names AI and the letter came from a company that received one of the 213 staff letters, within 120 days after it. That gives 117 responses in 73 letters.² Many draft registration statements are answered with an amended draft and a cover letter that is not filed as CORRESP until later, so the responses cover only part of the comments.

Letters per quarter mentioning AI

The count rises through 2024. There were 37 letters in 2023, 98 in 2024 and 71 in 2025, and 7 so far in 2026, with a peak of 34 in the first quarter of 2025.¹ The 2025 fourth quarter has none and 2026 has 5, 2 and 0 in its first three quarters.¹ Those quarters are thin for every subject. Full-text search returns between 1,574 and 2,178 staff letters a quarter carrying the phrase “Division of Corporation Finance” from 2023 through the third quarter of 2025, then 179 for the fourth quarter of 2025, 740 and 564 for the first two quarters of 2026 and 49 for the third.¹ The drop in the chart is a drop in what has been released, not a measure of what the staff is asking.

Against that denominator, letters with an AI comment were 0.5% of the Division's released letters in 2023, 1.3% in 2024 and 1.4% in 2025.¹ The 2026 figure, 0.5%, rests on the incomplete quarters.

What staff asked, grouped by request type

Use: 162 of 213 letters. The most common AI comment asks a company to explain what its AI does, and seven letters ask whether it differs from ordinary algorithmic code. To Waystar, on 2023-09-20, the staff wrote: “Please clarify what you mean by artificial intelligence and explain how it is used in your platform and differs from simple algorithmic code that automates processes in your platform.”⁶ Pattern Group received the same sentence on 2025-01-13.⁸ The follow-up question is usually whether the AI is the company's own: Waystar was also asked to “clarify whether your platform utilizes third-party artificial intelligence products or internally developed artificial intelligence processes.”⁶

Risk: 81. The staff asks for risk factors specific to AI, and for the state of AI regulation. Rosecliff Acquisition Corp I was asked on 2023-07-12 to “include a risk factor discussing the current state of artificial intelligence regulation within the United States and your other potential markets”.¹⁴ Klarna was asked on 2025-02-07 to address, in its risk section or MD&A, “how Klarna monitors, manages and provides governance to address this risk”, the risk being AI models that may be incorrectly designed or implemented.¹⁶

Substantiate: 33. These comments take a claim and ask for its basis, or ask for balance. CoreWeave was asked on 2025-01-13 to “disclose the basis for your statement that you are the AI Hyperscaler driving the AI revolution and the criteria on which you base this statement.”¹⁰ Astera Labs was asked on 2024-01-09 to “provide a more balanced discussion of AI”, including “the potential limitations, obstacles, and uncertainties associated with AI adoption, use, and commercialization.”¹¹

Define: 27. Arrowroot Acquisition Corp., reviewing a merger with an AI company, was asked on 2023-10-05: “Please revise to define the terms ‘artificial intelligence’ and ‘machine learning’ in the context of your business.”⁷ From October 2024 a stock form appears in 10 letters, Pattern Group's among them: “Please provide your definition of artificial intelligence in the context of your business”.¹⁸ Rubrik was asked on 2024-03-29 to clarify “in plain English, the meaning of generative artificial intelligence and the selection criteria and analysis used prior to implementing an AI tool.”⁹

Finance: 19. A smaller group of comments goes to the numbers. Space Exploration Technologies Corp's draft registration statement drew comments on its AI segment, among them: “We note that goodwill attributable to the AI segment was $11.2 billion as of December 31, 2025.”²⁰ The same review asked whether management uses AI key business metrics such as subscribers or average revenue per subscriber.²⁰

Nineteen letters carry none of the five codes, mostly comments that name AI in passing on another subject.¹ Governance comes up in 10 letters, typically as a question: Jefferson Capital was asked on 2025-02-18 to “Discuss whether you have a governance policy for how you use AI.”¹⁵

What 10-K filers were asked

The 19 letters on annual reports ask about AI where it touches the business results. Welltower was asked on 2025-04-28, on its 10-K, to “tell us, and revise future filings, to discuss your data science platform and the status of any AI-integration efforts”, after the staff noted how the company had described the platform on its fourth-quarter 2024 earnings call and in a press release.¹⁷ Upstart, whose 10-K said its AI models had grown in variables and data points, was asked on 2024-08-13 for “the factors that led lower than forecast performance for recent vintages, despite the access to additional data.”¹⁸ Reddit was asked on 2026-03-31 to reconcile its MD&A with an earnings call that credited revenue growth in part to “machine learning-powered efficiency”.¹⁹

Those three letters share a pattern that matters to a finance team. In each, the staff set a public statement about AI (an earnings call, a press release, a model description) against what the 10-K's own discussion of results says, and asked the company to close the gap.

What filers answered: added risk factor, removed claim, defined term

Most responses say the filing was changed. Of the 117 responses to AI comments, 99 name a revision or addition to the disclosure, 13 an added or revised risk factor, 2 the removal of a statement and 1 a definition of the term; 16 answer or explain without naming any change.² The definition count is low because filers usually add the definition to the amended filing and say only that they revised it.

Rosecliff's response of 2023-06-27 to a comment on balancing its device's strengths against “the challenges you face in developing AI capabilities” is typical of the risk factor answers: the company “has added disclosure on page 184 regarding the challenges associated with developing AI capabilities and has added a risk factor on page 77 related to such challenges.”¹²¹³ Space Exploration Technologies Corp, asked on 2026-05-19 to disclose a metric behind a statement that a growing share of its users are paying subscribers, answered on 2026-05-20 that the disclosure “has been revised to remove the statement referenced in the Staff’s comment.”²¹²²

The Ingram Micro exchange shows all three kinds of answer at once. The staff's comment of 2024-09-19 on its draft Form S-1:

And the company's answer of 2024-09-30:

The response adds that the change “was made to simplify the disclosure and to focus on the present state of the platform”.⁵

Where the staff has not asked

The set is also notable for what it lacks. None of the 349 AI comments asks how a company uses AI in its own accounting, its close or its internal control over financial reporting; the one comment that matches “internal control” does so only because a section heading on controls follows it in the letter.¹ Cybersecurity appears in the AI comments of 2 letters.¹ The 10-K letters ask about AI in the business and its results, not in the finance function that reports them.

Nor do the letters use the SEC's enforcement vocabulary. Full-text search returns no UPLOAD or CORRESP letter in the window with the phrase “AI washing”.¹² The site's explainer on the SEC's AI agenda covers the Commission's rules, statements and enforcement actions, and the SEC entry in the regulation tracker lists its AI documents by date. For how often filings themselves name AI, see the count of AI disclosure in SEC filings.

What a comment letter is and is not

A comment letter is a request in the course of a review. It records what the staff asked about a draft or a filing, and the response records what the company chose to change or explain; neither is a finding about the company. The Division says it “does not evaluate the merits of any transaction or determine whether an investment is appropriate for any investor.”³ Letters close with the same reminder, as in the one to Reddit: “We remind you that the company and its management are responsible for the accuracy and adequacy of their disclosures, notwithstanding any review, comments, action or absence of action by the staff.”¹⁹

The counts here are of what the staff wrote and released, in a window whose recent end is incomplete, coded by rules a reader checked. They are recomputed from the saved research files by scripts/cfonews-ai/articles/comment-letters.mjs, which prints every figure quoted above.