# cfonews.ai: full text

> What public companies tell the SEC about AI in their finance functions, and what regulators say about it, each item quoted from and linked to its primary source.

This file holds the explainers in full, the computed counts, every regulation tracker row and every filing entry with its verbatim quote. Quotes are copied from the filing on sec.gov in 40 words or fewer. Cite with attribution to the filing or the regulator and to cfonews.ai (https://cfonews.ai).

Index: https://cfonews.ai/llms.txt

## Stats

### AI in 10-K risk factors, by quarter

URL: https://cfonews.ai/stats/ai-in-10-k-risk-factors
Data: https://cfonews.ai/stats/ai-in-10-k-risk-factors.csv and .json
22 10-K filings from 22 companies in this log name AI in an Item 1A risk factor that touches finance, filed between 2025-11-04 and 2026-11-13. The most in one quarter is 16, in 2026-Q1. A count of this log, not of all filers.

- 2025-Q4 (log covers 2025-11-04 to 2025-12-31): 0 filings, 0 companies
- 2026-Q1 (log covers 2026-01-01 to 2026-03-31): 16 filings, 16 companies
- 2026-Q2 (log covers 2026-04-01 to 2026-06-30): 2 filings, 2 companies
- 2026-Q3 (log covers 2026-07-01 to 2026-09-30): 2 filings, 2 companies
- 2026-Q4 (log covers 2026-10-01 to 2026-11-13): 2 filings, 2 companies


## Long reads

### SEC comment letters that mention artificial intelligence: what the staff asked and how filers answered

URL: https://cfonews.ai/explainers/sec-comment-letters-artificial-intelligence
Published: 2026-11-12
Question: Has the SEC asked public companies about their AI disclosures in comment letters?
213 SEC staff comment letters from 2023 to 2026 with a comment on AI, read and coded by what the staff asked, with the filers' responses and the release lag.

Yes. From 2023-01-01 to 2026-10-31 the SEC's Division of Corporation Finance released 213 comment letters to 161 companies with at least one comment asking about artificial intelligence in their disclosures, and in 162 of those letters the staff asked the company to describe how it actually uses or develops AI.[1] The other requests repeat across letters: define what the company means by AI, back up or balance an AI claim, describe the risks, and, less often, explain AI revenue, costs or assets in the financial statements.[1]

Most of the letters went to companies on their way to market. Of the 213, 102 commented on a draft registration statement, 68 on a filed registration statement and 20 on a Regulation A offering statement; 19 reviewed a Form 10-K or 20-F and 2 a Form 10-Q.[1] A public company that files only periodic reports is a small part of this record, and the letters to them read differently, as the section on 10-K reviews below shows.

## How comment letters are released and how to read one

The Division of Corporation Finance reviews filings selectively, and its staff “may provide a company with comments where the staff believes a company can significantly enhance its compliance with the applicable requirements.”[3] Those comments may ask a company to provide supplemental information, revise a document on file, add disclosure, or change disclosure in a future filing, and “The Division completes many filing reviews without issuing comments.”[3]

The letters become public later. The Division posts its comment letters and the company responses on EDGAR “no sooner than 20 business days after it has completed its review of a periodic or current report or declared a registration statement effective.”[3] On EDGAR the staff letter is form UPLOAD and the company's reply is form CORRESP; the UPLOAD's filing date is the date of the letter, not the date it was released. A draft registration statement can be under review for months, and its letters appear only after the review closes, so the most recent quarters in any count of these letters are always short.

A letter reads in a fixed order. It names the filing under review, then sets out numbered comments, each under the heading and page of the passage it concerns. Most open with “We note your disclosure” and quote the company's own words back to it, then ask for something. The company's response repeats each comment and answers it below, usually by pointing to a page of the amended filing.

## Method: the queries, the windows and the release lag

EDGAR full-text search was run for four phrases, “artificial intelligence”, “machine learning”, “generative AI” and “AI”, in forms UPLOAD and CORRESP, one calendar quarter at a time from 2023-01-01 to 2026-10-31, every page of results read.[1][2] The search indexes both forms over the whole window. It returned 395 distinct UPLOAD letters and 533 CORRESP letters, counted by accession number.[1][2]

Every UPLOAD letter was read on sec.gov from the plain-text copy EDGAR keeps beside the PDF, split into its numbered comments, and kept when at least one comment names AI as its subject. That test matters. Of the 395 letters, 180 have no such comment: in 86 the AI comments name it only inside a name (a company, segment, subsidiary or counterparty with AI in it), and in the rest AI appears only in the address, the page headers or a heading. A mention counts when the lowercase phrase is used, or when “AI” stands without a capitalized word on either side (“your AI models”, “AI-powered”, “use of AI”).[1] One letter could be read only as a PDF and one, to a unit investment trust, came from the Division of Investment Management; both are left out. That leaves 213 letters with 349 AI comments.

Each comment was coded by five rules, tested on each sentence that names AI and the sentence after it:

- **Define.** Asks for a definition, or what the company means by the term.
- **Substantiate.** Asks for the basis or support for a statement, or to balance, qualify or remove it.
- **Risk.** Asks for risk disclosure or a risk factor.
- **Use.** Asks the company to describe, explain or clarify how AI is used, developed, sourced or deployed.
- **Finance.** Asks about revenue, goodwill, segments, leases, useful lives, metrics or capitalization tied to AI, tested on the AI sentence alone.

A reader then read every comment the rules coded as define, substantiate, risk or finance and every comment with no code, plus every third comment coded as use, and removed 35 codes that did not hold, such as a request to define “efficacious” in a comment that also mentions AI. The decisions are in the research file with a reason for each.[1]

For the responses, each CORRESP letter was split at the word “Response”, and a response was kept when the staff comment it repeats names AI and the letter came from a company that received one of the 213 staff letters, within 120 days after it. That gives 117 responses in 73 letters.[2] Many draft registration statements are answered with an amended draft and a cover letter that is not filed as CORRESP until later, so the responses cover only part of the comments.

## Letters per quarter mentioning AI

[Figure] Staff letters with a comment on AI rose from 4 in the first quarter of 2023 to 34 in the first quarter of 2025, then fell as releases lag. Staff letters by Quarter of the letter's date. Staff letters with a comment that names AI: 2023 Q1 4, 2023 Q2 10, 2023 Q3 6, 2023 Q4 17, 2024 Q1 23, 2024 Q2 18, 2024 Q3 26, 2024 Q4 31, 2025 Q1 34, 2025 Q2 18, 2025 Q3 19, 2025 Q4 0, 2026 Q1 5, 2026 Q2 2, 2026 Q3 0, 2026 Q4 0. Letters from the Division of Corporation Finance with at least one numbered comment that names AI as its subject, by the quarter of the letter's date on EDGAR. Letters are released no sooner than 20 business days after a review is complete, so 2025 Q4 to 2026 Q4 are incomplete. 2026 Q4 runs to 2026-10-31.

The count rises through 2024. There were 37 letters in 2023, 98 in 2024 and 71 in 2025, and 7 so far in 2026, with a peak of 34 in the first quarter of 2025.[1] The 2025 fourth quarter has none and 2026 has 5, 2 and 0 in its first three quarters.[1] Those quarters are thin for every subject. Full-text search returns between 1,574 and 2,178 staff letters a quarter carrying the phrase “Division of Corporation Finance” from 2023 through the third quarter of 2025, then 179 for the fourth quarter of 2025, 740 and 564 for the first two quarters of 2026 and 49 for the third.[1] The drop in the chart is a drop in what has been released, not a measure of what the staff is asking.

Against that denominator, letters with an AI comment were 0.5% of the Division's released letters in 2023, 1.3% in 2024 and 1.4% in 2025.[1] The 2026 figure, 0.5%, rests on the incomplete quarters.

## What staff asked, grouped by request type

[Figure] Of 213 staff letters with a comment on AI, 162 ask how the company uses or develops it and 81 ask about its risks. Staff letters by What the staff asked. Staff letters (of 213): Define or explain the AI term 27, Give the basis for an AI claim, or balance or remove it 33, Describe the risks of AI, or add a risk factor 81, Describe how AI is used or developed in the business 162, Account for or analyze AI revenue, costs or assets 19, None of these 19. Each letter counted once per request type when any of its AI comments matches the type's published rule, after a reader's review. A letter can carry several types. 2023-01-01 to 2026-10-31.

**Use: 162 of 213 letters.** The most common AI comment asks a company to explain what its AI does, and seven letters ask whether it differs from ordinary algorithmic code. To Waystar, on 2023-09-20, the staff wrote: “Please clarify what you mean by artificial intelligence and explain how it is used in your platform and differs from simple algorithmic code that automates processes in your platform.”[6] Pattern Group received the same sentence on 2025-01-13.[8] The follow-up question is usually whether the AI is the company's own: Waystar was also asked to “clarify whether your platform utilizes third-party artificial intelligence products or internally developed artificial intelligence processes.”[6]

**Risk: 81.** The staff asks for risk factors specific to AI, and for the state of AI regulation. Rosecliff Acquisition Corp I was asked on 2023-07-12 to “include a risk factor discussing the current state of artificial intelligence regulation within the United States and your other potential markets”.[14] Klarna was asked on 2025-02-07 to address, in its risk section or MD&A, “how Klarna monitors, manages and provides governance to address this risk”, the risk being AI models that may be incorrectly designed or implemented.[16]

**Substantiate: 33.** These comments take a claim and ask for its basis, or ask for balance. CoreWeave was asked on 2025-01-13 to “disclose the basis for your statement that you are the AI Hyperscaler driving the AI revolution and the criteria on which you base this statement.”[10] Astera Labs was asked on 2024-01-09 to “provide a more balanced discussion of AI”, including “the potential limitations, obstacles, and uncertainties associated with AI adoption, use, and commercialization.”[11]

**Define: 27.** Arrowroot Acquisition Corp., reviewing a merger with an AI company, was asked on 2023-10-05: “Please revise to define the terms ‘artificial intelligence’ and ‘machine learning’ in the context of your business.”[7] From October 2024 a stock form appears in 10 letters, Pattern Group's among them: “Please provide your definition of artificial intelligence in the context of your business”.[1][8] Rubrik was asked on 2024-03-29 to clarify “in plain English, the meaning of generative artificial intelligence and the selection criteria and analysis used prior to implementing an AI tool.”[9]

**Finance: 19.** A smaller group of comments goes to the numbers. Space Exploration Technologies Corp's draft registration statement drew comments on its AI segment, among them: “We note that goodwill attributable to the AI segment was $11.2 billion as of December 31, 2025.”[20] The same review asked whether management uses AI key business metrics such as subscribers or average revenue per subscriber.[20]

Nineteen letters carry none of the five codes, mostly comments that name AI in passing on another subject.[1] Governance comes up in 10 letters, typically as a question: Jefferson Capital was asked on 2025-02-18 to “Discuss whether you have a governance policy for how you use AI.”[15]

## What 10-K filers were asked

The 19 letters on annual reports ask about AI where it touches the business results. Welltower was asked on 2025-04-28, on its 10-K, to “tell us, and revise future filings, to discuss your data science platform and the status of any AI-integration efforts”, after the staff noted how the company had described the platform on its fourth-quarter 2024 earnings call and in a press release.[17] Upstart, whose 10-K said its AI models had grown in variables and data points, was asked on 2024-08-13 for “the factors that led lower than forecast performance for recent vintages, despite the access to additional data.”[18] Reddit was asked on 2026-03-31 to reconcile its MD&A with an earnings call that credited revenue growth in part to “machine learning-powered efficiency”.[19]

Those three letters share a pattern that matters to a finance team. In each, the staff set a public statement about AI (an earnings call, a press release, a model description) against what the 10-K's own discussion of results says, and asked the company to close the gap.

## What filers answered: added risk factor, removed claim, defined term

[Figure] In 117 responses to AI comments, filers named a revision in 99 and a new or revised risk factor in 13. Responses by What the filer said it did. Responses (of 117, in 73 letters): Revised or added disclosure 99, Added or revised a risk factor 13, Removed or replaced a statement 2, Defined the AI term 1, Answered or explained, no change named 16. Responses in CORRESP letters whose repeated staff comment names AI, from filers that received one of the 213 letters, filed within 120 days after it. Coded on the response text only. A response can carry several codes.

Most responses say the filing was changed. Of the 117 responses to AI comments, 99 name a revision or addition to the disclosure, 13 an added or revised risk factor, 2 the removal of a statement and 1 a definition of the term; 16 answer or explain without naming any change.[2] The definition count is low because filers usually add the definition to the amended filing and say only that they revised it.

Rosecliff's response of 2023-06-27 to a comment on balancing its device's strengths against “the challenges you face in developing AI capabilities” is typical of the risk factor answers: the company “has added disclosure on page 184 regarding the challenges associated with developing AI capabilities and has added a risk factor on page 77 related to such challenges.”[12][13] Space Exploration Technologies Corp, asked on 2026-05-19 to disclose a metric behind a statement that a growing share of its users are paying subscribers, answered on 2026-05-20 that the disclosure “has been revised to remove the statement referenced in the Staff’s comment.”[21][22]

The Ingram Micro exchange shows all three kinds of answer at once. The staff's comment of 2024-09-19 on its draft Form S-1:

[Excerpt] "Please clarify what you mean by artificial intelligence and machine learning in this context, explain how it is used in your FSE and Ingram Micro Xvantage and how such usage may differ from algorithmic code ..." (https://www.sec.gov/Archives/edgar/data/1897762/000000000024010650/filename2.txt)

And the company's answer of 2024-09-30:

[Excerpt] "the Company has revised its disclosure ... to define such terms based on the NIST Artificial Intelligence Risk Management Framework. In doing so, we have removed reference to our flexible subscription engine" (https://www.sec.gov/Archives/edgar/data/1897762/000119312524228603/filename1.htm)

The response adds that the change “was made to simplify the disclosure and to focus on the present state of the platform”.[5]

## Where the staff has not asked

The set is also notable for what it lacks. None of the 349 AI comments asks how a company uses AI in its own accounting, its close or its internal control over financial reporting; the one comment that matches “internal control” does so only because a section heading on controls follows it in the letter.[1] Cybersecurity appears in the AI comments of 2 letters.[1] The 10-K letters ask about AI in the business and its results, not in the finance function that reports them.

Nor do the letters use the SEC's enforcement vocabulary. Full-text search returns no UPLOAD or CORRESP letter in the window with the phrase “AI washing”.[1][2] The site's [explainer on the SEC's AI agenda](https://cfonews.ai/explainers/the-secs-ai-agenda) covers the Commission's rules, statements and enforcement actions, and the [SEC entry in the regulation tracker](https://cfonews.ai/regulation/sec) lists its AI documents by date. For how often filings themselves name AI, see the [count of AI disclosure in SEC filings](https://cfonews.ai/explainers/ai-disclosure-in-sec-filings-counted).

## What a comment letter is and is not

A comment letter is a request in the course of a review. It records what the staff asked about a draft or a filing, and the response records what the company chose to change or explain; neither is a finding about the company. The Division says it “does not evaluate the merits of any transaction or determine whether an investment is appropriate for any investor.”[3] Letters close with the same reminder, as in the one to Reddit: “We remind you that the company and its management are responsible for the accuracy and adequacy of their disclosures, notwithstanding any review, comments, action or absence of action by the staff.”[19]

The counts here are of what the staff wrote and released, in a window whose recent end is incomplete, coded by rules a reader checked. They are recomputed from the saved research files by scripts/cfonews-ai/articles/comment-letters.mjs, which prints every figure quoted above.

Sources:
[1] SEC EDGAR full-text search, form UPLOAD (staff letters), filed 2023-01-01 to 2026-10-31, phrases "artificial intelligence", "machine learning", "generative AI" and "AI", one query per phrase and calendar quarter, paged to the end, every letter read on sec.gov, 2026-11-12. https://efts.sec.gov/LATEST/search-index?q=%22artificial%20intelligence%22&forms=UPLOAD&dateRange=custom&startdt=2023-01-01&enddt=2026-10-31
[2] SEC EDGAR full-text search, form CORRESP (company correspondence), same phrases and window, every letter read on sec.gov, 2026-11-12. https://efts.sec.gov/LATEST/search-index?q=%22artificial%20intelligence%22&forms=CORRESP&dateRange=custom&startdt=2023-01-01&enddt=2026-10-31
[3] SEC, Division of Corporation Finance, Filing Review Process, 2019-09-27. https://www.sec.gov/divisions/corpfin/cffilingreview.htm
[4] SEC EDGAR, staff letter (UPLOAD) to Ingram Micro Holding Corp on its draft registration statement on Form S-1, 2024-09-19. https://www.sec.gov/Archives/edgar/data/1897762/000000000024010650/filename2.txt
[5] SEC EDGAR, Ingram Micro Holding Corp response letter (CORRESP), 2024-09-30. https://www.sec.gov/Archives/edgar/data/1897762/000119312524228603/filename1.htm
[6] SEC EDGAR, staff letter (UPLOAD) to Waystar Holding Corp. on its draft registration statement, 2023-09-20. https://www.sec.gov/Archives/edgar/data/1990354/000000000023010391/filename2.txt
[7] SEC EDGAR, staff letter (UPLOAD) to Arrowroot Acquisition Corp. on its registration statement, 2023-10-05. https://www.sec.gov/Archives/edgar/data/1835972/000000000023010982/filename2.txt
[8] SEC EDGAR, staff letter (UPLOAD) to Pattern Group Inc. on its draft registration statement, 2025-01-13. https://www.sec.gov/Archives/edgar/data/1811935/000000000025000340/filename2.txt
[9] SEC EDGAR, staff letter (UPLOAD) to Rubrik, Inc. on its draft registration statement, 2024-03-29. https://www.sec.gov/Archives/edgar/data/1943896/000000000024003416/filename2.txt
[10] SEC EDGAR, staff letter (UPLOAD) to CoreWeave, Inc. on its draft registration statement, 2025-01-13. https://www.sec.gov/Archives/edgar/data/1769628/000000000025000329/filename2.txt
[11] SEC EDGAR, staff letter (UPLOAD) to Astera Labs, Inc. on its draft registration statement, 2024-01-09. https://www.sec.gov/Archives/edgar/data/1736297/000000000024000300/filename2.txt
[12] SEC EDGAR, staff letter (UPLOAD) to Rosecliff Acquisition Corp I on its registration statement, 2023-05-26. https://www.sec.gov/Archives/edgar/data/1833498/000000000023005640/filename2.txt
[13] SEC EDGAR, Rosecliff Acquisition Corp I response letter (CORRESP), 2023-06-27. https://www.sec.gov/Archives/edgar/data/1833498/000121390023052250/filename1.htm
[14] SEC EDGAR, staff letter (UPLOAD) to Rosecliff Acquisition Corp I on its amended registration statement, 2023-07-12. https://www.sec.gov/Archives/edgar/data/1833498/000000000023007449/filename2.txt
[15] SEC EDGAR, staff letter (UPLOAD) to Jefferson Capital, Inc. on its draft registration statement, 2025-02-18. https://www.sec.gov/Archives/edgar/data/2046042/000000000025001844/filename2.txt
[16] SEC EDGAR, staff letter (UPLOAD) to Klarna Group plc on its draft registration statement, 2025-02-07. https://www.sec.gov/Archives/edgar/data/2003292/000000000025001346/filename2.txt
[17] SEC EDGAR, staff letter (UPLOAD) to Welltower Inc. on its Form 10-K, 2025-04-28. https://www.sec.gov/Archives/edgar/data/766704/000000000025004473/filename2.txt
[18] SEC EDGAR, staff letter (UPLOAD) to Upstart Holdings, Inc. on its Form 10-K, 2024-08-13. https://www.sec.gov/Archives/edgar/data/1647639/000000000024009255/filename2.txt
[19] SEC EDGAR, staff letter (UPLOAD) to Reddit, Inc. on its Form 10-K, 2026-03-31. https://www.sec.gov/Archives/edgar/data/1713445/000000000026003274/filename2.txt
[20] SEC EDGAR, staff letter (UPLOAD) to Space Exploration Technologies Corp on its draft registration statement, 2026-04-24. https://www.sec.gov/Archives/edgar/data/1181412/000000000026004247/filename2.txt
[21] SEC EDGAR, staff letter (UPLOAD) to Space Exploration Technologies Corp on its draft registration statement, 2026-05-19. https://www.sec.gov/Archives/edgar/data/1181412/000000000026005119/filename2.txt
[22] SEC EDGAR, Space Exploration Technologies Corp response letter (CORRESP), 2026-05-20. https://www.sec.gov/Archives/edgar/data/1181412/000162828026036964/filename1.htm

### ASC 350-40 walk-through: when capitalization starts and stops, with filers' own policy sentences

URL: https://cfonews.ai/explainers/asc-350-40-internal-use-software-walkthrough
Published: 2026-11-12
Question: What costs are capitalized under ASC 350-40 and when does capitalization start?
The three ASC 350-40 stages step by step, what is capitalized and what is expensed, and how twelve 2026 10-K filers word the start and stop of capitalization.

Under ASC 350-40, a company capitalizes the external direct costs of developing or obtaining internal-use software, the payroll of employees who work directly on the project and the interest incurred while building it, and expenses training, data conversion, overhead and maintenance.[1] Capitalization starts when the preliminary project stage is complete, management has authorized and committed to funding the project, and it is probable the project will be completed and the software used as intended; it stops no later than when the software is substantially complete and ready for its intended use.[1]

That is the rule most 10-Ks still describe. ASU 2025-06, issued by FASB on 2025-09-18, removes the stage condition and leaves the other two, with a new test for significant development uncertainty, for annual periods beginning after December 15, 2027.[1] This walk-through follows the Subtopic in the order a project runs, quotes twelve 2026 10-K filers on the start and the stop, and marks each place where the update changes the words. The site's [explainer on ASU 2025-06](https://cfonews.ai/explainers/asu-2025-06-internal-use-software-explained) covers the update itself and what filers say about adopting it.

## The scope question: what counts as internal-use software

The first decision is which Subtopic applies, because the start of capitalization differs between them. FASB's basis for conclusions in ASU 2025-06 puts the test in one place: when an entity “has a substantive plan to sell, lease, or otherwise market the software externally”, the costs fall under Subtopic 985-20; Subtopic 350-40 applies when the software “will be used internally in its own operations”, with an internal payroll system as the example.[1] Software used “to provide services (rather than to license the software) to external parties”, the arrangements usually called cloud computing arrangements, also falls under 350-40.[1] Software for sale has a different trigger: costs are expensed as research and development until technological feasibility is established.[1]

Paragraph 350-40-15-2 lists what the general guidance covers: internal-use software, the proceeds of internal-use software that is later marketed, new software that replaces old software, software made of more than one module, and, from ASU 2025-06, website development costs, moved in from Subtopic 350-50.[1] The module rule matters in practice. The Subtopic's own example is an accounting system with “a general ledger, an accounts payable subledger, and an accounts receivable subledger”, and the guidance “shall be applied to individual components or modules.”[1] Each module can sit in a different stage on the same day.

Cloud software reaches 350-40 by a second road. ASU 2018-15 requires a customer in a hosting arrangement that is a service contract “to follow the guidance in Subtopic 350-40 to determine which implementation costs to capitalize as an asset related to the service contract and which costs to expense.”[2] The customer works out which project stage each implementation activity belongs to; costs in the application development stage are capitalized by their nature, and preliminary and post-implementation costs are expensed.[2] The capitalized amount is then expensed over the term of the hosting arrangement, in the same income statement line as the hosting fees.[2]

## Preliminary project stage: what is expensed

Every cost before the start condition is met goes to expense. Paragraph 350-40-25-1 says internal and external costs incurred in the preliminary project stage “shall be expensed as they are incurred.”[1] The Subtopic's implementation guidance, as it stood before the update, listed four activities for the stage: conceptual formulation of alternatives, evaluation of alternatives, determination of existence of needed technology, and final selection of alternatives.[1]

In a finance systems project, that covers the requirements workshops, the vendor demonstrations, the make-or-buy analysis and the selection memo. Consultants' fees for that work are expensed in the same way as staff time.[1]

## Application development stage: what is capitalized and what is not

Capitalization begins when every condition in paragraph 350-40-25-12 is met. Before ASU 2025-06 there were three: the preliminary project stage is completed; management, “with the relevant authority, implicitly or explicitly authorizes and commits to funding a computer software project”; and it is probable the project will be completed and the software used to perform the function intended.[1] The paragraph's examples of authorization are a signed contract with a third party to develop the software, approval of expenditures for internal development, or a commitment to obtain the software from a third party.[1]

The old implementation guidance listed the stage's activities as design of the chosen path, including software configuration and interfaces; coding; installation to hardware; and testing, including the parallel processing phase.[1] The costs that may be capitalized are a closed list in paragraph 350-40-30-1, which says capitalized costs “include only the following”:[1]

- **External direct costs** of materials and services: fees paid to third parties to develop the software, costs to obtain software from third parties, and employees' travel directly associated with developing it.
- **Payroll and payroll-related costs** of employees “directly associated with and who devote time to” the project, to the extent of time spent on it.
- **Interest** incurred while developing the software, under Subtopic 835-20.
- **Software to access or convert old data** by the new system.

Three kinds of cost are expensed even when they fall inside the stage. Training costs “are not internal-use software development costs” and are expensed when incurred (350-40-25-4).[1] Data conversion is expensed except for the software described above, and the paragraph spells out what conversion covers: purging or cleansing existing data, reconciling old and new data, creating new data and converting old data (350-40-25-5).[1] General and administrative costs and overhead “shall not be capitalized” (350-40-30-3).[1] The Subtopic also says the order of activities may differ, since coding and testing often run together, and that once the start condition is met the guidance follows “the nature of the costs incurred, not the timing of their incurrence.”[1]

## Post-implementation and operation: training, maintenance, upgrades

Capitalization ends under paragraph 350-40-25-14: it “shall cease no later than the point at which a computer software project is substantially complete and ready for its intended use, that is, after all substantial testing is completed.”[1] ASU 2025-06 leaves that sentence as it is. If completion stops being probable before then, no further costs are capitalized and the impairment guidance applies to what has been capitalized (350-40-25-13).[1]

After go-live, training and maintenance are expensed. Upgrades and enhancements are capitalized only when it is probable the spending will result in additional functionality, which the Subtopic defines as modifications “to enable the software to perform tasks that it was previously incapable of performing.”[1] A company that cannot separate maintenance from relatively minor upgrades on a reasonably cost-effective basis expenses both (350-40-25-17D after the update, 25-10 before it).[1] When new software replaces old, the unamortized cost of the old software is expensed once the new software is ready for its intended use (350-40-25-15).[1]

[Diagram] The stage model in ASC 350-40 before ASU 2025-06: from project idea to capitalize or expense. 1: Preliminary project stage: expense. Conceptual formulation of alternatives, evaluation of alternatives, determination that the needed technology exists, final selection of alternatives. Internal and external costs are expensed as incurred (350-40-25-1). 2: Capitalization begins. When the preliminary project stage is completed, and management with the relevant authority authorizes and commits to funding the project, and it is probable the project will be completed and the software used as intended (old 350-40-25-12). 3: Application development stage: capitalize eligible costs. Design of the chosen path, coding, installation to hardware, testing including parallel processing. Capitalize external direct costs, payroll of employees working directly on the project, and interest (350-40-30-1). Expense training, data conversion, general and administrative costs and overhead (350-40-25-4, 25-5, 30-3). 4: Capitalization ceases. No later than when the project is substantially complete and ready for its intended use, after all substantial testing is completed (350-40-25-14). If completion stops being probable, capitalization stops and impairment guidance applies (350-40-25-13). 5: Post-implementation-operation stage: expense. Training and application maintenance are expensed as incurred (superseded 350-40-25-6). Upgrades and enhancements that add functionality follow the same stage tests (superseded 350-40-25-7 to 25-11).

## Policy sentences from twelve filers, grouped by how they state the start trigger

The sample follows a rule set before any filing was read. EDGAR full-text search was run for the phrase “ASC 350-40” in 10-Ks filed 2026-01-01 to 2026-10-31, one calendar month at a time and paged to the end; with amendments left out, it returned 385 documents from 366 filings.[3] Walking that list in the order the search returned it, the rule took the first filer in each SIC division whose matched document has a sentence stating when capitalization of internal-use software starts, and the second such filer in the three largest divisions. The frame has filers in nine divisions, so the rule yields twelve. Sixteen filings were passed over because the reader found no such sentence, usually because the note says only that certain costs are capitalized. A pattern missed Concentrix's sentence on the first pass; the reader added it, and the pattern was widened before the final draw.

[Figure] Services, manufacturing and finance filers write 298 of the 366 10-Ks; the sample takes two from each and one from every other division. Filings by SIC division. 10-Ks naming ASC 350-40: Services 142, Manufacturing 88, Finance, insurance, real estate 68, Transportation, communications, utilities 26, Retail trade 24, Wholesale trade 9, Construction 4, Mining 3, Agriculture, forestry, fishing 2. Filers quoted here: Services 2, Manufacturing 2, Finance, insurance, real estate 2, Transportation, communications, utilities 1, Retail trade 1, Wholesale trade 1, Construction 1, Mining 1, Agriculture, forestry, fishing 1. 10-Ks filed 2026-01-01 to 2026-10-31 whose text contains "ASC 350-40", by the SIC division of the filer's first SIC code on EDGAR, and the twelve filers the sampling rule drew. No filer in the frame is in public administration.

Twelve filings are an illustration of how the rule is written into notes. They do not show how all filers, or any industry, account for software.

The twelve fall into three groups by how the start is stated.

**The stage and the funding or completion conditions: 4 of 12.** These notes restate old paragraph 350-40-25-12 most fully. Diversified Energy writes that “Capitalization begins when the preliminary project stage is complete and management has authorized and committed to funding the software project, and it is probable that the project will be completed and the software will be used as intended.”[12] Ryerson pairs the end of the preliminary stage with probable completion.[9] Zeo Energy capitalizes development stage costs “once management authorizes and commits to funding the project and it is probable that the project will be completed and used as intended.”[15] T-Mobile's sentence is in the excerpt below.[11]

**The development stage only: 7 of 12.** Tesla says it capitalizes costs of internal use software “during the application development stage” to property, plant and equipment.[6] Concentrix capitalizes costs “subsequent to the software product reaching the application development stage.”[5] Verisk, Crisp Momentum, Arts Way, Dave & Buster's and Charlotte's Web use the stage name the same way, with Crisp Momentum and Verisk shortening it to “the development stage”.[4][7][8][13][14]

**The activities: 1 of 12.** Columbia Banking System names no capitalization stage. After charging preliminary project stage costs to non-interest expense, its note says “Costs associated with designing software configuration, installation, coding programs and testing systems are capitalized”, which is the old activity list for the application development stage in other words.[10]

The stop is stated less often. Four of the twelve notes say when capitalization ends: Arts Way, Verisk, T-Mobile and Zeo Energy, each with the Subtopic's phrase “ready for its intended use”.[7][8][11][15] Verisk puts both ends in one sentence: costs are capitalized once an application reaches the development stage “until the software is substantially complete and ready for its intended use.”[8] The other eight describe the end of capitalization only by saying that post-implementation, maintenance or training costs are expensed, or not at all.

[Table] Twelve policy notes, verbatim, on when capitalization of internal-use software starts and stops. Filer (SIC division) | Form, filed | How the note states the start | Start of capitalization, verbatim | Stop, verbatim
Crisp Momentum Inc. (Finance, insurance, real estate) | 10-K filed 2026-01-28, accession 0001493152-26-003967 | Names the development stage only | “Once an application has reached the development stage, internal and external costs incurred to develop internal-use software are capitalized ...” | Not stated in the note
Concentrix Corp (Services) | 10-K filed 2026-01-28, accession 0001803599-26-000027 | Names the development stage only | “The Company capitalizes costs incurred to develop software subsequent to the software product reaching the application development stage.” | Not stated in the note
Tesla, Inc. (Manufacturing) | 10-K filed 2026-01-29, accession 0001628280-26-003952 | Names the development stage only | “We capitalize costs incurred in the development of internal use software, during the application development stage to Property, plant and equipment, net on the consolidated balance sheets.” | Not stated in the note
Arts Way Manufacturing Co Inc (Manufacturing) | 10-K filed 2026-02-12, accession 0001437749-26-003904 | Names the development stage only | “Internal and external costs incurred to develop internal-use computer software during the application development stage are capitalized.” | “Capitalization of internal-use software costs ceases when a computer software project is substantially complete and ready for its intended use.”
Verisk Analytics, Inc. (Services) | 10-K filed 2026-02-18, accession 0001437749-26-004452 | Names the development stage only | “Once an application reaches the development stage, both internal and external costs are capitalized if they are direct and incremental, until the software is substantially complete and ready for its intended use.” | “... until the software is substantially complete and ready for its intended use.”
Ryerson Holding Corp (Wholesale trade) | 10-K filed 2026-02-23, accession 0001193125-26-062397 | States the stage and the funding or probable-completion conditions | “Software development costs are capitalized when the preliminary project stage is complete and the development stage of the project commences, it is probable that the project will be complete, and the software will be used to perform the function intended.” | Not stated in the note
Columbia Banking System, Inc. (Finance, insurance, real estate) | 10-K filed 2026-02-26, accession 0000887343-26-000088 | Lists the activities whose costs are capitalized | “Costs associated with designing software configuration, installation, coding programs and testing systems are capitalized and amortized using the straight-line method over three to seven years.” | Not stated in the note
T-Mobile US, Inc. (Transportation, communications, utilities) | 10-K filed 2026-02-11, accession 0001283699-26-000010 | States the stage and the funding or probable-completion conditions | “Capitalization of software costs commences once the final selection of the specific software solution has been made and management authorizes and commits to funding the software project and ceases once the project is ready for its intended use.” | “... and ceases once the project is ready for its intended use.”
Diversified Energy Co (Mining) | 10-K filed 2026-02-26, accession 0001922446-26-000020 | States the stage and the funding or probable-completion conditions | “Capitalization begins when the preliminary project stage is complete and management has authorized and committed to funding the software project, and it is probable that the project will be completed and the software will be used as intended.” | Not stated in the note
Dave & Buster's Entertainment, Inc. (Retail trade) | 10-K filed 2026-03-31, accession 0001525769-26-000008 | Names the development stage only | “Application development stage costs for internally developed software projects are capitalized and amortized as part of furniture, fixtures, and equipment.” | Not stated in the note
Charlotte's Web Holdings, Inc. (Agriculture, forestry, fishing) | 10-K filed 2026-03-31, accession 0001750155-26-000029 | Names the development stage only | “Software development costs incurred during the application development stage, which includes payroll and payroll-related costs related to employees and third-party consultant costs are capitalized.” | Not stated in the note
Zeo Energy Corp. (Construction) | 10-K filed 2026-04-01, accession 0001213900-26-037791 | States the stage and the funding or probable-completion conditions | “Costs incurred during the application development stage are capitalized once management authorizes and commits to funding the project and it is probable that the project will be completed and used as intended.” | “Capitalization ceases when the software is substantially complete and ready for its intended use.”

T-Mobile's note carries the start, the funding condition and the stop in 38 words:

[Excerpt] "Capitalization of software costs commences once the final selection of the specific software solution has been made and management authorizes and commits to funding the software project and ceases once the project is ready for its intended use." (https://www.sec.gov/Archives/edgar/data/1283699/000128369926000010/tmus-20251231.htm)

## How often the stage words appear across all 366 filings

The twelve show wording; the frame shows how widespread it is. Each stage term was searched together with “ASC 350-40” over the same window, so these counts are of every 10-K that cites the Subtopic, not a sample.[3]

[Figure] Of 366 10-Ks filed in 2026 that cite ASC 350-40, 34.2% use the words "application development stage" and 72.7% name ASU 2025-06. Share of filings by Term in the filing. All 366 10-Ks naming ASC 350-40: "preliminary project stage" 23.8%, "application development stage" 34.2%, "post-implementation" or "postimplementation" 30.1%, "probable that the project will be completed" 23.5%, "ready for its intended use" 21.3%, "ASU 2025-06" 72.7%. The 12 filers quoted here: "preliminary project stage" 50%, "application development stage" 66.7%, "post-implementation" or "postimplementation" 58.3%, "probable that the project will be completed" 25%, "ready for its intended use" 50%, "ASU 2025-06" 58.3%. Share of filings whose matched document contains "ASC 350-40" and the term, by EDGAR full-text search of the two together, 10-Ks filed 2026-01-01 to 2026-10-31, amendments left out. The second bar in each pair is the twelve filers quoted in this article, each 10-K read on sec.gov.

“Application development stage” appears in 125 of the 366 filings (34.2%), “post-implementation” or “postimplementation” in 110 (30.1%) and “preliminary project stage” in 87 (23.8%).[3] The words of the probable-completion condition, “probable that the project will be completed”, appear in 86 (23.5%), and the stop phrase “ready for its intended use” in 78 (21.3%), a count that also catches the same phrase used for buildings and equipment.[3] “ASU 2025-06” appears in 266, 72.7%, most of them in the paragraph on new standards not yet adopted.[3] Among the twelve, 8 use “application development stage” and 7 name ASU 2025-06 in that form.

A filing that cites ASC 350-40 does not have to use any stage term, and many in the frame cite the Subtopic only for hosting arrangement implementation costs, which is the 2018-15 route described above.[2]

## Where ASU 2025-06 replaces the stage language

The update takes the project stages out of the Subtopic. T-Mobile's note on it says “The amendments remove all references to project stages in ASC 350-40”, and the text of the ASU bears that out paragraph by paragraph: the start changes, the cost list and the stop do not.[11][1]

- **The start.** Paragraph 350-40-25-12(a), “Preliminary project stage is completed”, is superseded. Capitalization begins when management has authorized and committed to funding the project and it is probable the project will be completed and the software used as intended, which the ASU names the “probable-to-complete recognition threshold.”[1]
- **The new test.** The threshold is not met while significant development uncertainty exists, either because the software has “technological innovations or novel, unique, or unproven functions or features” not yet resolved through coding and testing, or because its significant performance requirements have not been identified or “continue to be substantially revised” (350-40-25-12A).[1]
- **The expense rule before the start.** Paragraph 350-40-25-1 now expenses costs incurred before the requirements of 25-12 through 25-12A are met, instead of costs “during the preliminary project stage”.[1]
- **The cost list.** Paragraph 350-40-30-1 keeps its four kinds of cost; the old stage activities (design, coding, installation, testing) move into it as examples of employee time.[1]
- **Upgrades.** The upgrade and maintenance paragraphs move to 350-40-25-17A through 25-17E and point to the start and stop paragraphs rather than the stages.[1]
- **The stop.** Paragraph 350-40-25-14 is unchanged.[1]

[Diagram] The same project under ASU 2025-06: authorization, then the probable-to-complete threshold, with no stages. 1: Before the two conditions are met: expense. Internal and external costs incurred before the capitalization requirements in 350-40-25-12 through 25-12A are met are expensed as incurred. 2: Condition one: authorization and funding. Management has authorized and committed to funding the software project. The ASU's examples: a contract with a third party to develop the software, approval of expenditures for internal development, or a commitment to obtain the software from a third party. 3: Condition two: probable to complete. It is probable the project will be completed and the software used to perform the function intended. The threshold is not met while significant development uncertainty exists (350-40-25-12A). 4: Capitalize eligible costs. The same list as before: external direct costs, payroll of employees working directly on the project (coding and testing, among other activities), interest, and software to access or convert old data (350-40-30-1). Training and data conversion stay expensed. 5: Capitalization ceases. No later than when the project is substantially complete and ready for its intended use, after all substantial testing (350-40-25-14). If the requirements stop being met, no further costs are capitalized and impairment guidance applies (350-40-25-13).

For the twelve, the sentences that would need new words under the update are the start sentences. All seven in the stage-only group and Columbia Banking's activity list describe the start by a stage or its activities; the four in the conditions group already name funding or probable completion, and Diversified Energy and Zeo Energy name both. The four stop sentences use the wording of 350-40-25-14, which the update keeps. ASU 2025-06 also gives no specific guidance on AI development costs: its basis for conclusions says the Board decided “not to provide specific guidance for training an AI model and data conversion costs.”[1] How companies describe AI in their own finance work is collected in the site's [explainer on AI in companies' own finance work](https://cfonews.ai/explainers/ai-in-own-finance-work).

## A worked cost list that mirrors the standard's text

A company replaces its general ledger with a licensed system and builds an internal reconciliation tool alongside it. Each line below takes the Subtopic's own words for the treatment; the paragraph numbers are those of the Subtopic after ASU 2025-06 unless marked.[1]

| Cost | Under the stage model | Under ASU 2025-06 | Paragraph |
|---|---|---|---|
| Requirements workshops, vendor demonstrations, selection | Expense: preliminary project stage | Expense: incurred before authorization and probable completion | 25-1 |
| Third-party fees to configure and code the ledger, after funding is approved | Capitalize: external direct cost | Capitalize, once the threshold is met | 30-1(a) |
| License fee to obtain the software | Capitalize: cost to obtain software from third parties | Same | 30-1(a), 25-17 |
| Payroll of staff coding and testing the reconciliation tool | Capitalize, for time spent directly on the project | Capitalize, once no significant development uncertainty remains | 30-1(b), 25-12A |
| Interest during development | Capitalize under Subtopic 835-20 | Same | 30-1(c) |
| Software written to convert old ledger data | Capitalize | Same | 30-1(d) |
| Cleansing and reconciling the old data | Expense: data conversion | Same | 25-5 |
| Training the close team | Expense, whenever incurred | Same | 25-4 |
| Project management office overhead, general and administrative cost | Expense | Same | 30-3 |
| Work after all substantial testing is complete | Stop capitalizing | Same | 25-14 |
| Maintenance after go-live | Expense | Same | 25-17C |
| A new module that does something the ledger could not do | Capitalize if additional functionality is probable, by the stage tests | Capitalize if additional functionality is probable, by the start and stop tests | 25-17A, 25-17B |

If the same ledger were a cloud service rather than a license, the implementation lines would follow the same tests through ASU 2018-15, with the capitalized amount expensed over the term of the hosting arrangement in the same line as the service fees.[2]

The research files, the sampling rule and the counts are recomputed by scripts/cfonews-ai/articles/asc-350-40.mjs, which also prints each figure quoted above.

Sources:
[1] Financial Accounting Standards Board, Accounting Standards Update No. 2025-06, Intangibles, Goodwill and Other, Internal-Use Software (Subtopic 350-40), issued 2025-09-18, as read on fasb.org, 2026-11-12. https://storage.fasb.org/ASU%202025-06.pdf
[2] Financial Accounting Standards Board, Accounting Standards Update No. 2018-15, implementation costs incurred in a cloud computing arrangement that is a service contract (August 2018), as read on fasb.org, 2026-11-12. https://storage.fasb.org/ASU%202018-15.pdf
[3] SEC EDGAR full-text search, phrase "ASC 350-40", form 10-K, filed 2026-01-01 to 2026-10-31, run month by month and paged to the end, with each stage term searched beside it, 2026-11-12. https://efts.sec.gov/LATEST/search-index?q=%22ASC%20350-40%22&forms=10-K&dateRange=custom&startdt=2026-01-01&enddt=2026-10-31
[4] SEC EDGAR, Crisp Momentum Inc. Form 10-K for the fiscal year ended 2025-07-31, 2026-01-28. https://www.sec.gov/Archives/edgar/data/924396/000149315226003967/form10-k.htm
[5] SEC EDGAR, Concentrix Corp Form 10-K for the fiscal year ended 2025-11-30, 2026-01-28. https://www.sec.gov/Archives/edgar/data/1803599/000180359926000027/cnxc-20251130.htm
[6] SEC EDGAR, Tesla, Inc. Form 10-K for 2025, 2026-01-29. https://www.sec.gov/Archives/edgar/data/1318605/000162828026003952/tsla-20251231.htm
[7] SEC EDGAR, Arts Way Manufacturing Co Inc Form 10-K for the fiscal year ended 2025-11-30, 2026-02-12. https://www.sec.gov/Archives/edgar/data/7623/000143774926003904/artw20251130_10k.htm
[8] SEC EDGAR, Verisk Analytics, Inc. Form 10-K for 2025, 2026-02-18. https://www.sec.gov/Archives/edgar/data/1442145/000143774926004452/vrsk20251231_10k.htm
[9] SEC EDGAR, Ryerson Holding Corp Form 10-K for 2025, 2026-02-23. https://www.sec.gov/Archives/edgar/data/1481582/000119312526062397/ryi-20251231.htm
[10] SEC EDGAR, Columbia Banking System, Inc. Form 10-K for 2025, 2026-02-26. https://www.sec.gov/Archives/edgar/data/887343/000088734326000088/colb-20251231.htm
[11] SEC EDGAR, T-Mobile US, Inc. Form 10-K for 2025, 2026-02-11. https://www.sec.gov/Archives/edgar/data/1283699/000128369926000010/tmus-20251231.htm
[12] SEC EDGAR, Diversified Energy Co Form 10-K for 2025, 2026-02-26. https://www.sec.gov/Archives/edgar/data/1922446/000192244626000020/dec-20251231.htm
[13] SEC EDGAR, Dave & Buster's Entertainment, Inc. Form 10-K for the fiscal year ended 2026-02-01, 2026-03-31. https://www.sec.gov/Archives/edgar/data/1525769/000152576926000008/play-20260203.htm
[14] SEC EDGAR, Charlotte's Web Holdings, Inc. Form 10-K for 2025, 2026-03-31. https://www.sec.gov/Archives/edgar/data/1750155/000175015526000029/cweb-20251231.htm
[15] SEC EDGAR, Zeo Energy Corp. Form 10-K for 2025, 2026-04-01. https://www.sec.gov/Archives/edgar/data/1865506/000121390026037791/ea0283937-10k_zeoenergy.htm

### AI credit scoring rules compared: Regulation B, SR 11-7, the EU AI Act and Colorado SB 24-205

URL: https://cfonews.ai/explainers/ai-credit-scoring-rules-compared
Published: 2026-11-12
Question: What regulations apply to AI used in credit scoring?
What Regulation B, SR 26-2 (which replaced SR 11-7), the EU AI Act and Colorado law ask of a lender using an AI credit model, and which ones lender 10-Ks name.

Four sets of rules apply to AI used in credit scoring, and only one of them reaches every U.S. creditor: Regulation B, which requires a creditor that takes adverse action on a scoring system's output to give "specific" reasons drawn from "those factors actually scored in the system."[1] The other three are narrower: the banking agencies' SR 26-2, which replaced SR 11-7 on 2026-04-17 and treats non-generative AI as a model; the EU AI Act, whose high-risk rules for scoring natural persons apply from 2 December 2027; and Colorado's SB26-189, signed 2026-05-14, which repealed and reenacted the state's 2024 AI law before its requirements took effect.[6][9][13]

The status of each document changed in the eighteen months to November 2026, and lenders' 10-Ks have not all caught up. This page sets out what each says, as of 2026-11-12, and counts how often fiscal 2025 lender 10-Ks name them. It describes the documents; it does not decide which of them reaches any particular lender or model.

## The question and the four documents

The plan for this page named SR 11-7, the Federal Reserve's 2011 model risk letter, as the second document. It no longer stands. SR 26-2, issued by the Fed with the FDIC and the OCC, "supersedes and replaces SR letter 11-7, Guidance on Model Risk Management (issued April 4, 2011)."[6] The comparison below uses the replacement, and the site's [SR 11-7 explainer](https://cfonews.ai/explainers/sr-11-7-explained-ai-models) covers the change section by section.

The four documents differ in kind before they differ in content. Regulation B is a federal regulation with a statute behind it, the Equal Credit Opportunity Act. SR 26-2 is supervisory guidance that says of itself it "does not set forth enforceable standards or prescriptive requirements."[7] The EU AI Act is a regulation of the European Union. Colorado's law is a state statute enforced by the state attorney general.[13]

## Regulation B: specific reasons for adverse action

Regulation B's duty starts with an event. A creditor must notify an applicant of action taken within 30 days after receiving a completed application, and within 30 days after taking adverse action on an existing account.[1] A notice of adverse action must be in writing and must contain either "A statement of specific reasons for the action taken" or a disclosure of the applicant's right to one.[1]

The reasons are where a scoring model meets the rule. Section 1002.9(b)(2) says the statement "must be specific and indicate the principal reason(s) for the adverse action," and rules out two answers a model's owner might reach for: "Statements that the adverse action was based on the creditor's internal standards or policies or that the applicant, joint applicant, or similar party failed to achieve a qualifying score on the creditor's credit scoring system are insufficient."[1]

The Official Interpretations go further for scoring systems. Comment 9(b)(2)-2 says the reasons "must relate to and accurately describe the factors actually considered or scored by a creditor."[1] Comment 9(b)(2)-4 says that when a denial rests on a credit scoring system, "the reasons disclosed must relate only to those factors actually scored in the system," that no principal reason may be left out, and that the creditor must disclose the actual reason "even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant."[1] Comment 9(b)(2)-5 leaves the method open: "The regulation does not require that any one method be used for selecting reasons," and it describes two methods based on comparing an applicant's score on each factor with average scores.[1] Comment 9(b)(2)-1 adds that "disclosure of more than four reasons is not likely to be helpful to the applicant."[1]

Regulation B also has a validation clause, older than any of the AI documents. Section 1002.2(p) defines a credit scoring system as one that "evaluates an applicant's creditworthiness mechanically," and to count as an empirically derived, demonstrably and statistically sound system it must be "Developed and validated using accepted statistical principles and methodology" and "Periodically revalidated by the use of appropriate statistical principles and methodology and adjusted as necessary to maintain predictive ability."[1] The status has a practical edge: in a system that meets the definition, section 1002.6(b)(2) allows a creditor to use an applicant's age as a predictive variable, "provided that the age of an elderly applicant is not assigned a negative factor or value."[1]

Two changes in 2025 and 2026 moved the ground around these sections. On 2025-05-12 the CFPB withdrew a long list of guidance documents, saying that "The withdrawals are applicable as of May 12, 2025."[3] The list includes Circular 2022-03, on credit decisions based on complex algorithms, and Circular 2023-03, on the proper use of the sample adverse action forms.[3] The 2022 circular had said that the notice requirements "apply equally to all credit decisions, regardless of the technology used to make them," and that ECOA and Regulation B "do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions."[4] Its page on consumerfinance.gov still carries that text with no withdrawal notice; the 2023 circular's page is marked "Archived content".[4][5] The regulation and its commentary, which the 2022 circular quoted, were not withdrawn and read as before.[1]

The second change is a rule. The CFPB's final rule of 2026-04-22, effective 2026-07-21, "amends provisions related to disparate impact, discouragement of applicants or prospective applicants, and special purpose credit programs under Regulation B."[2] Section 1002.6(a) now says that the Act does not provide that the "effects test" applies for determining whether there is discrimination in violation of the Act.[1] The rule's summary says the amendments "facilitate compliance with ECOA by clarifying the obligations imposed by the statute."[2]

## SR 26-2, which replaced SR 11-7: model definition, validation and governance

SR 26-2 applies to a model, defined as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates."[7] Simple spreadsheet arithmetic and deterministic rules with no such theory are excluded.[7] Its footnote 3 draws the AI line: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."[7] The same footnote says its principles "apply to traditional statistical and quantitative models and non-generative, non-agentic AI models."[7] A machine learning credit scorecard is a model by that text; a generative model that drafts a credit memo is not covered.

What it asks of a covered model is a model risk program, not a list of credit rules. Validation has three components in the text: conceptual soundness, outcomes analysis and ongoing monitoring.[7] Sound practice includes a model inventory with "sufficient information to understand model risks", and section VII says vendor and third-party products "can present unique challenges for validation."[7] The guidance is tailored by size: the letter says it is "most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve."[6] And it is not enforceable on its own terms, since "non-compliance with this guidance will not result in supervisory criticism against a banking organization."[7]

## EU AI Act Annex III: credit scoring of natural persons as high-risk

The EU AI Act names credit scoring directly. Annex III point 5(b) lists as high-risk "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud."[8] The Commission's own example for the category is "credit scoring denying citizens opportunity to obtain a loan."[10]

The test is the intended use and the subject. A system that scores companies is not scoring natural persons; a fraud model is carved out by name.[8] For systems inside point 5(b), the Commission lists the obligations: "Starting on 2 December 2027, high-risk AI systems will be subject to strict obligations before they can be put on the market," including risk assessment and mitigation, high-quality datasets "to minimise risks of discriminatory outcomes", logging, documentation, information to the deployer, human oversight and robustness.[10]

The date is the one that moved. Article 113, as amended by the Digital Omnibus on AI, now says the high-risk chapters apply from "2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III."[9] The Service Desk text is the consolidated version as at 27 July 2026.[9] The Commission says that from 2 August 2026 the AI Office and Member State authorities are responsible for implementing, supervising and enforcing the Act.[10] The site's explainer on [the EU AI Act and finance](https://cfonews.ai/explainers/eu-ai-act-credit-scoring-and-finance) covers the deployer duties in Article 26, including the provision for financial institutions.

## Colorado: SB 24-205, its delay and its replacement

Colorado's 2024 law never took effect in its original form. SB 24-205 was signed on 2024-05-17.[11] Its summary says that from 2026-02-01 a deployer of a high-risk system must use reasonable care against algorithmic discrimination, with a presumption of reasonable care for a deployer that implements a risk management policy and program, completes impact assessments, notifies consumers and offers an appeal "via human review if technically feasible."[11] It had a provision for banks: an examined bank or credit union "is in full compliance with the act" if its prudential regulator's published guidance on high-risk systems meets criteria in the act.[11]

In a special session the legislature passed SB25B-004, signed 2025-08-28, which "extends the effective date of the requirements of Senate Bill 24-205 to June 30, 2026."[12] Then on 2026-05-14, 47 days before that date, the governor signed SB26-189, session law chapter 131, effective the same day.[13] Its summary says: "The act repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions."[13]

The new act's trigger is broader in its words and narrower in its duties. A covered technology is one used to "materially influence" a consequential decision, and a consequential decision is "a decision that relates to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits."[13] Developers must give deployers technical documentation, including instructions for "appropriate use and human review", starting 2027-01-01.[13] Deployers must give notice at the point of interaction and "a plain language description of a covered ADMT's role within 30 days after the covered ADMT makes a consequential decision that results in an adverse outcome for the consumer."[13] Consumers may request "meaningful human review and reconsideration" after an adverse outcome.[13] The attorney general enforces it as a deceptive trade practice and, before 2030-01-01, must give 60 days' notice and a chance to cure.[13]

On lenders, the summary says only that "Specified entities are exempted from the requirements of the act to the extent the entities comply with other legal obligations."[13] The act's text is on the General Assembly's site as a PDF download, which its robots file closes to automated readers, so this page has not read which entities the exemption names.

## The four regimes side by side

[Table] Four regimes for an AI credit model, by trigger, duty, enforcer and status, each in the document's words. Document | What triggers it | What it asks of a lender using an AI credit model | Who enforces it | Status on 2026-11-12
Regulation B, 12 CFR part 1002 (eCFR, current to 2026-11-09) | Adverse action on an application or an existing account (§ 1002.9(a)(1)); a credit scoring system is one that evaluates creditworthiness “mechanically” (§ 1002.2(p)(1)) | A statement of specific reasons that “must be specific and indicate the principal reason(s)” (§ 1002.9(b)(2)); for a scoring system, reasons “must relate only to those factors actually scored” (Supplement I, 9(b)(2)-4); a statistically sound system must be validated and “Periodically revalidated” (§ 1002.2(p)(1)(iii), (iv)) | The federal agency named in the notice for each creditor (§ 1002.9(a)(2), (b)(1)); the CFPB writes the rule | In force. Final rule of 2026-04-22 (91 FR 21620), effective 2026-07-21, amended the disparate impact provisions. CFPB Circulars 2022-03 and 2023-03 on adverse action were withdrawn 2025-05-12 (90 FR 20084)
SR 26-2, Revised Guidance on Model Risk Management (Federal Reserve, FDIC, OCC) | A “model”: “a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates” | Development and testing, validation (conceptual soundness, outcomes analysis, ongoing monitoring), governance and an inventory; it applies to “non-generative, non-agentic AI models” and leaves generative and agentic models out (footnote 3) | The three banking agencies, as supervisory guidance that “does not set forth enforceable standards” | Issued 2026-04-17. It “supersedes and replaces SR letter 11-7” of 2011-04-04; “most relevant to banking organizations with over $30 billion in total assets”
Regulation (EU) 2024/1689, the AI Act, Annex III point 5(b) | AI systems “intended to be used to evaluate the creditworthiness of natural persons or establish their credit score”, except systems for detecting financial fraud | High-risk obligations: risk assessment and mitigation, dataset quality, logging, documentation, information to the deployer, human oversight, robustness and accuracy (European Commission summary) | The AI Office and Member State authorities, from 2 August 2026 | Annex III high-risk rules apply from 2 December 2027 (Article 113(c)(i), as amended by the Digital Omnibus on AI; consolidated text as at 27 July 2026)
Colorado SB 24-205, Consumer Protections for Artificial Intelligence, and SB26-189, Automated Decision-Making Technology | SB 24-205: a high-risk system that makes, or is a substantial factor in making, a consequential decision. SB26-189: technology used to “materially influence” a consequential decision, which includes “financial or lending services” | SB 24-205: reasonable care against algorithmic discrimination, a risk management policy, impact assessments, notice, appeal “via human review if technically feasible”. SB26-189: developer documentation from 2027-01-01, consumer notice, a plain language description within 30 days of an adverse outcome, a right to request meaningful human review | The Colorado attorney general, under the Colorado Consumer Protection Act | SB 24-205 signed 2024-05-17; its requirements moved to 2026-06-30 by SB25B-004 (signed 2025-08-28). SB26-189, signed 2026-05-14 (session law chapter 131), repeals and reenacts them. Banks examined under qualifying guidance were deemed compliant under SB 24-205; SB26-189's summary exempts specified entities “to the extent the entities comply with other legal obligations”

The documents ask three different things of the same model. Regulation B asks for an explanation an applicant can read, tied to the factors the model scored.[1] SR 26-2 asks for a program around the model: validation, monitoring, inventory, governance.[7] The EU AI Act and Colorado's act ask for both, and add disclosure to the consumer and a route to human review.[10][13]

[Diagram] One credit decision, four tests: the question each document asks before it applies. 1: Regulation B: was adverse action taken?. A creditor that denies an application, or takes adverse action on an existing account, owes the applicant a statement of specific reasons, the principal ones, within 30 days of a completed application. When the decision rests on a credit scoring system, the reasons must be factors the system actually scored. 2: SR 26-2: is the tool a model at a supervised bank?. A complex quantitative method that applies statistical, economic or financial theories to input data to produce quantitative estimates is a model. The guidance covers traditional models and non-generative, non-agentic AI models, and is most relevant above $30 billion in total assets. 3: EU AI Act: is it creditworthiness of a natural person?. Annex III point 5(b) lists AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, except systems used to detect financial fraud. The high-risk rules apply from 2 December 2027. 4: Colorado: does it materially influence a consequential decision?. SB26-189 covers automated decision-making technology used to materially influence a decision on an individual's access to, among other things, financial or lending services. Developers owe deployers documentation from 2027-01-01; deployers owe notice, an explanation after an adverse outcome and a route to human review.

## Which regimes lenders name in their 10-Ks

EDGAR full-text search was run on 10-Ks filed 2025-07-01 to 2026-06-30, one phrase and one calendar month at a time, paged to the end.[14] A hit counts when the filer's first SIC code on EDGAR is one of the five the plan names: 6021 and 6022 (national and state commercial banks), 6141 (personal credit institutions), 6153 (short-term business credit) and 6199 (finance services). The denominator is every lender 10-K the search found in the window, 398 filings: 265 from banks and 133 from the other codes.[14] SIC 6199, finance services, is a mixed code, and not every filer under it lends.[14]

[Figure] 259 of 398 lender 10-Ks for fiscal 2025 name Regulation B or ECOA; 13 name the EU AI Act, 2 the Colorado AI Act, 1 SR 11-7. Lender 10-Ks by Regime named. Lender 10-Ks naming the regime: Regulation B or ECOA 259, SR 11-7 or SR 26-2 1, EU AI Act 13, Colorado AI Act 2. Distinct 10-K filings filed 2025-07-01 to 2026-06-30 by filers whose first SIC code on EDGAR is 6021, 6022, 6141, 6153 or 6199, whose text names any of the regime's phrases. A mention anywhere in the filing counts once.

Regulation B or the Equal Credit Opportunity Act appears in 259 of the 398 filings (65.1%).[14] The AI-specific laws are rare: the EU AI Act in 13 filings (3.3%) and the Colorado AI Act, by name, in 2.[14] For comparison, 326 of the 398 (81.9%) use the phrase "artificial intelligence" somewhere.[14] SR 11-7 or SR 26-2 appears in one: Westamerica Bancorporation's 10-K says its interest rate model "is periodically assessed using supervisory guidance issued by the Board of Governors of the Federal Reserve System, SR 11-7".[16] That use is for an interest rate model, not a credit model. None names SR 26-2, and only 6 of the 398 were filed after it was issued.[14]

The Colorado count is by the act's name, and it undercounts the state. American Express's 10-K names "AI legislation in several U.S. states (e.g., in California, Colorado and Utah)"; Northern Trust's says Colorado and California "have passed or are continuing to propose laws and regulations that govern various facets and uses of AI, including consequential decisions"; neither names the act, so neither is in the 2.[20][19] Of the two that do, ProCap Financial's 10-K, filed 2026-02-18, says the act "goes into effect in June 2026"; three months later SB26-189 replaced it.[17][13] Pagaya's 10-K, filed 2026-03-02, says the EU AI Act and the Colorado AI Act "impose strict requirements on "high-risk" AI systems."[18]

[Figure] Banks name Regulation B; the EU and Colorado AI laws appear mostly in the 10-Ks of other lenders and finance companies. Regime named by Lender 10-Ks. Banks (SIC 6021, 6022): Regulation B or ECOA 223, SR 11-7 or SR 26-2 1, EU AI Act 2, Colorado AI Act 0. Other lenders and finance companies (SIC 6141, 6153, 6199): Regulation B or ECOA 36, SR 11-7 or SR 26-2 0, EU AI Act 11, Colorado AI Act 2. The same counts split by filer type. Banks are SIC 6021 and 6022 (265 of the 398 filings); the rest are SIC 6141, 6153 and 6199 (133).

The split by filer type is the clearest pattern. Banks account for 223 of the 259 Regulation B mentions: 223 of the 265 bank 10-Ks in the window (84.2%) name it, against 36 of the 133 from the other codes.[14] The EU AI Act runs the other way: 11 of its 13 mentions come from the non-bank codes, and both Colorado mentions do.[14]

A narrower search finds where the adverse action rule meets AI in the filings. The phrase "adverse action notice" or "adverse action notices" appears in 11 lender 10-Ks; each was read on sec.gov, and in 8 a sentence naming adverse action also names AI, a model or an algorithm, citing the CFPB in each case.[14] Six of the 8 share one sentence. Associated Banc-Corp's version sits under an "Artificial Intelligence" heading:

[Excerpt] "Artificial Intelligence CFPB and other federal regulatory guidance reiterates that creditors are not excused from the adverse action notice requirements under ECOA if they rely on complex algorithmic underwriting models" (https://www.sec.gov/Archives/edgar/data/7789/000000778926000071/asb-20251231.htm)

The sentence is accurate about the regulation and dated about the guidance.[15][3][1] Unity Bancorp's 10-K puts it more cautiously, saying regulators "have provided guidance that creditors may be subject to adverse action notice requirements under the Equal Credit Opportunity Act even if they rely on algorithmic underwriting models."[25]

## What the Fed speakers said about AI in credit

The Federal Reserve's governors have spoken about AI in lending several times since 2024, and the site's [Federal Reserve tracker](https://cfonews.ai/regulation/federal-reserve) lists each speech.

Governor Michelle W. Bowman, 2024-11-22: "Another often-discussed use case for AI in financial services is in expanding the availability of credit."[21] In the same speech she said AI "can also pose model risks in the banking context, with associated data management and governance concerns," and that "its use must comply with current laws and regulations, including fair lending, cyber security, data privacy, third-party risk management, and copyright."[21]

Governor Michael S. Barr, 2025-04-04: "Gen AI has benefits for document analysis, which could be applied to improve credit underwriting."[22]

Governor Barr again, 2025-11-11, noting that "in 1997, Governor Susan Phillips delivered a speech noting the use of AI in consumer loan underwriting."[23] He said that "Data-driven financial-sector-specific tasks, including credit decision support, fraud detection, and trading are using AI-specific tools," and: "We need to reduce the risk that AI reinforces biases in consumer lending."[23]

The OCC, the third agency behind SR 26-2, has no speech on the subject in the site's regulation table. The GAO's 2025 report on AI in financial services gives the oversight picture from outside the agencies: regulators "primarily oversee AI using existing laws, regulations, guidance, and risk-based examinations," and "some regulators have issued AI-specific guidance, such as on AI use in lending."[24] It lists "potentially biased lending decisions" among the risks.[24] The report and its recommendation status are in the site's [GAO tracker](https://cfonews.ai/regulation/gao).

The counts on this page are recomputed from the saved search results by scripts/cfonews-ai/articles/credit-rules.mjs, which also reads the adverse action passages and prints each figure quoted above.

Sources:
[1] Electronic Code of Federal Regulations, 12 CFR part 1002 (Regulation B) with Supplement I, Official Interpretations, as current to 2026-11-09, 2026-11-09. https://www.ecfr.gov/current/title-12/chapter-X/part-1002
[2] Federal Register, Consumer Financial Protection Bureau, Equal Credit Opportunity Act (Regulation B), final rule, 91 FR 21620, 2026-04-22. https://www.federalregister.gov/documents/2026/04/22/2026-07804/equal-credit-opportunity-act-regulation-b
[3] Federal Register, Consumer Financial Protection Bureau, Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, 90 FR 20084, 2025-05-12. https://www.federalregister.gov/documents/2025/05/12/2025-08286/interpretive-rules-policy-statements-and-advisory-opinions-withdrawal
[4] Consumer Financial Protection Bureau, Consumer Financial Protection Circular 2022-03, Adverse action notification requirements in connection with credit decisions based on complex algorithms, 2022-05-26. https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/
[5] Consumer Financial Protection Bureau, Consumer Financial Protection Circular 2023-03, page marked archived content, 2023-09-19. https://www.consumerfinance.gov/compliance/circulars/circular-2023-03-adverse-action-notification-requirements-and-the-proper-use-of-the-cfpbs-sample-forms-provided-in-regulation-b/
[6] Federal Reserve Board, SR letter 26-2, Revised Guidance on Model Risk Management, 2026-04-17. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
[7] Federal Reserve Board, FDIC and OCC, Supervisory Guidance on Model Risk Management, attachment to SR letter 26-2, 2026-04-17. https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf
[8] European Commission, AI Act Service Desk, Annex III, High-Risk AI Systems Referred to in Article 6(2), consolidated text as at 27 July 2026, 2026-07-27. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
[9] European Commission, AI Act Service Desk, Article 113, Entry into force and application, consolidated text as at 27 July 2026, 2026-07-27. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113
[10] European Commission, AI Act, Shaping Europe's digital future, last updated 19 October 2026, 2026-10-19. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
[11] Colorado General Assembly, SB24-205, Consumer Protections for Artificial Intelligence, bill page and summary as enacted, 2024-05-17. https://leg.colorado.gov/bills/sb24-205
[12] Colorado General Assembly, SB25B-004, Increase Transparency for Algorithmic Systems, bill page and summary as enacted, 2025-08-28. https://leg.colorado.gov/bills/sb25b-004
[13] Colorado General Assembly, SB26-189, Automated Decision-Making Technology, bill page and summary as enacted, session law chapter 131, 2026-05-14. https://leg.colorado.gov/bills/sb26-189
[14] SEC EDGAR full-text search, form 10-K, filed 2025-07-01 to 2026-06-30, filers with SIC code 6021, 6022, 6141, 6153 or 6199, phrases naming Regulation B or ECOA, SR 11-7 or SR 26-2, the EU AI Act and the Colorado AI Act, and the phrases "artificial intelligence" and "adverse action notice, 2026-11-12. https://efts.sec.gov/LATEST/search-index?q=%22Regulation%20B%22&forms=10-K
[15] SEC EDGAR, Associated Banc-Corp Form 10-K for 2025, 2026-02-12. https://www.sec.gov/Archives/edgar/data/7789/000000778926000071/asb-20251231.htm
[16] SEC EDGAR, Westamerica Bancorporation Form 10-K for 2025, 2026-02-27. https://www.sec.gov/Archives/edgar/data/311094/000117184326001195/wabc20251231_10k.htm
[17] SEC EDGAR, ProCap Financial, Inc. Form 10-K for 2025, 2026-02-18. https://www.sec.gov/Archives/edgar/data/2076163/000149315226007352/form10-k.htm
[18] SEC EDGAR, Pagaya Technologies Ltd. Form 10-K for 2025, 2026-03-02. https://www.sec.gov/Archives/edgar/data/1883085/000188308526000018/pgy-20251231.htm
[19] SEC EDGAR, Northern Trust Corp Form 10-K for 2025, 2026-02-24. https://www.sec.gov/Archives/edgar/data/73124/000007312426000016/ntrs-20251231.htm
[20] SEC EDGAR, American Express Co Form 10-K for 2025, 2026-02-06. https://www.sec.gov/Archives/edgar/data/4962/000000496226000080/axp-20251231.htm
[21] Federal Reserve Board, Governor Michelle W. Bowman, Artificial Intelligence in the Financial System, 2024-11-22. https://www.federalreserve.gov/newsevents/speech/bowman20241122a.htm
[22] Federal Reserve Board, Governor Michael S. Barr, AI, Fintechs, and Banks, 2025-04-04. https://www.federalreserve.gov/newsevents/speech/barr20250404a.htm
[23] Federal Reserve Board, Governor Michael S. Barr, AI and Central Banking, 2025-11-11. https://www.federalreserve.gov/newsevents/speech/barr20251111a.htm
[24] U.S. Government Accountability Office, GAO-25-107197, Artificial Intelligence, Use and Oversight in Financial Services, 2025-05-19. https://www.gao.gov/products/gao-25-107197
[25] SEC EDGAR, Unity Bancorp, Inc. Form 10-K for 2025, 2026-03-04. https://www.sec.gov/Archives/edgar/data/920427/000092042726000012/unty-20251231x10k.htm

### AI governance in finance: what 10-K and proxy filers disclose on policies, committees, owners and frameworks

URL: https://cfonews.ai/explainers/ai-governance-in-finance-filings
Published: 2026-11-12
Question: How are public companies governing AI in finance?
A seeded sample of 300 10-Ks and proxy statements that name AI, coded for an AI policy, board oversight, a committee, an owner by title and a named framework.

Public companies are governing AI in finance mostly through their boards, and their filings say little about the controls underneath: in a seeded sample of 150 DEF 14A proxy statements that name artificial intelligence, 48 assign oversight of AI to the board or a board committee, while 13 describe an AI policy, 8 a management committee or council and 5 an executive owner by title.[1] The 10-Ks say less, with 16 of 150 sampled annual reports disclosing any of those elements, and none of the 300 filings describes validating an AI model.[1]

The counts come from reading each filing on sec.gov and coding it by published rules, then checking every match by hand. They measure what companies chose to write in two documents, not what they run. A company with a mature AI program may describe none of it in a 10-K; a company that wrote one line about an acceptable use policy counts the same as one that described a committee, a charter and a reporting line.

## What governance means in the regulators' documents

Three documents written for the financial sector set out what AI governance looks like, and none of them is addressed to a public company's annual report.

FINRA's 2026 Annual Regulatory Oversight Report, published 2025-12-09, has a section on generative AI that is new for the year. It says FINRA's rules, "which are intended to be technologically neutral", continue to apply when firms use GenAI "just as they apply when firms use any other technology or tool."[2] Under Supervision & Governance it lists "Establishing a supervision, governance or model risk management framework that establishes clear policies and procedures to develop, implement, use and monitor GenAI, while maintaining comprehensive documentation throughout."[2] It also names "formal review and approval processes" staffed by "both business and technology experts", robust testing, and monitoring that may include "validation and human-in-the-loop review of model outputs, including performing regular checks for errors or bias."[2] Its list of additional resources ends with the NIST AI Risk Management Framework (AI RMF 1.0) of January 2023.[2]

The U.S. Treasury's report on AI in financial services, announced on 2024-12-19, summarized 103 comment letters on its request for information and recommended next steps.[3] One of them is a governance step in plain terms: that "Financial firms prioritize their review of AI use cases for compliance with existing laws and regulations before deployment and that they periodically reevaluate compliance as needed."[3] Another asks for collaboration "to promote consistent and robust standards for uses of AI in the financial services sector."[3]

The Federal Reserve has no rule on AI governance for issuers, but its governors have described one. Governor Lisa D. Cook said on 2025-07-17 that "A central tenet of good governance should be the mindset that humans are in the loop, because it ensures that people guide AI rather than allow AI to guide us."[4] On 2026-05-27 she concluded that "alongside experimentation, strong governance and risk management must be our foundation."[19]

The plan for this article named a fourth document, IOSCO's AI Supervisory Toolkit of 2026-05-25. IOSCO's site refused the request when this article was researched on 2026-11-12, so the toolkit is not quoted here; its entry is in the site's [IOSCO tracker](https://cfonews.ai/regulation/iosco), with FINRA's documents in the [FINRA tracker](https://cfonews.ai/regulation/finra) and Treasury's in the [Treasury tracker](https://cfonews.ai/regulation/treasury).

## Method: the sample and the codebook

The frame is every filing that EDGAR full-text search returns for the phrase "artificial intelligence" in two windows, searched one calendar month at a time and paged to the end.[1] For 10-Ks the window is 2025-07-01 to 2026-06-30, the twelve months that hold fiscal 2025 annual reports; it returned 4,032 documents, and after keeping main documents only (no amendments) and one filing per filer, 3,842 filers. For proxy statements the window is 2025-01-01 to 2026-11-11, so it covers two proxy seasons; it returned 2,726 documents from 1,645 filers.[1]

From each frame a seeded random draw took 150 filers (seed 20261112 for 10-Ks, 20261113 for proxies). Each main document was read on sec.gov and split into sentences; the sentences that name artificial intelligence, generative AI, GenAI, machine learning, AI or agentic were kept. Five of the 10-Ks and 25 of the proxies had no such sentence the reader could isolate in the main document, usually because the AI mention sat in a table, an exhibit or a PDF; they stay in the denominator.[1]

Five governance elements were coded, each present when any AI sentence matches its rule:

- **Policy.** An AI policy, acceptable use policy, guidelines or principles of the filer's own.
- **Board oversight.** The board or a board committee oversees, reviews or is responsible for AI, tested on the 250 characters either side of each AI term, because proxy statements list committee duties without full stops.
- **Committee.** A management committee, council, working group or center of excellence for AI.
- **Owner.** An executive named by title who leads, chairs, heads or reports to the board on AI.
- **Framework.** A named AI framework or standard: the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 23894 or the OECD AI Principles.

The rules were written to find candidates. A reader then opened every match and removed the false ones: a Utah statute called the Artificial Intelligence Policy Act, a federal "task force" in an executive order, a director's award, sentences that begin "if we are unable to develop" a policy. The reader also added a handful of passages the patterns missed, such as a proxy that says its committee "oversees the Company’s artificial intelligence governance framework". Each decision is recorded with its reason in the site's research file, and the script applies them before counting.

## How many filers disclose each element

[Figure] Board oversight of AI appears in 48 of 150 sampled proxy statements; every other element appears in 13 or fewer filings of either form. Share of sampled filings by Governance element. 10-K: An AI policy or guidelines of its own 5.3%, Board or board-committee oversight of AI 0.7%, A management committee, council or working group for AI 2.7%, An executive owner, named by title 0.7%, A named AI framework or standard 2%. DEF 14A proxy: An AI policy or guidelines of its own 8.7%, Board or board-committee oversight of AI 32%, A management committee, council or working group for AI 5.3%, An executive owner, named by title 3.3%, A named AI framework or standard 0%. Share of the sampled filings in which at least one sentence naming AI matches the element's rule, after a reader checked every match. 150 10-Ks filed 2025-07-01 to 2026-06-30 and 150 DEF 14A proxies filed 2025-01-01 to 2026-11-11, each from a different filer, drawn from full-text hits for "artificial intelligence".

The two forms tell different parts of the story. Proxy statements are where boards describe their own work, and 48 of the 150 sampled proxies, 32.0%, say the board or one of its committees oversees AI.[1] The 10-Ks rarely say it: 1 of 150. That one is Groupon's, which reported that its board established an Artificial Intelligence Committee "to provide focused Board-level oversight of the Company's artificial intelligence strategy and related risks and opportunities."[10]

Below board oversight the numbers fall fast. An AI policy of the filer's own appears in 13 proxies (8.7%) and 8 10-Ks (5.3%); a management committee or council in 8 proxies and 4 10-Ks; an executive owner by title in 5 proxies and 1 10-K.[1] Counted either way, 49 of the 150 proxies (32.7%) and 16 of the 150 10-Ks (10.7%) disclose at least one of the five elements.[1]

The policy statements are mostly one sentence long. BitGo's 10-K says: "We have adopted an internal AI Acceptable Use Policy, which establishes guidelines for the responsible and secure use of AI technologies within BitGo."[16] Smith & Wesson's proxy goes further in one respect, with a policy for directors: "We maintain an artificial intelligence use policy for the Board."[22]

The committees are described with more detail. Upbound Group's 10-K says it formed a "Data and AI Governance Committee, which includes company executives, to address the risks of AI-based technology use on an ongoing basis", meeting quarterly.[17] Two of the 12 bodies found in the sample are described as reviewing or approving use cases, the step Treasury recommended: LXP Industrial Trust's committee and Portland General Electric's management committee, which "reviews use cases and establishes guidelines on AI governance, use of data and privacy."[8][21]

The owners are named by title only, and the titles vary. In the sample they are a General Counsel (LXP), a Chief Technology Officer (nVent), a Corporate Vice President for AI and data engineering (Motorola Solutions), a Chief Compliance Officer on a committee (Synchronoss), a Senior Vice President and Chief Information Officer who reports to the audit committee (SBA Communications), and in a 10-K a Chief Digital & AI Officer (eHealth).[1] Synchronoss described an AI Governance Committee made up of its Chief Compliance Officer, a governance, risk and compliance director and two vice presidents, for procurement and engineering, set up "to oversee and enforce the AI Governance policy."[20] No sampled filing names a Chief AI Officer.[1]

[Figure] Across sectors, about a quarter of sampled filings disclose at least one AI governance element; utilities, transport and mining trail. Share of sampled filings by SIC division. Discloses at least one element: Wholesale and retail trade 28.6%, Finance, insurance, real estate 26.8%, Manufacturing 24.8%, Services 23.6%, Transportation, communications, utilities 11.1%, Agriculture, mining, construction 0%. Both forms together, by the SIC division of the filer's first SIC code on EDGAR. A filing counts when it discloses any of the five elements. Divisions with fewer than 10 sampled filings are left out.

The sector split is flatter than the form split. Wholesale and retail trade (4 of 14), finance, insurance and real estate (19 of 71), manufacturing (26 of 105) and services (13 of 55) all fall between 23.6% and 28.6%; transportation, communications and utilities reach 3 of 27 and agriculture, mining and construction 0 of 12.[1] The finance group is not ahead. Of its 71 filings, 20 come from banks, and 2 of those disclose an element: Capital One's 10-K, on policies, and First Financial Bancorp's proxy, on board oversight.[1] The sample is small at the division level, so a difference of a few filings moves a bar by several points.

## Frameworks named, and how often

The framework count is not taken from the sample. Full-text search was run over both whole windows for each framework's phrases, so these are every filing that names one.[1]

[Figure] The NIST AI Risk Management Framework is named in 21 10-Ks and 22 proxy filings; ISO/IEC 42001 in 8 and 9. Filings naming it by Framework or standard. 10-Ks: NIST AI Risk Management Framework 21, ISO/IEC 42001 8, ISO/IEC 23894 0, OECD AI Principles 1. DEF 14A proxies: NIST AI Risk Management Framework 22, ISO/IEC 42001 9, ISO/IEC 23894 0, OECD AI Principles 4. Every 10-K and DEF 14A in the two windows whose text names the framework, by EDGAR full-text search, counted by accession number. Not a sample. ISO/IEC 23894 is named in none.

The NIST AI Risk Management Framework appears in 21 10-Ks and 22 proxy filings, which come from 17 filers because five companies named it in both proxy seasons.[1] ISO/IEC 42001, the management-system standard for AI, appears in 8 10-Ks and 9 proxies; the OECD AI Principles in 1 10-K and 4 proxies; ISO/IEC 23894 in none.[1] Against 3,842 10-K filers and 1,645 proxy filers that name artificial intelligence in those windows, frameworks are a rare disclosure.

What the filers say about a framework also varies. Horace Mann Educators, an insurer, wrote that "we have considered elements of the National Institute of Standards and Technology (NIST) AI Risk Management Framework and evolving regulatory expectations as reference points in shaping our approach."[7] Paycom reported a certification: "In November 2025, we obtained a certification based on ISO/IEC 42001:2023 criteria".[9] Tandy Leather Factory folded the AI framework into its cybersecurity program: "We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework)."[18] Considering, certifying and designing against a framework are three different claims, and a count of names treats them alike.

## Finance-specific controls named

Four finance-specific measures were coded on the same sentences, and three of them are close to empty.

- **Model validation or model risk management of AI**, in a sentence without "may", "could", "might", "if" or a law's requirement: 0 of 300.[1]
- **Human review of AI output, as a control the filer runs**, on the same test: 1 of 300, and it describes a product pipeline rather than a finance process.[1]
- **AI used in accounting, the close or financial reporting**: 1 of 300.[1]
- **AI oversight given to the audit committee**: 24 of the 150 proxies, and none of the 10-Ks.[1]

The hedge test matters because the words appear often in risk factors. Several 10-Ks name "human oversight" only to say that a law may require it or that its absence could cause harm. Capital One's 10-K mentions validation in the same way, in a risk factor saying its results depend on "our policies, programs, processes and practices governing how data, models and AI are acquired, validated, stored, protected, processed and analyzed".[15] That is a statement that such policies exist and could fail, not a description of a validation step.

The one filing that names AI in financial reporting is Armour Residential REIT's 10-K: "We, our manager, or third-party service providers use, and may continue to use, artificial intelligence (“AI”) in certain business processes, including but not limited to data analysis, investment modeling, risk management, financial reporting, and cybersecurity."[14] The filing does not say what the AI does in reporting or who reviews it.

The audit committee is the finance-specific finding. In 24 proxies AI oversight sits with the committee that also oversees financial reporting, internal control and the external auditor.[1] Two charters tie the two together in words. SI-BONE's audit committee is responsible for "reviewing our guidelines and policies with respect to financial and information security risk management and the use of artificial intelligence impacting financial reporting and internal controls."[12] Accendra Health's audit committee oversees "Artificial intelligence (“AI”) applications and AI’s impact on financial reporting".[13] Motorola Solutions' proxy says its board "has delegated to the Audit Committee the responsibility to oversee risks related to AI as part of our enterprise risk management program", and that the board and the committee receive updates on AI from, among others, "our executive finance team."[11]

For a CFO this places AI on the audit committee's agenda at a growing number of companies, with the controls behind it undisclosed. The site's explainer on [AI and internal control over financial reporting](https://cfonews.ai/explainers/ai-and-internal-control) collects what 10-K filers say about AI in their controls sections.

## Excerpts by element

Two 10-K passages show what a disclosure looks like when it carries more than one element. Gallagher's sits in its risk factors:

[Excerpt] "We have internal policies and controls governing development, procurement, deployment and the use of AI by our employees designed to align with globally recognized AI principles" (https://www.sec.gov/Archives/edgar/data/354190/000162828026008662/ajg-20251231.htm)

The sentence that follows in the same 10-K says employees "could violate these policies", which is why the disclosure sits among the risk factors.[5] Matthews International's passage sits in its cybersecurity item:

[Excerpt] "Matthews has also established a cross-functional Artificial Intelligence ("AI") Council ... The Matthews AI Council includes key members of its IT and legal functions, including its Chief Information Security Officer" (https://www.sec.gov/Archives/edgar/data/63296/000006329625000070/matw-20250930.htm)

The 10-K adds that the council "serves as an extension of its cybersecurity program with a specific focus on artificial intelligence systems."[6] The governance home for AI in both passages is risk and security, not the finance function.

The proxy that carries the most elements in the sample is LXP Industrial Trust's. It says that "In 2025, LXP adopted a formal Artificial Intelligence Policy governing the use of AI tools across the organization, which was updated in 2026," that the policy establishes an AI Governance Committee "chaired by the General Counsel, which is responsible for evaluating and approving AI use cases, managing associated risks, and ensuring compliance with LXP's security and data protection standards," and that the committee reports to the board's audit and risk committee "on a quarterly basis on the status of approved use cases, any incidents or policy violations, and the results of vendor security assessments."[8] Policy, committee, owner by title and board oversight are all there; a named framework is not.

## Where the regulators' expectations and filers' disclosures meet

[Table] What FINRA, Treasury and a Fed governor ask for, next to the element filers disclose. What the document says, quoted | Source and date | The filer element it matches | Sampled filings that disclose it
“Establishing a supervision, governance or model risk management framework that establishes clear policies and procedures to develop, implement, use and monitor GenAI” | FINRA, 2026 Annual Regulatory Oversight Report, GenAI section, Supervision & Governance (2025-12-09) | An AI policy or guidelines of its own | 8 of 150 10-Ks; 13 of 150 proxies
“Implementing formal review and approval processes to assess and evaluate GenAI opportunities”, with “both business and technology experts” | FINRA, 2026 report, GenAI section (2025-12-09) | A management committee, council or working group for AI | 4 of 150 10-Ks; 8 of 150 proxies
“validation and human-in-the-loop review of model outputs, including performing regular checks for errors or bias” | FINRA, 2026 report, GenAI section, Monitoring (2025-12-09) | Model validation of AI, or human review run as a control | Validation: none of 300. Human review: 1 10-K
“Financial firms prioritize their review of AI use cases for compliance with existing laws and regulations before deployment” | U.S. Treasury, press release on its AI in financial services report (2024-12-19) | A body that reviews or approves AI use cases | 2 of the 12 bodies found are described as reviewing or approving use cases
“promote consistent and robust standards for uses of AI in the financial services sector” | U.S. Treasury, press release on its AI in financial services report (2024-12-19) | A named AI framework or standard | 3 of 150 10-Ks; 0 of 150 proxies
“A central tenet of good governance should be the mindset that humans are in the loop” | Federal Reserve Governor Lisa D. Cook, AI: A Fed Policymaker's View (2025-07-17) | Human review run as a control | 1 of 300
Neither the FINRA section nor the Treasury release, as read, assigns AI oversight to a board | FINRA (2025-12-09); Treasury (2024-12-19) | Board or board-committee oversight of AI | 1 of 150 10-Ks; 48 of 150 proxies

Read side by side, the documents and the filings meet on policies and committees and part at the two places closest to finance work.

FINRA's first governance item, a framework with "clear policies and procedures", is the element most often disclosed after board oversight, and still by fewer than 1 in 10 sampled filings of either form.[2][1] Its review-and-approval process matches the committees, and the two committees that approve or review use cases match Treasury's recommendation that firms review AI use cases before deployment.[2][3][8][21] FINRA lists the NIST AI RMF as a resource; 43 filings across both windows name it.[2][1]

The monitoring items are where the filings go quiet. FINRA's "validation and human-in-the-loop review of model outputs" and Governor Cook's "humans are in the loop" have no counterpart in the sample beyond one product pipeline.[2][4][1] And the element filers disclose most, board oversight, is one that neither the FINRA section nor Treasury's release addresses.[2][3]

The sample and the codebook are in the site's repository; the figures are recomputed from the saved research files by scripts/cfonews-ai/articles/governance.mjs, which also prints each count quoted above.

Sources:
[1] SEC EDGAR full-text search, phrase "artificial intelligence", 10-Ks filed 2025-07-01 to 2026-06-30 and DEF 14A proxy statements filed 2025-01-01 to 2026-11-11, with a seeded sample of 150 filers per form read on sec.gov, and the framework phrases over the same windows, 2026-11-12. https://efts.sec.gov/LATEST/search-index?q=%22artificial%20intelligence%22&forms=10-K,DEF%2014A
[2] FINRA, 2026 Annual Regulatory Oversight Report, GenAI, Continuing and Emerging Trends, 2025-12-09. https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai
[3] U.S. Department of the Treasury, press release on its report on the uses, opportunities and risks of AI in financial services, 2024-12-19. https://home.treasury.gov/news/press-releases/jy2760
[4] Federal Reserve Board, Governor Lisa D. Cook, AI, A Fed Policymaker's View, 2025-07-17. https://www.federalreserve.gov/newsevents/speech/cook20250717a.htm
[5] SEC EDGAR, Arthur J. Gallagher & Co. Form 10-K for 2025, 2026-02-17. https://www.sec.gov/Archives/edgar/data/354190/000162828026008662/ajg-20251231.htm
[6] SEC EDGAR, Matthews International Corp Form 10-K for the fiscal year ended 2025-09-30, 2025-11-21. https://www.sec.gov/Archives/edgar/data/63296/000006329625000070/matw-20250930.htm
[7] SEC EDGAR, Horace Mann Educators Corp Form 10-K for 2025, 2026-02-27. https://www.sec.gov/Archives/edgar/data/850141/000085014126000007/hmn-20251231.htm
[8] SEC EDGAR, LXP Industrial Trust proxy statement (DEF 14A), 2026-04-03. https://www.sec.gov/Archives/edgar/data/910108/000091010826000015/lxp-20260403.htm
[9] SEC EDGAR, Paycom Software, Inc. Form 10-K for 2025, 2026-02-19. https://www.sec.gov/Archives/edgar/data/1590955/000119312526059372/payc-20251231.htm
[10] SEC EDGAR, Groupon, Inc. Form 10-K for 2025, 2026-03-10. https://www.sec.gov/Archives/edgar/data/1490281/000162828026016429/grpn-20251231.htm
[11] SEC EDGAR, Motorola Solutions, Inc. proxy statement (DEF 14A), 2025-03-27. https://www.sec.gov/Archives/edgar/data/68505/000119312525064714/d703432ddef14a.htm
[12] SEC EDGAR, SI-BONE, Inc. proxy statement (DEF 14A), 2026-04-21. https://www.sec.gov/Archives/edgar/data/1459839/000145983926000049/sibn-20260420.htm
[13] SEC EDGAR, Accendra Health Inc. proxy statement (DEF 14A), 2026-04-02. https://www.sec.gov/Archives/edgar/data/75252/000110465926038823/ach-20260514xdef14a.htm
[14] SEC EDGAR, Armour Residential REIT, Inc. Form 10-K for 2025, 2026-02-18. https://www.sec.gov/Archives/edgar/data/1428205/000142820526000029/arr-20251231.htm
[15] SEC EDGAR, Capital One Financial Corp Form 10-K for 2025, 2026-02-19. https://www.sec.gov/Archives/edgar/data/927628/000092762826000024/cof-20251231.htm
[16] SEC EDGAR, BitGo Holdings, Inc. Form 10-K for 2025, 2026-03-27. https://www.sec.gov/Archives/edgar/data/1740604/000174060426000020/btgo-form10xk.htm
[17] SEC EDGAR, Upbound Group, Inc. Form 10-K for 2025, 2026-02-23. https://www.sec.gov/Archives/edgar/data/933036/000093303626000008/upbd-20251231.htm
[18] SEC EDGAR, Tandy Leather Factory, Inc. Form 10-K for 2025, 2026-02-24. https://www.sec.gov/Archives/edgar/data/909724/000114036126006550/ef20060825_10k.htm
[19] Federal Reserve Board, Governor Lisa D. Cook, The Opportunities and Risks AI Presents for the Economy and Financial System, 2026-05-27. https://www.federalreserve.gov/newsevents/speech/cook20260527a.htm
[20] SEC EDGAR, Synchronoss Technologies, Inc. proxy statement (DEF 14A), 2025-04-29. https://www.sec.gov/Archives/edgar/data/1131554/000114036125016310/ny20042304x1_def14a.htm
[21] SEC EDGAR, Portland General Electric Co proxy statement (DEF 14A), 2025-03-05. https://www.sec.gov/Archives/edgar/data/784977/000078497725000055/por-20250304.htm
[22] SEC EDGAR, Smith & Wesson Brands, Inc. proxy statement (DEF 14A), 2026-08-06. https://www.sec.gov/Archives/edgar/data/1092796/000119312526338441/swbi-20260806.htm

### Agentic AI in banking: what bank 10-Ks and 10-Qs tell the SEC about AI agents, and what the Fed has said

URL: https://cfonews.ai/explainers/agentic-ai-in-banking-filings-fed
Published: 2026-11-11
Question: What are banks telling the SEC about agentic AI?
Bank 10-K and 10-Q filings that name agentic AI or AI agents, counted by quarter and coded by context, set beside Governor Waller's speech on AI agents.

Banks are telling the SEC about agentic AI mostly as a risk and a change in their industry, and only rarely as something they run: of the 40 bank 10-K and 10-Q filings that name agentic AI or AI agents and could be read and coded, 7 describe the bank's own use or evaluation, 17 a risk and 16 an industry trend.[1] The words arrived late in bank filings, with 4 bank 10-Ks and 10-Qs in all of 2025 and 27 in the first quarter of 2026, against 294 filings of every kind that used “agentic” in that one quarter.[1]

The Federal Reserve’s most direct statement on the subject came from Governor Christopher J. Waller on 2026-09-29, who described two models of “agentic commerce” and called trust between buyers and sellers “the biggest barrier” to scaling it.[2] The supervisory guidance on models issued in April 2026 leaves agentic AI out of its scope altogether.[11]

## Where the term first appears in bank filings

EDGAR full-text search finds no bank 10-K or 10-Q using “agentic” or “AI agents” in any quarter of 2024.[1] The first is a 10-K filed by BankUnited, Inc. on 2025-02-28, with one sentence: generative and agentic AI “are emerging technologies that present both opportunities and risks to users.”[1] Axos Financial’s 10-K of 2025-08-21 followed, then WaFd’s and Pathward’s 10-Ks in November 2025, both for fiscal years ending in September.[1]

Across all filers the word moved earlier and faster. Full-text search counts 3 10-K and 10-Q filings with “agentic” in 2024-Q4, 28 in 2025-Q1 and 72 in 2025-Q4.[1] Banks were a small part of that: in 2026-Q1, 23 of the 294 filings that used “agentic” came from filers with a bank SIC code, about 7.8%.[1]

## Filings per quarter that name agentic AI or AI agents

The method is two searches, one for “agentic” and one for “AI agents”, each run on forms 10-K and 10-Q one calendar quarter at a time and paged to the end, with each filing counted once by its accession number. A hit is kept when the filer’s first SIC code on EDGAR is 6021 (national commercial banks), 6022 (state commercial banks), 6035 or 6036 (savings institutions). That leaves out bank holding companies EDGAR files under other codes and every credit union, broker and card network.

[Figure] 27 bank 10-Ks and 10-Qs filed in 2026-Q1 named agentic AI or AI agents; in all of 2025 there were 4. Bank filings by Calendar quarter of filing. Bank 10-Ks and 10-Qs: 2024-Q1 0, 2024-Q2 0, 2024-Q3 0, 2024-Q4 0, 2025-Q1 1, 2025-Q2 0, 2025-Q3 1, 2025-Q4 2, 2026-Q1 27, 2026-Q2 2, 2026-Q3 4, 2026-Q4 to 11-11 7. Distinct 10-K and 10-Q filings by commercial banks and savings institutions (SIC 6021, 6022, 6035, 6036) whose text contains "agentic" or "AI agents", by calendar quarter of filing. The first quarter is when calendar-year banks file their 10-Ks.

The shape is the 10-K calendar. Calendar-year banks file 10-Ks in February and March, which is why 2026-Q1 holds 27 of the 44 bank filings counted from 2025-Q1 to 2026-11-11.[1] The quarters after it fall back to 2, 4 and 7, and most of those are 10-Qs that repeat a risk factor or an item from the year’s 10-K. The 7 so far in 2026-Q4 run only to 2026-11-11, the date of the count.

## Context: own use, risk, or industry change

Each of the 44 filings was read on sec.gov and every sentence naming agentic AI or AI agents was kept. Four had no sentence the reader could isolate in the main document, leaving 40 filings from 33 banks.[1] Each filing was then coded once by the first of three rules that any of its sentences matches:

- **Own use.** The bank, as subject, deploys, integrates, invests in, adopts, implements, partners for or evaluates the technology, with no “may”, “could”, “might” or “monitor” between the subject and the verb.
- **Risk.** The sentence names risks, fraud, threats, liability or adverse effects, or uses “may”, “could” or “might”.
- **Industry change.** Anything else: the technology described as a development in banking with no stance.

[Figure] Of 40 bank filings read, 17 name agentic AI as a risk, 16 as a change in the industry and 7 as something the bank uses or is weighing. Half year of filing by Bank filings. Its own use: deploying, investing in or evaluating agents: 2025 H1 0, 2025 H2 0, 2026 H1 5, 2026 H2 to 11-11 2. A risk: errors, fraud, cyber or liability: 2025 H1 1, 2025 H2 1, 2026 H1 13, 2026 H2 to 11-11 2. Industry change, no stance: 2025 H1 0, 2025 H2 2, 2026 H1 9, 2026 H2 to 11-11 5. Each bank filing behind the count, read on sec.gov and coded once by the first rule its sentences on agentic AI or AI agents match, in the order shown. Four filings where no such sentence was found in the main document are left out.

The risk sentences repeat across banks. One phrasing, that AI models “particularly generative or agentic AI models, may produce outputs or take action that is incorrect”, appears in the 10-Ks of WaFd, Capital City Bank Group, Patriot National Bancorp and Western Alliance.[1] The industry sentences repeat too: “Recently, the financial services industry has experienced rapid developments in artificial intelligence, including agentic artificial intelligence” appears word for word at Simmons First, Burke & Herbert, Atlantic Union and QNB.[1] Shared risk-factor wording is common, and it means the count measures how often a sentence travels between filings, not how many banks have an agentic program.

The larger banks write about agents in narrower terms. Capital One’s 10-K ties them to card losses:

[Excerpt] "the growth of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, may increase fraud losses as well as change circumstances when the merchant or issuer is liable for fraud losses" (https://www.sec.gov/Archives/edgar/data/927628/000092762826000024/cof-20251231.htm)

Bank of America’s 10-K lists what could go wrong inside the bank: expanded use of AI, “including emerging third‑party AI services and autonomous AI agents, may result in increased data risk, unpredictable system interactions, inadequate controls or safeguards, AI failure, or produce unintended operations or consequences.”[4] Ally Financial’s 10-K says the risks “may vary depending on whether our AI use is internal or customer-facing,” on what systems and data the tool touches “and what level of autonomy an AI solution is granted.”[12] Eastern Bankshares names agentic AI as a tool for the other side, allowing “bad actors to more easily use sophisticated and iterative methods of facilitating fraud through the creation of synthetic identities and ‘deepfake’ images and documentation.”[10]

Citigroup’s 10-Q for the third quarter of 2026 is the one bank filing in the set that defines the term in its glossary: “Artificial intelligence that autonomously pursues goals by planning actions, using tools, observing results and iterating with minimal human supervision.”[9]

## What the Fed said about agents and payments

Governor Waller gave “Payments in the Age of AI Agents” at Sibos 2026 in Miami; the Board’s page dates it 2026-09-29.[2] The speech is about payments, not bank operations, and it is the clearest description a Fed official has given of what an agent does with money. Agents, Waller said, “can plan and execute multistep processes using LLMs, enabling those agents to transact autonomously.”[2]

He drew two models. In the agent-assisted model “the buyer remains in control. They make the decisions, and they handle the payment.” In the agent-delegated model “a buyer grants authority to an AI agent to shop and make payments on their behalf.”[2] He named three trust problems, “authentication, liability, and fraud,” and put the liability question plainly: “Who is on the hook if an agent makes the wrong purchase?”[2] Capital One’s risk factor asks the same question from the issuer’s side.[3]

For a finance department the most direct passage is about business purchases. Waller said B2B buying “may be especially well suited for agentic commerce” because purchases “are often recurring and abide by a set of rules, such as approved suppliers and budget limits.”[2] He added that higher B2B transaction values “amplify the financial exposure from agent errors or unauthorized actions, so robust controls and monitoring systems will be essential,” and that agents would have to pay across “ACH, wire, instant payments, and cards.”[2] He also said fraud systems “calibrated to human behavior, may not translate well to agents.”[2]

The model risk guidance the Fed, the FDIC and the OCC issued on 2026-04-17 as SR 26-2 does not cover any of this. Its footnote 3 reads: “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.”[11] It points banks instead to their general risk management and governance practices for “any tools, processes, or systems not covered in this document.”[11]

## Finance-function uses banks name

Seven filings from five banks describe their own use or evaluation, and they are the most useful for a finance leader because they say where the tool sits.[1]

Business First Bancshares reported in its 10-Q of 2026-05-01, and repeated in the next two 10-Qs, that “On February 17, 2026, we announced a strategic partnership with Covecta, to deploy agentic AI across the bank's day to day workflows.”[6] Valley National Bancorp’s 10-K says the bank has made “and expect to continue to make investments to integrate artificial intelligence tools into our solutions,” naming agentic AI among them.[7] C&F Financial’s 10-K, under efficiency and technology, says the company is “evaluating potential use cases across all subsidiaries and departments for the prudent adoption of Artificial Intelligence (AI) including robotic process automation, generative and agentic AI, and machine learning tools.”[8]

Two banks, Sierra Bancorp and Bank of Marin Bancorp, filed 10-Ks with closely matching language that says where each stood when it filed.

[Excerpt] "While the Company’s deployment of AI at this time is generally limited to fraud detection or prevention; we continue to evaluate whether to implement additional AI tools, or agentic AI, in certain limited capacities" (https://www.sec.gov/Archives/edgar/data/1130144/000110465926021479/bsrr-20251231x10k.htm)

Bank of Marin’s 10-K says the company “continues to evaluate additional AI capabilities, including agentic AI, in limited capacities,” and lists the risks it weighs: errors in work product, privacy, intellectual property, bias and cybersecurity.[13]

None of the 40 filings names a finance-department task (the close, payables, reconciliations, forecasting, regulatory reporting) as a place where the bank runs an agent. The process names that do appear sit in risk factors about AI generally.

## What banks say stays with a person

The reader also searched every kept sentence for a human-review statement: human review, oversight, judgment or intervention, “human in the loop”, review by personnel or management, manual review. None of the 40 filings has one in a sentence that names agentic AI or AI agents.[1] That does not mean the banks have no such controls; it means they did not describe them next to the word.

The nearest statement is Citigroup’s definition, which builds the absence of a person into the term itself: “iterating with minimal human supervision.”[9] Governor Waller’s speech puts the control question on the buyer in the delegated model: the buyer “may specify some constraints and set up guardrails, but the agent operates autonomously.”[2]

## What is not yet in the filings

Four things a reader might expect are absent from the 44 bank filings counted here.[1]

In the sentences that name the term, no bank names an agent vendor other than Business First’s partner, and none gives a cost, a headcount effect or a count of agents in production. No bank filing in the set mentions SR 26-2, though the guidance excludes agentic models by name.[11] No bank describes agents initiating payments from its own accounts, the business-to-business case the Fed governor singled out.[2] And no filing in the set reports an incident caused by an AI agent.

The count will move each February. The site’s refresh reruns the two searches daily for recent quarters, and this article’s figures are recomputed from the saved results by the script in the site’s repository (scripts/cfonews-ai/articles/compute.mjs). The bank filings that describe AI in the finance function more broadly are collected in [AI in their own finance work](https://cfonews.ai/explainers/ai-in-own-finance-work), and the Fed speeches on AI are listed in the [Federal Reserve tracker](https://cfonews.ai/regulation/federal-reserve).

Sources:
[1] SEC EDGAR full-text search, forms 10-K and 10-Q, phrases "agentic" and "AI agents", calendar quarters 2024-Q1 to 2026-11-11, filers with SIC code 6021, 6022, 6035 or 6036, 2026-11-11. https://efts.sec.gov/LATEST/search-index?q=%22agentic%22&forms=10-K,10-Q
[2] Federal Reserve Board, Governor Christopher J. Waller, Payments in the Age of AI Agents, speech at Sibos 2026, 2026-09-29. https://www.federalreserve.gov/newsevents/speech/waller20260928a.htm
[3] SEC EDGAR, Capital One Financial Corp Form 10-K for 2025, 2026-02-19. https://www.sec.gov/Archives/edgar/data/927628/000092762826000024/cof-20251231.htm
[4] SEC EDGAR, Bank of America Corp Form 10-K for 2025, 2026-02-25. https://www.sec.gov/Archives/edgar/data/70858/000007085826000157/bac-20251231.htm
[5] SEC EDGAR, Sierra Bancorp Form 10-K for 2025, 2026-02-27. https://www.sec.gov/Archives/edgar/data/1130144/000110465926021479/bsrr-20251231x10k.htm
[6] SEC EDGAR, Business First Bancshares, Inc. Form 10-Q for the quarter ended 2026-03-31, 2026-05-01. https://www.sec.gov/Archives/edgar/data/1624322/000162432226000028/bfst-20260331.htm
[7] SEC EDGAR, Valley National Bancorp Form 10-K for 2025, 2026-02-27. https://www.sec.gov/Archives/edgar/data/714310/000071431026000017/vly-20251231.htm
[8] SEC EDGAR, C&F Financial Corp Form 10-K for 2025, 2026-03-03. https://www.sec.gov/Archives/edgar/data/913341/000091334126000010/cffi-20251231x10k.htm
[9] SEC EDGAR, Citigroup Inc. Form 10-Q for the quarter ended 2026-09-30, 2026-11-05. https://www.sec.gov/Archives/edgar/data/831001/000083100126000056/c-20260930.htm
[10] SEC EDGAR, Eastern Bankshares, Inc. Form 10-K for 2025, 2026-03-02. https://www.sec.gov/Archives/edgar/data/1810546/000162828026013126/ebc-20251231.htm
[11] Federal Reserve Board, FDIC and OCC, Supervisory Guidance on Model Risk Management, attachment to SR letter 26-2, 2026-04-17. https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf
[12] SEC EDGAR, Ally Financial Inc. Form 10-K for 2025, 2026-02-25. https://www.sec.gov/Archives/edgar/data/40729/000004072926000005/ally-20251231.htm
[13] SEC EDGAR, Bank of Marin Bancorp Form 10-K for 2025, 2026-03-13. https://www.sec.gov/Archives/edgar/data/1403475/000140347526000018/bmrc-20251231.htm

### Business email compromise: what FBI IC3 reports, what FinCEN says, and how 10-K and 8-K filers disclose it

URL: https://cfonews.ai/explainers/business-email-compromise-ic3-fincen
Published: 2026-11-11
Question: How big is business email compromise, and how do companies prevent it?
Business email compromise losses and complaints from FBI IC3 reports for 2018 to 2025, FinCEN's alerts, the SEC's 2018 report and what SEC filers disclose.

Business email compromise cost U.S. complainants $3,046,598,558 in 2025 on 24,768 complaints, according to the FBI’s Internet Crime Complaint Center, the largest loss figure IC3 has printed for the category and second only to investment fraud among the crime types in its 2025 report.[1] Companies prevent it, in the words the SEC used in its 2018 report on nine public companies that lost nearly $100 million, with internal accounting controls over payment authorization and vendor data “attuned to this kind of cyber-related fraud,” and with training on those controls.[10]

The numbers below are copied from each year’s IC3 report, FinCEN’s two advisories and SEC EDGAR. They count complaints and filings. They do not measure all business email compromise: they count only what victims chose to report to IC3 and what companies chose to file.

## What BEC is, in the FBI’s and FinCEN’s definitions

The FBI’s 2025 report defines BEC as “a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments,” carried out by “compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds.”[1] The phone numbers and virtual meetings are a widening of the older wording the SEC quoted in 2018, which spoke of businesses that “often work with foreign suppliers.”[10]

FinCEN’s definition, in its advisory of 2019-07-16, is about the account rather than the method. BEC “Targets accounts of financial institutions or customers of financial institutions that are operational entities, including commercial, non-profit, non-governmental, or government entities.”[8] Its companion, email account compromise, targets “personal email accounts belonging to an individual.”[8] The same advisory says the payments are not only wires: FinCEN had seen BEC schemes induce “convertible virtual currency payments, automated clearing house transfers, and purchases of gift cards.”[8]

## IC3 complaint counts and losses by year

Each figure here is the one printed in that year’s report, in its table of crime types by loss and by count. The 2019, 2020 and 2021 reports use the combined category BEC/EAC; from 2022 the reports print BEC alone. The 2018 figure comes from the three-year comparison table in the 2020 report.[6]

[Figure] Business email compromise losses reported to the FBI rose from $1.3 billion in 2018 to $3.0 billion in 2025. Reported losses, $ millions by Year of complaint. Adjusted losses, $ millions: 2018 1,298, 2019 1,777, 2020 1,867, 2021 2,396, 2022 2,742, 2023 2,947, 2024 2,770, 2025 3,047. Adjusted losses complainants reported to IC3 under business email compromise (BEC/EAC in the 2019 to 2021 reports), in millions of dollars, as each year's report prints them; 2018 from the 2020 report. These are reported losses, not audited or recovered amounts.

Reported losses grew 71.5% from 2019 to 2025, from $1,776,549,688 to $3,046,598,558.[7][1] They dipped once, from $2,946,830,270 in 2023 to $2,770,151,146 in 2024, before the 2025 rise.[3][2]

[Figure] The number of complaints barely moved, from 20,373 in 2018 to 24,768 in 2025. Complaints by Year of complaint. BEC complaints: 2018 20,373, 2019 23,775, 2020 19,369, 2021 19,954, 2022 21,832, 2023 21,489, 2024 21,442, 2025 24,768. Complaints IC3 recorded under business email compromise each year, from the same tables. Losses grew faster than complaints, so the reported loss per complaint rose.

Complaints went the other way for most of the period. IC3 received 23,775 BEC/EAC complaints in 2019 and 19,369 in 2020, and the count stayed between 21,442 and 21,832 from 2022 to 2024 before reaching 24,768 in 2025.[7][6][4][2][1] Dividing one by the other gives a reported loss per complaint of about $74,723 in 2019, $137,132 at the 2023 peak and $123,005 in 2025. That is an average of reported figures, and a few large cases move it.

The figures are what complainants reported, as IC3 adjusted them. They are not audited, and they include only victims who filed a complaint.[1]

The 2025 report also says where money can still be stopped. Its Recovery Asset Team ran the Financial Fraud Kill Chain on 3,900 incidents in 2025 with $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate.[1] The report says that in the past “the majority of FFKC incidents initiated by the IC3 RAT were Business Email Compromises (BECs)”, and that in 2025 the process saw a rise in tech support and account takeover cases.[1] Its advice for a company that finds a fraudulent transfer is short: “time is of the essence,” contact the bank and request a recall, and file a complaint with IC3 “Regardless of the amount lost.”[1]

## What FinCEN’s alerts add

FinCEN sees BEC through suspicious activity reports filed by banks, a different window from IC3’s complaints. Its 2019 advisory said that since its first BEC advisory of 2016 it had received “over 32,000 reports involving almost $9 billion in attempted theft from BEC fraud schemes affecting U.S. financial institutions and their customers.”[8]

The advisory’s main point is in its title: vulnerable business processes. Criminals “identify processes vulnerable to compromise, whether through openly available information about their targets or through cyber-enabled reconnaissance efforts,” then “insert themselves into communications by impersonating a critical player in a business relationship or transaction.”[8] It notes that a scheme’s chance of success “often depends on the criminal’s knowledge of their victim’s normal business processes, as well as weaknesses in the victim’s authorization and authentication protocols.”[8] For a finance department that sentence is a scoping note: the process map of payables and treasury is the attack surface.

FinCEN’s alert of 2024-11-13, FIN-2024-Alert004, adds generative AI. It says FinCEN observed, beginning in 2023 and continuing in 2024, “an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media in fraud schemes.”[9] Among the schemes it names BEC, and it says criminals “have reportedly used GenAI tools to target companies by impersonating an executive or other trusted employee and then instructing victims to transfer large sums or make payments to accounts ultimately under the scammer’s control.”[9] It asks banks to tag related reports with the key term “FIN-2024-DEEPFAKEFRAUD”.[9]

IC3 began counting the same thread in 2025. Its report tags 22,364 complaints across all crime types with the descriptor “AI Related”, with $893,346,472 in reported losses; the descriptor is counted across crime types rather than as one of them.[1]

## How issuers disclose BEC losses and controls

EDGAR full-text search, run once per calendar year and reduced to distinct filings, finds the phrase “business email compromise” in 22 10-Ks filed in 2019, 74 in 2023, 129 in 2025 and 157 so far in 2026, to 2026-11-11.[11] The 8-K count is small and uneven: between 1 and 14 a year, 62 over the whole period, counting the exhibits filed with each 8-K.[11]

[Figure] 129 10-Ks filed in 2025 named business email compromise, up from 22 in 2019. Filings by Calendar year of filing. 10-K: 2019 22, 2020 33, 2021 39, 2022 59, 2023 74, 2024 120, 2025 129, 2026 to 11-11 157. 8-K: 2019 4, 2020 1, 2021 6, 2022 8, 2023 11, 2024 12, 2025 6, 2026 to 11-11 14. Distinct 10-K and 8-K filings (8-Ks with their exhibits) whose text contains "business email compromise", by calendar year of filing; 2026 runs to 2026-11-11. Most 10-K uses are risk factors, not incidents.

The 10-K figure is mostly risk-factor and cybersecurity-item language: a filer names BEC as one kind of attack it faces. The 8-Ks say more, because a company files one when it has news. Each of the 62 8-Ks was read on sec.gov and its sentences naming the scheme coded by a published rule: an incident or loss (a filer that “was the victim”, an amount “lost”, “diverted” or “wired”, or that “experienced” a compromise), then a control or remediation, then a risk mention.[11] Thirteen had no sentence the reader could isolate. Of the other 49, 5 report an incident or loss, 10 describe a control and 34 name it as a risk.[11]

The five incident filings come from four companies. Journey Medical Corp reported in its results for 2021 that wire fraud costs of “approximately $9.5 million were attributable to funds erroneously wired to fraudulent accounts as a result of a sophisticated business email compromise fraud scheme.”[13] Comera Life Sciences said that in February 2022 it determined it was “affected by a business email compromise fraud” that diverted company capital to unknown parties, and booked a $590 thousand loss in the quarter to 2022-03-31.[14] BeiGene’s updated risk factors of 2024-09-30 say one of its third-party vendors “experienced a business email compromise which resulted in us sending payment to a fraudulent bank account.”[15] NETSTREIT’s earnings release for the second quarter of 2024 is the clearest of the set:

[Excerpt] "the Company was the victim of a criminal scheme involving a business email compromise of an employee that led to two fraudulent transfers totaling $3.3 million to a third-party impersonating one of our development partners" (https://www.sec.gov/Archives/edgar/data/1798100/000179810024000064/netstreitearningsrelease-q.htm)

## The anatomy of a payment-redirect case

The SEC’s 2018 report describes two variants among the nine issuers it investigated. In the first, perpetrators emailed finance personnel from spoofed executive addresses, directing them to work with a purported outside attorney who then had them wire funds abroad; the SEC said these “were not sophisticated frauds in general design or the use of technology.”[10] In the second, perpetrators hacked foreign vendors’ email accounts, asked issuer staff to change the vendors’ banking information and “attached doctored invoices reflecting the new, fraudulent account information.”[10] One company made 14 wire payments over several weeks, losing over $45 million, before a foreign bank raised the alarm; another paid eight invoices totaling $1.5 million over several months.[10]

[Diagram] A payment-redirect case in five steps, with the control the SEC, FinCEN and the FBI name at each one. 1: Reconnaissance. The criminal learns how the company pays: who approves, which vendors, which schedules, from public information or a compromised mailbox (FinCEN 2019). Control: limit what payment process detail is public. 2: The request. A spoofed email from a ‘CEO’ with an outside ‘attorney’ and a secret, urgent deal, or a real vendor’s hacked mailbox sending a bank-change request with a doctored invoice (SEC 2018). Control: an instruction alone is not authority to pay. 3: Vendor master change. Procurement relays the new bank details to accounting, which updates vendor data. The SEC’s nine issuers all had a rule to verify vendor data changes and still paid (SEC 2018). Control: confirm through a contact already on file. 4: Approval and release. The wire goes out under the authorization matrix. In the SEC’s cases one employee skipped dual authorization and another read the matrix as granting a CFO’s approval level (SEC 2018). Control: payment authorization under Section 13(b)(2)(B). 5: Detection and recall. Most of the SEC’s issuers learned of the fraud from a bank, law enforcement or the real vendor; afterwards they added reconciliation and outgoing-payment notices. IC3 says time is of the essence: ask the bank for a recall and file a complaint (IC3 2025).

## What the SEC said about internal accounting controls

The report is not an enforcement action; the Commission said it “determined not to pursue an enforcement action in these matters.”[10] What it did was point to Exchange Act Section 13(b)(2)(B)(i) and (iii), which require issuers to keep internal accounting controls sufficient to provide reasonable assurances that transactions are executed, and access to assets is permitted, only with management’s authorization.[10]

The nine issuers had controls. They “had procedures that required certain levels of authorization for payment requests, management approval for outgoing wires, and verification of any changes to vendor data. Yet they still became victims of these attacks.”[10] The SEC’s reading is that staff took the email itself as enough to act on. In one case an accounting employee “did not follow the company’s dual-authorization requirement for wire payments”; in another, an employee read the authorization matrix as granting approval authority “at a level reserved for the CFO.”[10] In two cases the recipients of fake executive emails were chief accounting officers.[10]

After the frauds each issuer sought to enhance its payment authorization procedures and its verification of vendor changes; issuers that had learned of the fraud from third parties bolstered account reconciliation and outgoing payment notification; and all of them enhanced training.[10] The report’s conclusion states the standard: issuers “must calibrate their internal accounting controls to the current risk environment and assess and adjust policies and procedures accordingly.”[10] It also says the Commission is not suggesting that every victim of such a scam has violated the controls requirements.[10]

## Where the deepfake explainer fits

A deepfake is a new way to deliver the request in step two; the controls in steps three and four are the same ones the SEC listed in 2018. FinCEN’s 2024 alert is the document that ties the two, by naming BEC among the schemes generative tools now support.[9] The filings that describe deepfake attempts on finance teams, and the Federal Reserve’s remarks on them, are in [deepfakes and payment fraud](https://cfonews.ai/explainers/deepfakes-and-payment-fraud); the log entries on the subject are under [fraud and deepfakes](https://cfonews.ai/topics/fraud-and-deepfakes); and FinCEN’s documents are listed in the [FinCEN tracker](https://cfonews.ai/regulation/fincen).

How these figures were made: IC3 values are copied from each report’s crime-type tables and kept in the site’s research file with the report’s URL; EDGAR counts come from full-text search per calendar year, paged to the end and counted by accession number; the 8-K coding rule is in the site’s research script, and every chart is recomputed from those files by scripts/cfonews-ai/articles/compute.mjs.

Sources:
[1] Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report, 2026-11-11. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
[2] Federal Bureau of Investigation, Internet Crime Complaint Center, 2024 IC3 Annual Report, 2026-11-11. https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
[3] Federal Bureau of Investigation, Internet Crime Complaint Center, 2023 IC3 Annual Report, 2026-11-11. https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf
[4] Federal Bureau of Investigation, Internet Crime Complaint Center, 2022 IC3 Annual Report, 2026-11-11. https://www.ic3.gov/AnnualReport/Reports/2022_IC3Report.pdf
[5] Federal Bureau of Investigation, Internet Crime Complaint Center, 2021 IC3 Annual Report, 2026-11-11. https://www.ic3.gov/AnnualReport/Reports/2021_IC3Report.pdf
[6] Federal Bureau of Investigation, Internet Crime Complaint Center, 2020 IC3 Annual Report, 2026-11-11. https://www.ic3.gov/AnnualReport/Reports/2020_IC3Report.pdf
[7] Federal Bureau of Investigation, Internet Crime Complaint Center, 2019 IC3 Annual Report, 2026-11-11. https://www.ic3.gov/AnnualReport/Reports/2019_IC3Report.pdf
[8] FinCEN Advisory FIN-2019-A005, Updated Advisory on Email Compromise Fraud Schemes Targeting Vulnerable Business Processes, 2019-07-16. https://www.fincen.gov/sites/default/files/advisory/2019-07-16/Updated%20BEC%20Advisory%20FINAL%20508.pdf
[9] FinCEN Alert FIN-2024-Alert004, FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions, 2024-11-13. https://www.fincen.gov/sites/default/files/shared/FinCEN-Alert-DeepFakes-Alert508FINAL.pdf
[10] SEC Release No. 84429, Report of Investigation Pursuant to Section 21(a) Regarding Certain Cyber-Related Frauds Perpetrated Against Public Companies and Related Internal Accounting Controls Requirements, 2018-10-16. https://www.sec.gov/litigation/investreport/34-84429.pdf
[11] SEC EDGAR full-text search, phrase "business email compromise", forms 10-K and 8-K, calendar years 2019 to 2026-11-11, 2026-11-11. https://efts.sec.gov/LATEST/search-index?q=%22business%20email%20compromise%22&forms=10-K,8-K
[12] SEC EDGAR, NETSTREIT Corp. Form 8-K exhibit, earnings release for the quarter ended 2024-06-30, 2024-07-29. https://www.sec.gov/Archives/edgar/data/1798100/000179810024000064/netstreitearningsrelease-q.htm
[13] SEC EDGAR, Journey Medical Corp Form 8-K exhibit 99.1, results for 2021, 2022-03-24. https://www.sec.gov/Archives/edgar/data/1867066/000110465922037193/tm2210106d1_ex99-1.htm
[14] SEC EDGAR, Comera Life Sciences Holdings, Inc. Form 8-K exhibit 99.1, 2022-05-25. https://www.sec.gov/Archives/edgar/data/1907685/000119312522159833/d360099dex991.htm
[15] SEC EDGAR, BeiGene, Ltd. Form 8-K exhibit, updated risk factors, 2024-09-30. https://www.sec.gov/Archives/edgar/data/1651308/000165130824000123/a20240930formxupdatedriskf.htm

### AI in finance: what 10-K and 10-Q filers say it does in the finance function, counted by process and quarter

URL: https://cfonews.ai/explainers/ai-in-finance-function-counted
Published: 2026-11-11
Question: How is AI used in finance departments?
How often 10-K and 10-Q filers name AI beside the close, invoices, FP&A, tax and cash forecasting, by quarter, and what a sample read on sec.gov actually says.

In 10-K and 10-Q filings, AI used in finance departments shows up far more often as a word near finance vocabulary than as a described practice: 152 filings in 2026 to 2026-11-11 named both “artificial intelligence” and “financial close”, but in a sample of 168 filings that named AI beside a finance process, only 15 put the two in the same sentence.[1] Of those 15, one describes a company applying AI to its own accounting work, eight describe products or services sold to other companies’ finance teams, and six use the words for something else.[1]

The counts below are of filings, not companies, and of words, not deployments. Each figure says how it was made.

## The question and the process list

Six phrases stand for six pieces of finance work, chosen because each names the work rather than a line item: “financial close”, “account reconciliations”, “financial planning and analysis”, “invoice processing”, “tax compliance” and “cash forecasting”. The obvious phrase for payables, “accounts payable”, was left out because nearly every 10-K prints it on the balance sheet, so pairing it with AI would count almost every AI filing. Each phrase was searched together with “artificial intelligence” on forms 10-K and 10-Q.[1]

## Method: full-text counts, a sample, and the sentence test

The counts come from EDGAR full-text search, run one calendar quarter at a time from 2023-Q1, paged to the end, and reduced to distinct accession numbers, so a filing counts once however many times it uses the words.[1] A 10-K and the three 10-Qs a company files in a year are four filings. Both phrases can sit anywhere: an AI risk factor in Item 1A and “financial close” in Item 9A make a hit.

To see what the hits say, a seeded random sample of up to eight main documents per process and quarter, for the four quarters 2025-Q4 to 2026-Q3, was drawn from the search results and each document read on sec.gov.[1] Where a quarter had fewer than eight, all were read. A filing passes the sentence test when at least one sentence names an AI term (artificial intelligence, generative AI, machine learning, AI, agentic) and matches the process pattern: the site’s published topic rules for the close, payables, forecasting, tax and treasury, and “reconciliation” for the last.[1] Every passing sentence was then coded for stage (in use, piloting, planning, or none of these) by the verb rules in the site’s research script.

## Filings naming AI by process and quarter

“Financial close” beside AI went from 15 filings in 2023-Q1 to 55 in 2026-Q1; “account reconciliations” from 35 to 72; “financial planning and analysis” from 39 to 147; “invoice processing” from 6 to 11.[1] Calendar years tell the same story without the first-quarter spike: financial close 52 filings in 2023, 85 in 2024, 111 in 2025 and 152 in 2026 to 2026-11-11.[1]

[Figure] 10-K and 10-Q filings naming artificial intelligence and "financial close" reached 55 in 2026-Q1, from 15 in 2023-Q1. Filings by Calendar quarter of filing. “financial close”: 2023-Q1 15, 2023-Q2 17, 2023-Q3 10, 2023-Q4 10, 2024-Q1 17, 2024-Q2 26, 2024-Q3 22, 2024-Q4 20, 2025-Q1 31, 2025-Q2 31, 2025-Q3 22, 2025-Q4 27, 2026-Q1 55, 2026-Q2 39, 2026-Q3 35. “invoice processing”: 2023-Q1 6, 2023-Q2 1, 2023-Q3 1, 2023-Q4 1, 2024-Q1 6, 2024-Q2 2, 2024-Q3 2, 2024-Q4 2, 2025-Q1 7, 2025-Q2 4, 2025-Q3 2, 2025-Q4 3, 2026-Q1 11, 2026-Q2 7, 2026-Q3 6. “financial planning and analysis”: 2023-Q1 39, 2023-Q2 10, 2023-Q3 10, 2023-Q4 12, 2024-Q1 87, 2024-Q2 23, 2024-Q3 14, 2024-Q4 16, 2025-Q1 122, 2025-Q2 17, 2025-Q3 11, 2025-Q4 19, 2026-Q1 147, 2026-Q2 25, 2026-Q3 14. “account reconciliations”: 2023-Q1 35, 2023-Q2 15, 2023-Q3 18, 2023-Q4 19, 2024-Q1 49, 2024-Q2 34, 2024-Q3 25, 2024-Q4 25, 2025-Q1 57, 2025-Q2 31, 2025-Q3 29, 2025-Q4 36, 2026-Q1 72, 2026-Q2 37, 2026-Q3 38. Distinct 10-K and 10-Q filings each calendar quarter whose text contains "artificial intelligence" and the process phrase, anywhere in the filing. First quarters carry most 10-Ks, so every line peaks in Q1.

Two phrases are left off the chart. “Tax compliance” is the largest, 585 filings in 2026-Q1 alone, and the sample shows why: its two passing passages were a list of laws a company must follow and a note on taxes on electricity, not the tax department’s work.[1] “Cash forecasting” is the smallest, no filings at all in 2023 and between 3 and 5 in each full quarter since 2025-Q1.[1]

## What a sample read on sec.gov says

The sentence test cuts the counts down hard. Of 32 sampled filings with AI and “financial close”, none had a sentence joining them; the same for 32 with “account reconciliations” and all 16 with “cash forecasting”.[1] FP&A passed in 7 of 32, invoice processing in 6 of 24, tax compliance in 2 of 32.[1]

[Figure] In a sample of 168 filings naming both, 15 put AI and the finance work in the same sentence. Process phrase searched by Sampled filings. AI and the work in one sentence: “financial close” 0, “invoice processing” 6, “financial planning and analysis” 7, “tax compliance” 2, “cash forecasting” 0, “account reconciliations” 0. Both in the filing, never in one sentence: “financial close” 32, “invoice processing” 18, “financial planning and analysis” 25, “tax compliance” 30, “cash forecasting” 16, “account reconciliations” 32. A seeded random sample of up to eight filings per process and quarter, 2025-Q4 to 2026-Q3, each read on sec.gov. Dark is a filing with at least one sentence naming an AI term and the work; yellow is a filing where the two never meet in a sentence.

## Where the close and reconciliation words sit

The two phrases that never met AI in a sentence have a home of their own in these filings. In 25 of the 32 sampled filings with “financial close”, the phrase’s first use sits within 1,500 characters of the words “material weakness” or a form of “remediate”; the same is true for 25 of the 32 with “account reconciliations”.[1] For FP&A, invoice processing, tax compliance and cash forecasting, the count is 2 of 104 filings put together.[1] The rule is mechanical (a window of text around the first use, read in the filing on sec.gov) and is printed in the site’s research script.

That placement explains most of the growth in the first chart. A small company that reports a material weakness in its financial close and reporting process, and also carries a risk factor about artificial intelligence, is a hit for both phrases, and both kinds of disclosure have become more common. The close shows up in these filings as a control that failed or is being repaired, written in the controls items of the 10-K and 10-Q, not as a process a model now runs. A finance leader reading the count as adoption would be reading the controls section as a product brochure.

What the sample does not show is as useful. No sampled sentence that names AI describes a model that posts journal entries, matches bank statements or drafts the close checklist, and none names a vendor whose AI it uses for the close.[1] The passages that come nearest are the payables products in the next group, sold by their makers to other companies.

Read one by one, the 15 passing filings sort into three groups.

**A company using AI on its own finance work: one filing.** The OLB Group’s 10-Q for the quarter ended 2026-06-30 is the only sampled passage in which a filer says it is building AI for its own accounting.[2]

[Excerpt] "In accounting and finance, we are developing AI agents intended to automate invoice processing, reconciliation, residual calculations, expense categorization and routine financial close activities." (https://www.sec.gov/Archives/edgar/data/1314196/000118518526003553/olbgroup10q063026.htm)

**Products and services sold to other finance teams: eight filings.** XBP Global’s 10-K says its accounts payable and procure-to-pay solution “leverages artificial intelligence to simplify the complexities of supplier onboarding, management, and invoice processing,” and that it “performs AI-based three-way matching.”[3] Global AI, Inc. filed the same description in a 10-K and two 10-Qs: a deployment at a customer “automates how supplier invoices are received, validated, and recorded across the customer’s finance systems,” with agents “processing invoices without manual intervention, and escalating exceptions for finance team review.”[4] Paylocity’s 10-K describes “AI-powered Accounts Payable Automation” covering every step “from vendor onboarding and invoice processing to bill coding, approvals, payments” and reconciliation.[5] Resources Connection, a consultancy, lists “financial planning and analysis enhancement” and “AI adoption” among its core solutions in a 10-K and two 10-Qs.[7]

**The words meeting by chance: six filings.** An executive’s biography that lists a past FP&A role and a later AI title; a list of laws that runs from foreign account tax compliance to artificial intelligence; a risk that AI-related demand makes it harder to forecast manufacturing capacity; labor forecasting in a payroll product; taxes on the electricity that AI equipment uses; and Kimball Electronics’ statement that it uses AI across its business, including “supply chain forecasting, back office productivity tools, and certain administrative functions.”[6] Kimball’s is a statement of use, and the back office is in it, but the forecasting it names is supply chain forecasting, not FP&A.

## Stage: in use, piloting, planning

The stage rule found 4 in-use statements among the 15 and no statement of a pilot or a plan; the other 11 state no stage.[1] Three of the four are Global AI’s descriptions of deployments at its customers, and the fourth is Kimball’s.[4][6] OLB’s “we are developing” falls outside the rule’s verbs and codes as no stage, which is why the sentence is printed above rather than counted. With 15 passages the split cannot carry a trend, and none is drawn here.

## What filers say they keep manual

The sample was also searched for a human-review statement in any sentence naming AI: human review, oversight, judgment or intervention, “human in the loop”, review by personnel or management, manual review. 24 of the 168 sampled filings have one.[1] Global AI’s passage is the only one of the 15 that joins a finance task to a person in the same sentence, with exceptions escalated “for finance team review.”[4]

The Federal Reserve has put reconciliation on the record as an early use. Governor Christopher J. Waller said on 2026-09-29 that the payments industry “was also an early adopter of large language models (LLMs) for payment reconciliation and similar tasks.”[8] The search found reconciliation beside AI in 167 filings in 2026 to 2026-11-11 and, in the 32 sampled, never in the same sentence.[1]

## What changed since the site’s first filings entry

The site’s filings log holds 67 published entries filed from 2025-11-04 to 2026-11-10, each a verbatim passage from a 10-K, 10-Q or 8-K that puts AI next to finance work, found by targeted searches and read in the filing. By the topic rules printed on the [methodology page](https://cfonews.ai/methodology), fraud and deepfakes lead with 19 entries, then controls and audit with 12, AP and payments 11, the close 9, forecasting and FP&A 7, and tax and treasury one each; 15 entries fit no topic.

[Figure] In the site's own log of 67 passages, fraud and deepfakes lead with 19 entries, the close has 9. Topic by Entries. Entries in the filings log: Fraud and deepfakes 19, Controls and audit 12, AP and payments 11, The close 9, Forecasting and FP&A 7, Tax 1, Treasury 1. Entries in the cfonews.ai filings log by topic, each assigned by the keyword rule printed on the methodology page. An entry can sit under two topics; 15 sit under none.

The log and the sample point the same way: passages that describe finance work done with AI are rare enough to be read one at a time, and in the sample most come from companies that sell the tools. The entries are grouped under [the close](https://cfonews.ai/topics/close), [AP and payments](https://cfonews.ai/topics/ap-and-payments) and [forecasting and FP&A](https://cfonews.ai/topics/forecasting-and-fpa), and the passages where filers describe AI in their own finance work are collected in [AI in their own finance work](https://cfonews.ai/explainers/ai-in-own-finance-work).

## How to use the counts, and when not to

The full-text counts are a fair measure of how often the vocabulary of AI and the vocabulary of finance work appear in the same SEC filing, quarter by quarter. They rise every year for every phrase except cash forecasting, which is too small to say.[1] They are not a measure of how many finance departments use AI, and they are not a count of companies: a calendar-year filer contributes up to four filings a year.

The sample is a small, seeded draw from four quarters, and its figures apply only to the filings drawn. It does not support a share for all filers, and none is given here. Every count in this article is recomputed from the saved search results and the sample file by scripts/cfonews-ai/articles/compute.mjs, and the sample can be drawn again from the same seed by the research script beside it.

Sources:
[1] SEC EDGAR full-text search, forms 10-K and 10-Q, "artificial intelligence" with each of six process phrases, calendar quarters 2023-Q1 to 2026-11-11, 2026-11-11. https://efts.sec.gov/LATEST/search-index?q=%22artificial%20intelligence%22%20%22financial%20close%22&forms=10-K,10-Q
[2] SEC EDGAR, The OLB Group, Inc. Form 10-Q for the quarter ended 2026-06-30, 2026-08-14. https://www.sec.gov/Archives/edgar/data/1314196/000118518526003553/olbgroup10q063026.htm
[3] SEC EDGAR, XBP Global Holdings, Inc. Form 10-K for 2025, 2026-03-31. https://www.sec.gov/Archives/edgar/data/1839530/000110465926037421/xbp-20251231x10k.htm
[4] SEC EDGAR, Global AI, Inc. Form 10-Q, 2026-06-03. https://www.sec.gov/Archives/edgar/data/1473490/000149315226027134/form10-q.htm
[5] SEC EDGAR, Paylocity Holding Corp Form 10-K for the fiscal year ended 2026-06-30, 2026-08-05. https://www.sec.gov/Archives/edgar/data/1591698/000159169826000069/pcty-20260630.htm
[6] SEC EDGAR, Kimball Electronics, Inc. Form 10-K for the fiscal year ended 2026-06-30, 2026-08-19. https://www.sec.gov/Archives/edgar/data/1606757/000160675726000032/ke-20260630.htm
[7] SEC EDGAR, Resources Connection, Inc. Form 10-K for the fiscal year ended 2026-05-30, 2026-07-24. https://www.sec.gov/Archives/edgar/data/1084765/000108476526000051/rgp-20260530.htm
[8] Federal Reserve Board, Governor Christopher J. Waller, Payments in the Age of AI Agents, 2026-09-29. https://www.federalreserve.gov/newsevents/speech/waller20260928a.htm

### SR 11-7 explained: the Fed's model risk guidance, replaced in 2026, and the AI its successor leaves out

URL: https://cfonews.ai/explainers/sr-11-7-explained-ai-models
Published: 2026-11-11
Question: Does SR 11-7 apply to AI and machine learning models?
SR 11-7 was superseded on 2026-04-17 by SR 26-2. What the new guidance says, section by section, about AI and machine learning, and what bank 10-Ks say.

SR 11-7 no longer applies to AI and machine learning models, or to any model: on 2026-04-17 the Federal Reserve, the FDIC and the OCC issued SR 26-2, which “supersedes and replaces” the 2011 letter.[1] By its own words the replacement applies to “traditional statistical and quantitative models and non-generative, non-agentic AI models”, and it puts generative and agentic AI models outside its scope.[2]

That makes the question most readers bring to SR 11-7 a question about SR 26-2. The 2011 letter has also left the Fed’s website: its page of 2011 supervision letters, read on 2026-11-11, runs from SR 11-15 down to SR 11-1 without an SR 11-7 entry.[3] What follows is the new guidance in its own words, section by section, and what bank 10-Ks say about model risk and AI.

## What SR 11-7 was, and what replaced it

SR 26-2’s cover letter names its predecessor exactly: SR letter 11-7, “Guidance on Model Risk Management,” issued April 4, 2011.[1] It also replaces SR letter 21-8 of April 9, 2021, the interagency statement on model risk management for bank systems supporting Bank Secrecy Act and anti-money-laundering compliance.[1] The letter is signed by Randall D. Guynn, Director of the Division of Supervision and Regulation, and says the revised guidance “reflects supervisory experience and industry feedback accumulated over the past fifteen years, as well as significant advancements in modeling practices.”[1]

The change of tone is in two sentences. The cover letter says the agencies want “to emphasize a risk-based approach to model risk management that is tailored to a banking organization's model risk profile and the size and complexity of its operations.”[1] And the attachment says the guidance “does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization.”[2] A footnote adds that supervisory action may still follow from violations of law or unsafe or unsound practices stemming from insufficient management of model risk.[2]

The scope is narrower than the name suggests. The guidance “is expected to be most relevant to banking organizations with over $30 billion in total assets,” and says that generally excluding banks of $30 billion or less “is consistent with a tailored supervisory approach,” though it may be relevant to smaller banks with complex models.[2]

## The definition of a model, and where machine learning sits

SR 26-2 defines a model as “a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates.”[2] It excludes “simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use.”[2]

For AI the operative text is footnote 3:

“Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.”[2]

The same footnote says “the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models,” and that a bank’s risk management and governance practices “should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document.”[2] The guidance does not use the words “machine learning.” By its text, a machine learning model that is neither generative nor agentic is an AI model inside the scope; a large language model that drafts text or an agent that acts on its own is outside it.

[Table] SR 26-2 section by section, in its own words, with the question each raises for a machine learning model. Section of SR 26-2 | What it says, quoted | The question for an AI or machine learning model
II. Purpose and scope | Expected to be “most relevant to banking organizations with over $30 billion in total assets”; a model is “a complex quantitative method, system, or approach”. | Is the tool statistical, economic or financial theory applied to input data, or a deterministic rule with none?
II, footnote 3 | “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.” | Is the model generative or agentic? If so, governance falls to the bank's general risk practices.
III. Overview | Model risk is “influenced by a model’s inherent risk, exposure, purpose, and use”; effective challenge is critical analysis “by objective experts”. | Who outside the build team can challenge a model whose logic is learned from data?
IV. Development and use | “Model development is not purely a technical exercise.” Testing may include “out-of-sample and out-of-time testing”. | Was the model tested on data from a period it was not trained on?
V. Validation and monitoring | Validation “generally occurs prior to a model’s first use”; conceptual soundness may rest on “interpretability measures or benchmarking to other models”. | For a model that cannot be read line by line, which interpretability or benchmark test stands in for theory?
VI. Governance and controls | Internal audit’s role is “to evaluate whether the model risk management practices are rigorous and effective”; an inventory supports risk “at the individual and aggregate levels”. | Does the inventory list every machine learning model, including ones inside vendor products?
VII. Vendor and other third-party products | Banks “may not receive from the vendor the underlying code, data, or methodology”; “the principles of model risk management remain applicable.” | What evidence of design and performance does the vendor give, and is it enough to validate?

## Development, implementation and use

Section IV has a sentence a finance team using a vendor’s forecasting model will recognise: “Model development is not purely a technical exercise.”[2] Development starts with a clear statement of purpose, and testing “evaluates whether a model performs as intended,” including “out-of-sample and out-of-time testing,” comparisons of alternative assumptions and “a critical assessment of data quality, relevance, and inputs.”[2]

On use, the guidance warns that “Using a model beyond its intended purpose introduces additional uncertainty and risk,” and that extending a model to a new application calls for analysis of the new usage and a review of existing controls.[2]

[Diagram] The model lifecycle in SR 26-2, section by section, with the question it raises for a machine learning model. 1: IV. Development. Begins with a clear statement of purpose. Testing evaluates whether the model performs as intended, with rigor commensurate with complexity and materiality. 2: IV. Use. Effective use depends on understanding the model's limitations. Using a model beyond its intended purpose introduces additional uncertainty and risk. 3: V. Validation. Generally before first use. Covers conceptual soundness and outcomes analysis; an urgent business need may justify use before validation, with limits and closer monitoring. 4: V. Ongoing monitoring. Whether the model still performs as expected as products, clients, data relevance or markets change; overlays, adjustment or redevelopment when it does not. 5: VI. Governance and VII. Vendors. Clear roles, an inventory, documentation, internal audit as evaluator; vendor models validated even when code and data are proprietary.

## Validation and effective challenge

Section V says validation “generally occurs prior to a model’s first use,” and allows use before validation in an urgent business need, with “greater attention to the model’s limitations” and controls such as “placing limits on model use or more closely monitoring its performance.”[2] Validation has three components in the text: conceptual soundness, outcomes analysis and ongoing monitoring.[2]

The conceptual soundness paragraph is the one that changes most for machine learning. It says evaluating theoretical construction may be important for some models, and that for others assessments such as “interpretability measures or benchmarking to other models” may be more practical.[2] For a model whose logic is learned from data rather than written down, those are the tests the guidance names in place of reading the theory.

Effective challenge appears in section III as “the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes throughout the model lifecycle.”[2] The people who do it need “the appropriate expertise,” “sufficient independence to maintain objectivity” and “the organizational standing and influence to effect any change.”[2] Section V adds that the quality of validation “depends on the rigor and effectiveness of the review rather than on organizational structure.”[2]

## Governance, policies and documentation

Section VI asks for clear roles, an inventory and documentation. The inventory “includes sufficient information to understand model risks, so as to support effective model risk management at the individual and aggregate levels.”[2] Internal audit “would generally not duplicate model risk management activities such as model development or validation”; its role is “to evaluate whether the model risk management practices are rigorous and effective.”[2]

Section VII covers vendor and other third-party products, where most machine learning in a finance department arrives. Banks “may not receive from the vendor the underlying code, data, or methodology,” and “Nevertheless, the principles of model risk management remain applicable.”[2] Sound practice includes understanding the vendor model’s “conceptual soundness, design, development data, and performance” and monitoring whether it remains fit for purpose.[2]

## What the Fed’s speakers have said about AI and model risk

Three Fed statements sit on either side of the April 2026 change, all on the Board’s own site.

Governor Michelle W. Bowman, 2024-11-22: “AI can also pose model risks in the banking context, with associated data management and governance concerns.” In the same passage: “While AI may be on the frontier of technology, it does not operate outside the existing legal and regulatory framework.”[8]

Governor Michael S. Barr, 2025-04-04, on what regulators should do about generative AI: “They should review and update existing standards on model risk management, as appropriate.”[9]

Vice Chair for Supervision Bowman, 2026-07-07, three months after SR 26-2, on the Financial Stability Board’s consultation on sound practices for AI: “lower-risk uses of AI should receive a lighter supervisory and regulatory touch,” and use and materiality “will help inform the type and intensity of the governance and controls that should be applied for the specific AI deployment.”[11]

The GAO’s 2025 report on AI in financial services makes the point from outside the banking agencies. It recommended that the National Credit Union Administration update its model risk management guidance “to encompass a broader variety of models used by credit unions,” and its product page lists that recommendation as open.[10] The report and its status are in the site’s [GAO tracker](https://cfonews.ai/regulation/gao).

## How many bank 10-Ks name model risk, by year

EDGAR full-text search was run on 10-Ks one calendar year at a time, paged to the end, and each filing counted once by accession number; a filing counts as a bank’s when the filer’s first SIC code on EDGAR is 6021, 6022, 6035 or 6036.[4] The phrase “model risk” appears in 33 bank 10-Ks filed in 2019, 48 in 2024 and 61 in 2025, and in 76 so far in 2026.[4] Banks are about half of all users of the phrase: 61 of the 122 10-Ks that used it in 2025.[4]

[Figure] 61 bank 10-Ks filed in 2025 used the phrase model risk, up from 33 in 2019. 10-K filings by Calendar year of filing. Bank 10-Ks naming "model risk": 2019 33, 2020 35, 2021 41, 2022 36, 2023 41, 2024 48, 2025 61, 2026 to 11-11 76. All 10-Ks naming "model risk": 2019 94, 2020 88, 2021 101, 2022 112, 2023 103, 2024 105, 2025 122, 2026 to 11-11 143. Distinct 10-K filings whose text contains "model risk", by calendar year of filing; 2026 runs to 2026-11-11. Bank filings are those whose filer's first SIC code on EDGAR is 6021, 6022, 6035 or 6036.

The pairing with AI moved faster. Bank 10-Ks naming both “model risk” and “artificial intelligence” rose from 5 in 2019 to 29 in 2024 and 49 in 2025; with “machine learning”, from 1 to 10 to 17.[4]

[Figure] Bank 10-Ks naming model risk and artificial intelligence went from 5 in 2019 to 49 in 2025. Bank 10-K filings by Calendar year of filing. with "artificial intelligence": 2019 5, 2020 8, 2021 12, 2022 13, 2023 14, 2024 29, 2025 49, 2026 to 11-11 68. with "machine learning": 2019 1, 2020 4, 2021 6, 2022 5, 2023 5, 2024 10, 2025 17, 2026 to 11-11 29. Bank 10-K filings whose text contains "model risk" and the second phrase anywhere in the filing, by calendar year of filing; 2026 runs to 2026-11-11.

Both phrases can sit anywhere in a filing, so the reader opened the 117 bank 10-Ks filed in 2025 and 2026 behind the AI and machine learning counts and kept the sentences naming model risk. In 114 such a sentence was found; in 37 at least one of them also names an AI term (artificial intelligence, generative AI, machine learning, AI or agentic).[4] Twenty of those 37 filings, from 11 banks, share one sentence that begins “AI introduces model risk, where flawed algorithms or biased data could result in” and goes on to credit decisions, compliance violations and lending outcomes.[4]

The large custody banks write about the framework itself. State Street’s 10-K for 2025 says “All regulatory capital calculation models, including any artificial intelligence and machine learning models, must comply with the model risk management framework and corresponding policies.”[7] BNY Mellon’s 10-K says its Model Risk Management framework “includes use cases employing artificial intelligence, including large language models,” and that the function is integrated into a broader artificial intelligence risk management framework.[6] Large language models are the class SR 26-2 now leaves to general governance.[2]

## Check status before relying on it

Bank filings did not all change their references when the guidance did. Westamerica Bancorporation’s 10-Q filed 2026-11-06 describes its interest rate model this way:

[Excerpt] "Management monitors the Company’s interest rate risk using a licensed third party simulation model, which is periodically assessed using supervisory guidance issued by the Board of Governors of the Federal Reserve System, SR 11-7" (https://www.sec.gov/Archives/edgar/data/311094/000117184326007225/wabc20260930_10q.htm)

A full-text search for “SR 26-2” in 10-K and 10-Q filings from 2026-04-17 to 2026-11-10 returned no filings, and neither did the guidance’s title, “Revised Guidance on Model Risk Management.”[4] A search for “SR 11-7” in the same forms from 2025-01-01 found nine documents, eight of them Westamerica’s.[4]

Three checks follow from the documents. The guidance in force is SR 26-2 and its attachment, dated 2026-04-17, issued jointly by the Federal Reserve, the FDIC and the OCC.[1] It is written as principles that carry no supervisory criticism on their own, with a stated focus on banks over $30 billion in total assets.[2] And for generative or agentic AI, the document a bank’s controls answer to is not SR 26-2 but the bank’s own governance, as footnote 3 says.[2] The Fed’s speeches and letters on AI are listed in the [Federal Reserve tracker](https://cfonews.ai/regulation/federal-reserve); every count above is recomputed from the saved search results by scripts/cfonews-ai/articles/compute.mjs in the site’s repository.

Sources:
[1] Federal Reserve Board, SR letter 26-2, Revised Guidance on Model Risk Management, 2026-04-17. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
[2] Federal Reserve Board, FDIC and OCC, Supervisory Guidance on Model Risk Management, attachment to SR letter 26-2, 2026-04-17. https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf
[3] Federal Reserve Board, Supervision and Regulation Letters, 2011, as read on the date given, 2026-11-11. https://www.federalreserve.gov/supervisionreg/srletters/2011.htm
[4] SEC EDGAR full-text search, form 10-K, phrase "model risk", alone and with "artificial intelligence" or "machine learning", calendar years 2019 to 2026-11-11, all filers and filers with SIC code 6021, 6022, 6035 or 6036, 2026-11-11. https://efts.sec.gov/LATEST/search-index?q=%22model%20risk%22&forms=10-K
[5] SEC EDGAR, Westamerica Bancorporation Form 10-Q for the quarter ended 2026-09-30, 2026-11-06. https://www.sec.gov/Archives/edgar/data/311094/000117184326007225/wabc20260930_10q.htm
[6] SEC EDGAR, The Bank of New York Mellon Corporation Form 10-K for 2025, 2026-02-25. https://www.sec.gov/Archives/edgar/data/1390777/000139077726000033/bk-20251231_d2.htm
[7] SEC EDGAR, State Street Corporation Form 10-K for 2025, 2026-02-19. https://www.sec.gov/Archives/edgar/data/93751/000009375126000124/stt-20251231.htm
[8] Federal Reserve Board, Governor Michelle W. Bowman, Artificial Intelligence in the Financial System, 2024-11-22. https://www.federalreserve.gov/newsevents/speech/bowman20241122a.htm
[9] Federal Reserve Board, Governor Michael S. Barr, AI, Fintechs, and Banks, 2025-04-04. https://www.federalreserve.gov/newsevents/speech/barr20250404a.htm
[10] U.S. Government Accountability Office, GAO-25-107197, Artificial Intelligence, Use and Oversight in Financial Services, product page with recommendation status, 2025-05-19. https://www.gao.gov/products/gao-25-107197
[11] Federal Reserve Board, Vice Chair for Supervision Michelle W. Bowman, Opening Remarks on Sound Practices for Artificial Intelligence, 2026-07-07. https://www.federalreserve.gov/newsevents/speech/bowman20260707a.htm

### AI in auditing: what the PCAOB has said, which standards already apply, and what audit firms report

URL: https://cfonews.ai/explainers/ai-in-auditing-pcaob
Published: 2026-11-10
Question: How is AI used in auditing, and what has the PCAOB said about it?
What the PCAOB has published on AI in auditing since 2023, which standards each document names, and how often 10-K auditor's reports mention AI, counted.

AI in auditing means two different things in the PCAOB’s documents: audit firms using AI tools in their own work, mostly for administrative and research tasks according to a July 2024 staff Spotlight, and auditors meeting AI inside the companies they audit.[1] The PCAOB has issued no standard on either; its one technology amendment, Release No. 2024-007 of 2024-06-12, covers technology-assisted analysis and says it does not address “specific matters relating to other technology applications used in audits (e.g., blockchain or artificial intelligence).”[2]

The PCAOB’s agenda page, as read on 2026-11-02, names AI only inside a research project and a planned piece of staff guidance.[3] What follows sets each PCAOB document beside the standards it names, then counts the other side: how many 10-Ks name artificial intelligence, and how often the auditor’s report bound into those 10-Ks does.

## Two questions: auditors using AI, and audited companies using AI

The Spotlight splits its observations the same way, one section on generative AI in audits and one on generative AI in financial reporting.[1] On the first, staff wrote that use by the firms they spoke to “appears to be focused primarily on administrative and research activities.”[1] On the second, companies said that bringing generative AI into accounting and financial reporting “appears to be secondary to integrating GenAI in operational and customer-facing areas.”[1]

The two questions land on different standards. An auditor’s own use of a tool goes to audit evidence and to supervision of the engagement team. A company’s use goes to the auditor’s risk assessment and, in an integrated audit, to the testing of internal control over financial reporting under AS 2201, the standard that began as Auditing Standard No. 5.[2][5] The SEC’s 2007 order approving that standard says it “requires the auditor to evaluate and test both the design and the operating effectiveness of internal control.”[5] A control that runs on a model is still a control the auditor must test.

## What the PCAOB has published, in date order

[Diagram] The PCAOB on technology and AI, 2023 to 2026: one amended standard, one staff Spotlight, an agenda that names AI only as a research topic. 2023-06-29: Standards and Emerging Issues Advisory Group meets. The Spotlight cites this meeting as one that discussed emerging issues in auditing, including artificial intelligence. 2023-06: Technology-assisted analysis proposed. The Board proposed amendments to AS 1105 and AS 2301 on audit procedures that analyze information in electronic form with technology-based tools. 2024-06-12: Release No. 2024-007 adopted. Amendments to AS 1105 and AS 2301, with a conforming amendment to AS 2501. The release says they do not address other technology such as blockchain or artificial intelligence. 2024-07: Staff Spotlight on generative AI. Observations from limited outreach to audit firms and companies. Staff views, not a rule, policy or statement of the Board. 2025-12-15: Amendments take effect. For audits of financial statements for fiscal years beginning on or after this date, as Release No. 2024-007 set it, subject to SEC approval. 2026-03-31: Strategic Priorities request for comment. Release No. 2026-001. Its comments informed the focus areas of the later standard-setting request. 2026-06-23: Standard Setting request for comment. Release No. 2026-005 sought stakeholder feedback on standard-setting and research priorities. 2026-11-02: Agenda page as read. A Data and Technology research project; technology named inside the Fraud and Going Concern projects; staff guidance planned on the use of super intelligence by companies and auditors.

The record is short. Three of the eight dates are about technology-assisted analysis, the PCAOB’s term for what practice calls data analytics.[2] Release No. 2024-007 says some auditors use it “to examine the correlation between different types of transactions, compare company information to auditor-developed expectations or third-party information, or recalculate company information.”[2]

Of the documents on the timeline, the Spotlight is the only one about generative AI, and it is explicit about its weight: it “represents the views of PCAOB staff and not necessarily those of the Board. It is not a rule, policy, or statement of the Board.”[1] It came out of “limited outreach to several audit firms and companies.”[1] This site’s [explainer on the Spotlight](https://cfonews.ai/explainers/pcaob-and-generative-ai-in-audits) walks through its observations one by one; here the interest is in which standards each document touches.

## Which existing standards each statement touches

[Table] Six PCAOB statements on AI or technology, and the standards each one names. PCAOB document | Standards it names | What it says about AI or technology, quoted
Release No. 2024-007, 2024-06-12 | AS 1105, AS 2301; AS 2501 conformed | The amendments are not focused on “specific matters relating to other technology applications used in audits (e.g., blockchain or artificial intelligence)”.
Release No. 2024-007, 2024-06-12 | AS 2201 and AS 2601, for integrated audits and service organizations | In the 2023 inspection year, “Less than 7% of the U.S. GNFs’ tools used blockchain technology, artificial intelligence, or robotic process automation.”
Staff Spotlight, July 2024 | None by number | Firms said PCAOB auditing standards “are not currently viewed as impediments to the development and use of GenAI in the audit.”
Agenda page, Fraud project | AS 2401 | Amendments to address intentional misstatements, “including addressing matters that may arise from developments in the use of technology.”
Agenda page, Going Concern project | AS 2415 | The Fraud and Going Concern projects “may examine how technology affects auditor identification of misstatements”.
Agenda page, Data and Technology research | None by number | Staff “plans to develop guidance on considerations relating to the use of super intelligence by companies and auditors”.

Release No. 2024-007 amends AS 1105, Audit Evidence, and AS 2301, The Auditor’s Responses to the Risks of Material Misstatement, and conforms AS 2501 on accounting estimates.[2] Among the changes it lists are two that bear on any tool: “Specify considerations for the auditor’s investigation of items identified when performing tests of details” and “Emphasize the importance of controls over information technology.”[2] It points auditors to AS 2601 for a company’s use of a service organization and to AS 2201 for integrated audits.[2] Its effective date is for audits of financial statements for fiscal years beginning on or after December 15, 2025, subject to SEC approval as the release states it.[2]

The release also carries the only count of AI tools the PCAOB has published in these documents. Its economic analysis reports that in the 2023 inspection year the six U.S. global network firms said 90% of their tools were used for data visualization, summarization, tabulation or modeling, and that “Less than 7% of the U.S. GNFs’ tools used blockchain technology, artificial intelligence, or robotic process automation.”[2] The six firms are named in the release’s footnote: BDO USA, Deloitte & Touche, Ernst & Young, Grant Thornton, KPMG and PricewaterhouseCoopers.[2] All six reported using tools to identify and select journal entries and to select samples for testing.[2]

Commenters on the 2023 proposal had asked for more. The release records that some said the Board “should continue to research and evaluate the need for standard setting related to other types of technology used in the audit, such as artificial intelligence.”[2] The Board answered that the amendments address “only one area of auditors’ use of technology” and that other areas “continue to be analyzed as part of our ongoing research activities.”[2]

## What the Spotlight says firms use generative AI for

Staff reported that some firms let staff use generative AI for “certain administrative documents or initial drafts of memos and presentations related to the audit,” and that some had built tools “to assist staff in researching internal accounting and auditing guidance.”[1] The global network firms were further along than the non-affiliated firms.[1]

The uses firms expected next are closer to audit evidence: summarizing accounting policy and legal documents, checking the completeness of audit documentation, certain risk assessment procedures, scoping, evaluating the completeness of disclosures, and comparing amounts in the statements or notes with audited amounts.[1] Those are the procedures AS 1105 governs, which is why the release’s carve-out of artificial intelligence matters.

Some firms did not allow generative AI in audit or attest procedures at all, citing data privacy and the reliability of output.[1] Firms that did said an engagement team member who uses such a tool “is still responsible for the results and documentation of the work,” and that reviewers apply “the same level of diligence as when reviewing work where GenAI was not involved.”[1]

## What the standard-setting agenda says is under consideration

The agenda page, as read on 2026-11-02, lists a Data and Technology research project to study “how auditors and companies are using new technologies and how those technologies may affect audit quality.”[3] It says auditors, public companies and broker-dealers “increasingly use data analytics, automation, super intelligence, and other technologies,” and that “the staff plans to develop guidance on considerations relating to the use of super intelligence by companies and auditors.”[3] “Super intelligence” is the page’s own term; it does not define it.

Two standard-setting projects name technology. The Fraud project would amend AS 2401, “including addressing matters that may arise from developments in the use of technology,” and the page says the Fraud and Going Concern projects “may examine how technology affects auditor identification of misstatements.”[3] Neither project has a proposal date on the page; for both, staff “is evaluating feedback” and developing a project plan.[3]

The agenda is the product of two public requests for comment in 2026. Release No. 2026-001 on strategic priorities was issued on March 31, 2026, and its comments informed the focus areas in Release No. 2026-005 on standard setting, issued on June 23, 2026.[3] The page says the agendas “are dynamic and may evolve” and that the Office of the Chief Auditor will update it “at least quarterly.”[3] The one project in its “Recently Completed” table is not about technology: amendments to QC 1000 on quality control, adopted on September 9, 2026, effective on December 15, 2026, with SEC approval pending as the page was read.[3]

## Counts: AI in the firms’ tools and in the companies they audit

The audited side is easier to count. EDGAR full-text search, run quarter by quarter and reduced to distinct filings, finds the phrase “artificial intelligence” in 836 10-Ks filed in 2021, 1,139 in 2022, 1,283 in 2023, 2,412 in 2024 and 3,271 in 2025.[4] The full method and the share of all 10-Ks are in [the AI disclosure count](https://cfonews.ai/explainers/ai-disclosure-in-sec-filings-counted).

[Figure] The audited side grew fast. 10-K filings naming artificial intelligence went from 836 in 2021 to 3,271 in 2025. 10-K filings by Calendar year of filing. 10-K filings naming "artificial intelligence": 2021 836, 2022 1,139, 2023 1,283, 2024 2,412, 2025 3,271. 10-K filings whose text contains "artificial intelligence", by calendar year of filing. These are the companies whose auditors meet AI in the business, the controls or the risk factors.

The firms’ side has one published count, the one in Release No. 2024-007. The release reports that the average number of tools used by engagement teams at the six U.S. global network firms rose from approximately 13 to approximately 18 per firm between 2018 and 2023, about 38%.[2] It says firms “generally do not require the use of such tools on audit engagements.”[2]

[Figure] In the 2023 inspection year, under 7% of the six largest firms' audit tools used AI, blockchain or robotic process automation. What the tools did or used by Share of the firms' reported tools. Share of the U.S. GNFs' tools: Data visualization, summarization, tabulation or modeling 90%, Developed in-house 75%, Also used third-party data 20%, Used cloud computing 18%, Used blockchain, AI or RPA (less than) 7%. Shares of the tools the six U.S. global network firms reported to the PCAOB for the 2023 inspection year, as Release No. 2024-007 prints them. The last bar is an upper bound; the others are the release's approximate figures.

The chart reads as a census of ordinary software. Nine in ten of the tools did data visualization, summarization, tabulation or modeling; about three in four were built in-house; about one in five also used third-party data; fewer than one in fourteen used artificial intelligence, blockchain or robotic process automation, and the release does not split that last group.[2] Every tool used company data.[2] Those are 2023 figures, and none of the other PCAOB documents read for this article gives a later count.

The firms in the count are the ones that audit most of the market. The Spotlight’s footnote describes its own outreach sample the same way: the U.S. global network firms and several non-affiliated firms that audit more than 100 issuers, which, the footnote says, “audit the majority of the market capitalization for issuers.”[1]

On the companies’ side the numbers are larger and moving faster. Of the 6,431 10-Ks filed in 2025, 3,271 named artificial intelligence, against 836 of 6,933 in 2021.[4] More than half of the 10-Ks filed that year used the phrase. The count does not say where: a risk factor, the business description or the controls section. The [AI disclosure count](https://cfonews.ai/explainers/ai-disclosure-in-sec-filings-counted) splits it by year, form and industry.

No document read for this article counts auditor’s reports that mention AI, and the PCAOB’s agenda page lists no project on critical audit matters about AI; it says only that staff plans “a further post-implementation review of CAMs” before deciding on further research, standard setting or guidance.[3]

## What an audit committee can ask, from the documents

The documents suggest questions without prescribing them. Each of these traces to a sentence above.

- Which audit procedures on this engagement used a firm tool built on AI, and does the firm’s policy allow it for audit or attest procedures? The Spotlight records firms that did not.[1]
- Where the audit used technology-assisted analysis, how were items the tool flagged investigated, as the amended AS 1105 and AS 2301 now specify?[2]
- Which of the company’s controls over financial reporting depend on a model, and how were they tested in the integrated audit under AS 2201?[2][5]
- Has the auditor’s fraud risk assessment considered AI-enabled schemes, the matter the PCAOB’s Fraud project names as technology?[3]

The PCAOB’s own entries are in the [regulation tracker](https://cfonews.ai/regulation/pcaob), and the controls side of what companies file is in [AI and internal control over financial reporting](https://cfonews.ai/explainers/ai-and-internal-control).

Sources:
[1] PCAOB staff, Spotlight: Staff Update on Outreach Activities Related to the Integration of Generative Artificial Intelligence in Audits and Financial Reporting (July 2024), 2026-11-02. https://pcaobus.org/documents/generative-ai-spotlight.pdf
[2] PCAOB Release No. 2024-007, amendments on technology-assisted analysis (AS 1105, AS 2301), 2024-06-12. https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket-052/2024-007-adoptingrelease.pdf?sfvrsn=28f44e9e_2
[3] PCAOB, Standard-Setting, Research, Rulemaking, and Related Activities, 2026-11-02. https://pcaobus.org/oversight/standards/standard-setting-research-rulemaking-related-activities
[4] SEC EDGAR full-text search, form 10-K, phrase "artificial intelligence", run quarter by quarter, 2026-11-10. https://efts.sec.gov/LATEST/search-index?q=%22artificial%20intelligence%22&forms=10-K
[5] SEC Release No. 34-56152, order approving PCAOB Auditing Standard No. 5, 2007-07-27. https://www.sec.gov/rules/pcaob/2007/34-56152.pdf

### SOX testing explained: how controls are tested, where AI enters the test, and what 10-K filers say about it

URL: https://cfonews.ai/explainers/sox-testing-ai-controls-explained
Published: 2026-11-10
Question: How is SOX control testing done, and how is AI changing it?
How SOX control testing works under the SEC's 2007 guidance and AS 2201, where an AI component changes each test, and what sampled 10-K Item 9A sections say.

SOX control testing has two possible testers: management evaluates whether its controls over financial reporting are designed to catch a material misstatement and whether they operated, under the SEC’s interpretive guidance of 2007-06-20, and at an accelerated or large accelerated filer that is not an emerging growth company the auditor also tests the same design and operation in the integrated audit under PCAOB AS 2201.[1][2][8] AI changes the inputs to that test more than the test itself: of the 3,271 10-Ks filed in 2025 that use the phrase “artificial intelligence”, 127 also use the exact phrase “information technology general controls” and 83 “automated controls”, the vocabulary of the IT side of the test.[4]

Neither the SEC’s 2007 guidance nor the SEC’s 2007 order approving the auditing standard uses the words artificial intelligence.[1][2] Their structure still decides what an AI component has to survive, which is why the sequence below is the useful place to start.

## What SOX testing is and who does it

Section 404 of the Sarbanes-Oxley Act gives the work up to two owners. Management assesses internal control over financial reporting and reports on it in the 10-K. Section 404 requires registered public accounting firms to “attest to and report on” management’s assessment, but not at every issuer: “SOX Section 404(c) exempts from Section 404(b) any issuer that is neither a large accelerated filer nor an accelerated filer,” and the JOBS Act of 2012 exempts emerging growth companies from Section 404(b).[8] The SEC’s 2020 amendments moved certain low-revenue issuers out of the accelerated filer categories; such an issuer still has to “establish and maintain ICFR and have management assess the effectiveness of ICFR,” without the auditor’s attestation.[8] Where the attestation applies, the auditor’s report under Auditing Standard No. 5, which the SEC approved on 2007-07-27, “will express one opinion” on whether the company maintained effective internal control as of its fiscal year-end.[2] To give it, the standard “requires the auditor to evaluate and test both the design and the operating effectiveness of internal control.”[2] The standard is now numbered AS 2201, “An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements,” the title the PCAOB uses for it in its 2024 rulemaking.[3]

The SEC’s guidance for management describes “a top-down, risk-based evaluation” and calls an evaluation that follows it “one way to satisfy the evaluation requirements” of Exchange Act Rules 13a-15(c) and 15d-15(c).[1]

## Scoping and risk assessment in the SEC guidance

The guidance sets the order. Management “identifies the risks to reliable financial reporting, evaluates whether controls exist to address those risks, and evaluates evidence about the operation of the controls.”[1] The purpose is a reasonable basis for the annual assessment of whether any material weakness exists at fiscal year-end.[1]

Scoping is where an AI component first shows up, because the guidance asks about controls by what they depend on. Controls “may be automated, dependent upon IT functionality, or a combination of both manual and automated procedures,” and in that case management’s evaluation “generally considers the design and operation of the automated or IT dependent application controls and the relevant IT general controls over the applications providing the IT functionality.”[1] The guidance adds that “the proper and consistent operation of automated controls or IT functionality often depends upon effective IT general controls.”[1]

[Diagram] The SOX testing sequence, from the SEC's 2007 guidance and AS 2201, with the AI question at each step. 1: Identify the financial reporting risks. Management identifies the risks to reliable financial reporting, top down and risk based. 2: Identify the controls that address them. Controls may be manual, automated, IT dependent or a mix, and automated controls depend on effective IT general controls. 3: Evaluate design. Whether the controls, if operating properly, can prevent or detect misstatements that could be material. 4: Evaluate operating effectiveness. Whether the control operated as designed and the person performing it has the authority and competence to do so, by direct tests, on-going monitoring or both. 5: Evaluate deficiencies. A deficiency is evaluated to decide whether a material weakness exists: a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.

## Walkthroughs, design effectiveness and operating effectiveness

Design is a judgment about whether the controls, “if operating properly, can effectively prevent or detect misstatements that could result in material misstatements in the financial statements.”[1] Operating effectiveness asks something different: “whether the control is operating as designed and whether the person performing the control possesses the necessary authority and competence to perform the control effectively.”[1]

Evidence of operation, the guidance says, “comes from direct tests of controls, on-going monitoring, or a combination of both.”[1] Direct tests are periodic and done by people with “a high degree of objectivity relative to the controls being tested”; on-going monitoring includes self-assessment by the people who run the control.[1] How much evidence is needed scales with risk. Among the factors in whether a control might fail, the guidance lists “the type of control (that is, manual or automated) and the frequency with which it operates,” its complexity, the risk of management override and the judgment required.[1]

The walkthrough is the auditor’s tool for following a transaction through the process and the controls. The SEC’s 2007 order records that a small number of commenters wanted clarification on relying on the work of others “when conducting walkthroughs,” and that the Commission found the standard “sufficiently clear about the extent to which the auditor can use the work of others.”[2]

## Sample sizes and automated controls in AS 2201

The guidance treats automated controls as cheaper to evidence once IT general controls are in place. “When adequate information technology ('IT') general controls exist and management has determined that the operation of such controls is effective, management may determine that automated controls are more efficient to evaluate than manual controls.”[1] Its example of a lower-risk control is an automated one “subject to a system that is stable (that is, has not undergone significant change) and is supported by effective IT general controls.”[1]

That sentence is where an AI component parts company with a classic automated control. A matching rule in an ERP runs the same way until its code is changed, and change management is built to see that change. A model that a vendor retrains has changed even if no one at the company edited a line of code. The guidance’s phrase “has not undergone significant change” becomes a question to answer, not an assumption.

The PCAOB’s 2024 amendments, which take effect for audits of fiscal years beginning on or after December 15, 2025, point the same way for the auditor’s own tools: among their changes, they “Emphasize the importance of controls over information technology.”[3] The release states that it does not address “other technology applications used in audits (e.g., blockchain or artificial intelligence).”[3]

The auditor’s side of the same test was made lighter in 2007, and the SEC’s approval order lists how. Auditing Standard No. 5 eliminated procedures “by, among other things, removing the requirement to evaluate management’s process; permitting consideration of knowledge obtained during previous audits; refocusing the multi-location testing requirements on risk rather than coverage; and removing unnecessary barriers to using the work of others.”[2] It also directs the auditor “to tailor the audit to reflect the attributes of smaller, less complex companies.”[2]

Two of those changes bear on an AI component. Knowledge from previous audits lets an auditor lean on what it learned about a stable system last year, which a retrained model undercuts. And the standard lets the auditor use the work of others, which puts weight on whoever inside the company tests the model’s controls.[2] The PCAOB received 175 comment letters on the draft standard and the Commission received 37 on the version it approved.[2]

## Where an AI component changes the testing question

Each step in the sequence above has an AI line. They come down to three tests the 2007 documents already require, applied to a new object.

- **Scope.** If a model produces an estimate, a match or a classification that reaches the statements, the controls over that output are in scope, and so are the IT general controls over the model, its data and its changes.[1]
- **Design.** A review control over a model’s output is only as good as the reviewer’s ability to tell a wrong output from a right one. The design question is whether the control, “if operating properly,” would catch it.[1]
- **Operation.** The person performing a control must have “the necessary authority and competence.”[1] When the performer is a model with a reviewer behind it, the evidence has to cover both.

## What 10-Ks say about testing, counted by year

The words of the test are rarer in 10-Ks than the test itself. EDGAR full-text search, run one calendar year at a time and reduced to distinct filings, finds the exact phrase “information technology general controls” in 84 of the 6,933 10-Ks filed in 2021 (1.2%) and in 251 of the 6,431 filed in 2025 (3.9%).[4][5] “Automated controls” went from 53 filings (0.8%) to 110 (1.7%).[4][5] Many filers write “IT general controls” or “ITGCs” instead, which these exact-phrase counts do not catch, so the figures are a floor for the vocabulary, not a count of companies that test IT controls.

The 2025 figure is the year the count stopped growing: 257 filings used the IT phrase in 2024 and 251 in 2025.[4]

[Figure] The exact phrase “information technology general controls” appeared in 3.9% of 10-Ks filed in 2025, up from 1.2% in 2021. Share of 10-Ks filed by Calendar year of filing. "information technology general controls": 2021 1.2%, 2022 1.6%, 2023 2.7%, 2024 3.9%, 2025 3.9%. "automated controls": 2021 0.8%, 2022 1.2%, 2023 1.3%, 2024 1.5%, 2025 1.7%. Share of all 10-K filings in each calendar year whose text contains the phrase anywhere. Most uses sit in Item 9A or in a material weakness disclosure, but the count does not separate them.

## What filers say about AI or automation in testing

Putting the two vocabularies side by side gives a rough measure of overlap. Among 10-Ks that contain “artificial intelligence”, the share that also contain “information technology general controls” rose from 8 of 836 in 2021 (1.0%) to 127 of 3,271 in 2025 (3.9%); the share with “automated controls” stayed between 1.8% and 2.8%, 83 filings in 2025.[4] The phrase “material weakness” is far more common beside AI, in 2,623 of the 3,271 filings in 2025, because risk factors routinely warn of material weaknesses as a general risk.[4] Both phrases can sit anywhere in a filing, so these counts are of filings that use both sets of words, not of passages that join them.

[Figure] 127 of the 3,271 10-Ks naming artificial intelligence in 2025 also used “information technology general controls”. 10-K filings by Calendar year of filing. with "information technology general controls": 2021 8, 2022 33, 2023 41, 2024 102, 2025 127. with "automated controls": 2021 15, 2022 28, 2023 29, 2024 67, 2025 83. 10-K filings in each calendar year whose text contains "artificial intelligence" and the second phrase, anywhere in the filing.

The clearest statements come from smaller companies remediating a weakness, in 10-Q Item 4 rather than in the 10-K. One amended 10-Q describes an AI tool as a supplemental control.[6]

[Excerpt] "Implementing technology-assisted financial review procedures, including AI-enabled analytical testing, as a supplemental control designed to identify period inconsistencies, mathematical discrepancies, unusual variances, internal inconsistencies and other potential reporting anomalies for further human review" (https://www.sec.gov/Archives/edgar/data/1166708/000149315226039921/form10-qa.htm)

TOMI Environmental Solutions listed among its remediation actions in a 10-Q filed 2026-08-14 that it “Integrated AI-assisted technical research tools to support complex U.S. GAAP research and financial statement disclosures.”[7] Both passages are in this site’s [filings log](https://cfonews.ai/filings) under the CONTROLS label.

## From test result to deficiency evaluation

A failed test is the start of the last step. “If management determines that a deficiency in ICFR exists, it must be evaluated to determine whether a material weakness exists.”[1] The definition the guidance cites is the one in Rule 12b-2 and Rule 1-02 of Regulation S-X: a material weakness is “a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the registrant’s annual or interim financial statements will not be prevented or detected on a timely basis.”[1]

For a model-driven control, the evaluation turns on reach. A failed review of one model output is one deficiency in one account. A failure in the IT general controls over the model, its access or its change management, touches every control that depends on it, which is the same reasoning the guidance applies to any IT dependency.[1] What companies say about AI and internal control in their own words is collected in [AI and internal control over financial reporting](https://cfonews.ai/explainers/ai-and-internal-control) and [AI in the controls section](https://cfonews.ai/explainers/ai-in-the-controls-section), and the passages are filed under the [controls and audit topic](https://cfonews.ai/topics/controls-and-audit).

Sources:
[1] SEC Release No. 33-8810, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting, 2007-06-20. https://www.sec.gov/rules/interp/2007/33-8810.pdf
[2] SEC Release No. 34-56152, order approving PCAOB Auditing Standard No. 5, 2007-07-27. https://www.sec.gov/rules/pcaob/2007/34-56152.pdf
[3] PCAOB Release No. 2024-007, amendments on technology-assisted analysis, 2024-06-12. https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket-052/2024-007-adoptingrelease.pdf?sfvrsn=28f44e9e_2
[4] SEC EDGAR full-text search, form 10-K, phrases "information technology general controls", "automated controls" and "material weakness", alone and with "artificial intelligence", calendar years 2021 to 2025, 2026-11-10. https://efts.sec.gov/LATEST/search-index?q=%22information%20technology%20general%20controls%22&forms=10-K
[5] SEC EDGAR quarterly form indexes, form 10-K, 2021 to 2025, 2026-11-10. https://www.sec.gov/Archives/edgar/full-index/
[6] SEC EDGAR, Brownie's Marine Group, Inc. Form 10-Q/A, Item 4, 2026-08-24. https://www.sec.gov/Archives/edgar/data/1166708/000149315226039921/form10-qa.htm
[7] SEC EDGAR, TOMI Environmental Solutions, Inc. Form 10-Q, Item 4, 2026-08-14. https://www.sec.gov/Archives/edgar/data/314227/000165495426007620/tomz_10q.htm
[8] SEC Release No. 34-88365, Accelerated Filer and Large Accelerated Filer Definitions, 2020-03-12. https://www.sec.gov/files/rules/final/2020/34-88365.pdf

### AI disclosure in SEC filings: how many 10-Ks and 10-Qs mention AI, counted from EDGAR, 2019 to 2026

URL: https://cfonews.ai/explainers/ai-disclosure-in-sec-filings-counted
Published: 2026-11-10
Question: How many companies mention AI in their 10-K?
How many 10-Ks mention artificial intelligence? Counted from EDGAR by quarter since 2019, with generative AI, 10-Qs and industry splits, and every query listed.

In 2025, 3,271 of the 6,431 10-K annual reports filed on EDGAR, 50.9%, contained the phrase “artificial intelligence”, up from 432 of 6,660 (6.5%) in 2019.[1][4] In 2026 to 2026-11-10 the count is 3,850 of 6,183 10-Ks filed, 62.3%, and 1,206 of them (19.5%) also use the phrase “generative AI”, a term that appeared in two 10-Ks in all of 2022.[1][2][4]

Those are counts of filings, not of companies’ views. A 10-K counts once whether it names artificial intelligence in one boilerplate risk factor or across forty pages of a business description, and the counts say nothing about what a company does with AI in its own finance work. This site’s [filings log](https://cfonews.ai/filings) does that part by hand.

## The question and the rule for counting

The question people put to search engines is “how many companies mention AI in their 10-K.” The answer here is a count of 10-K filings, which is close to a count of companies because a company files one 10-K a year, though not equal to it: an amended 10-K/A is not counted, and a company that changes its fiscal year can file two 10-Ks in one calendar year.

The rule is simple and strict. A filing counts when the full text of any document in it contains the exact phrase. “AI” alone is not searched, because the two letters also match tickers, company names and other words, so a filing that only ever writes “AI” is not in these counts. The phrase “generative AI” is counted separately, and so is “machine learning” in the table at the foot.

## Method: queries, windows, denominators and the 10,000-hit cap

EDGAR full-text search returns at most 10,000 hits for a query, so no query here covers more than one form in one calendar quarter of filing dates.[1] Every page of results for every quarter from 2019-Q1 to 2026-Q4 was read, and the hits, which are documents, were reduced to distinct accession numbers, which are filings. The largest 10-K quarter was 2026-Q1, with 3,261 matching documents in 3,216 filings.[1]

The denominators are EDGAR’s quarterly form indexes, which list every filing by form type.[4] Each index was read and its 10-K and 10-Q accession numbers counted, amendments excluded. Over the eight calendar years the 10-K count runs from 6,183 (2026, to 2026-11-10) to 7,538 (2022).[4]

The queries, run on 2026-11-10, were the exact phrases “artificial intelligence” and “generative AI” for forms 10-K and 10-Q, with the filer’s SIC code kept for 10-Ks filed in 2025.[1][2][3] The scripts that ran them and computed every figure on this page are in the site’s repository under scripts/cfonews-ai/articles, and the counts they produced are committed beside the article.

## Share of 10-Ks mentioning AI, by year

[Figure] One 10-K in 15 named artificial intelligence in 2019; one in two did in 2025. Share of 10-Ks filed by Calendar quarter of filing. "artificial intelligence": 2019-Q1 5.5%, 2019-Q2 8%, 2019-Q3 7.6%, 2019-Q4 11.3%, 2020-Q1 7.4%, 2020-Q2 10.4%, 2020-Q3 11.2%, 2020-Q4 11.6%, 2021-Q1 10.3%, 2021-Q2 19.4%, 2021-Q3 14.4%, 2021-Q4 18%, 2022-Q1 14.3%, 2022-Q2 18.4%, 2022-Q3 16.6%, 2022-Q4 16.9%, 2023-Q1 15.5%, 2023-Q2 24.6%, 2023-Q3 30.3%, 2023-Q4 27.7%, 2024-Q1 36.1%, 2024-Q2 32.7%, 2024-Q3 44.9%, 2024-Q4 41.2%, 2025-Q1 51.1%, 2025-Q2 48.1%, 2025-Q3 48.2%, 2025-Q4 55.3%, 2026-Q1 62.7%, 2026-Q2 58.7%, 2026-Q3 61.3%. "generative AI": 2019-Q1 0%, 2019-Q2 0%, 2019-Q3 0%, 2019-Q4 0%, 2020-Q1 0%, 2020-Q2 0%, 2020-Q3 0%, 2020-Q4 0%, 2021-Q1 0%, 2021-Q2 0%, 2021-Q3 0%, 2021-Q4 0%, 2022-Q1 0%, 2022-Q2 0%, 2022-Q3 0%, 2022-Q4 0%, 2023-Q1 0.4%, 2023-Q2 0.8%, 2023-Q3 5.5%, 2023-Q4 5.5%, 2024-Q1 7.7%, 2024-Q2 4.9%, 2024-Q3 11.5%, 2024-Q4 11.9%, 2025-Q1 13.7%, 2025-Q2 9.9%, 2025-Q3 15.1%, 2025-Q4 15.6%, 2026-Q1 20%, 2026-Q2 15%, 2026-Q3 20.3%. Share of all 10-K filings in each calendar quarter whose text contains the phrase. Quarters with few 10-Ks (the second to fourth) move more than the first.

The rise has two steps. From 2019 to 2023 the share climbed by two to six points a year: 6.5%, 8.3%, 12.1%, 15.1% and 18.0%.[1][4] Then it doubled in a year, to 36.4% of 10-Ks filed in 2024, and passed half in 2025.[1][4]

| Calendar year | 10-Ks filed | Naming “artificial intelligence” | Share | Naming “generative AI” | Share |
|---|---|---|---|---|---|
| 2019 | 6,660 | 432 | 6.5% | 0 | 0.0% |
| 2020 | 6,508 | 543 | 8.3% | 0 | 0.0% |
| 2021 | 6,933 | 836 | 12.1% | 1 | 0.0% |
| 2022 | 7,538 | 1,139 | 15.1% | 2 | 0.0% |
| 2023 | 7,118 | 1,283 | 18.0% | 69 | 1.0% |
| 2024 | 6,631 | 2,412 | 36.4% | 511 | 7.7% |
| 2025 | 6,431 | 3,271 | 50.9% | 870 | 13.5% |
| 2026 (to 2026-11-10) | 6,183 | 3,850 | 62.3% | 1,206 | 19.5% |

The first-quarter numbers carry the most weight, because most companies have a December year-end and file their 10-K between January and March. In 2025-Q1, 2,560 of 5,007 10-Ks named artificial intelligence; in 2026-Q1, 3,216 of 5,132.[1][4]

## The 2024 jump, in the first quarter

First quarters isolate the December year-end filers, the bulk of 10-K filers, and show where the jump sat. In 2023-Q1, 851 of the quarter’s 10-Ks named artificial intelligence, 15.5%. In 2024-Q1 the count was 1,713, or 36.1%: the share more than doubled between two filing seasons twelve months apart.[1][4] It rose again to 51.1% in 2025-Q1 (2,560 filings) and 62.7% in 2026-Q1 (3,216).[1][4]

The generative AI count moved in the same season, from 20 10-Ks in 2023-Q1 to 365 in 2024-Q1.[2] The count cannot say why companies added the words; the passages themselves can. In this site’s filings log, 27 of the 41 10-K entries were filed in 2026-Q1, and each quotes what the company wrote.

## Generative AI: when the term enters filings

“Generative AI” is close to absent before 2023. Full-text search finds it in one 10-K filed in 2021 and two in 2022.[2] It reached 69 10-Ks in 2023, then 511 in 2024 and 870 in 2025.[2] In 2026 to 2026-11-10, 1,206 10-Ks use the phrase, about one in three of those that name artificial intelligence at all.[1][2] Measured that way, as a share of the 10-Ks that name artificial intelligence, generative AI went from 5.4% in 2023 (69 of 1,283) to 21.2% in 2024, 26.6% in 2025 and 31.3% in 2026 to date.[1][2]

## The same count for 10-Qs

Quarterly reports carry less narrative than annual reports, and the count shows it. In 2019, 564 of 17,969 10-Qs filed contained “artificial intelligence”, 3.1%.[3][4] The share passed 10% in 2023-Q4, reached 22.2% for 2025 as a whole and 32.4% in 2026-Q3, when 10-Qs for the quarter to September came in.[3][4] For 2026 to 2026-11-10, 4,796 of 14,638 10-Qs name the phrase.[3][4]

[Figure] In 10-Qs the phrase moved later and slower, from 3.1% of quarterly reports in 2019 to 32.4% in 2026-Q3. Share of 10-Qs filed by Calendar quarter of filing. "artificial intelligence": 2019-Q1 3.6%, 2019-Q2 2.8%, 2019-Q3 3.1%, 2019-Q4 3.4%, 2020-Q1 4.8%, 2020-Q2 3.4%, 2020-Q3 3.5%, 2020-Q4 3.6%, 2021-Q1 5.5%, 2021-Q2 3.9%, 2021-Q3 4%, 2021-Q4 4.9%, 2022-Q1 8.1%, 2022-Q2 5.4%, 2022-Q3 5.2%, 2022-Q4 5.8%, 2023-Q1 7.8%, 2023-Q2 6.8%, 2023-Q3 8.8%, 2023-Q4 10.2%, 2024-Q1 13.9%, 2024-Q2 14.9%, 2024-Q3 16.1%, 2024-Q4 17.2%, 2025-Q1 19.4%, 2025-Q2 21.2%, 2025-Q3 22.2%, 2025-Q4 23.8%, 2026-Q1 23%, 2026-Q2 29.6%, 2026-Q3 32.4%. "generative AI": 2019-Q1 0%, 2019-Q2 0%, 2019-Q3 0%, 2019-Q4 0%, 2020-Q1 0%, 2020-Q2 0%, 2020-Q3 0%, 2020-Q4 0%, 2021-Q1 0%, 2021-Q2 0%, 2021-Q3 0%, 2021-Q4 0%, 2022-Q1 0%, 2022-Q2 0%, 2022-Q3 0%, 2022-Q4 0%, 2023-Q1 0.1%, 2023-Q2 0.5%, 2023-Q3 1.6%, 2023-Q4 2.2%, 2024-Q1 2.3%, 2024-Q2 3.2%, 2024-Q3 3.4%, 2024-Q4 3.7%, 2025-Q1 3.3%, 2025-Q2 4.4%, 2025-Q3 4.9%, 2025-Q4 5.3%, 2026-Q1 3.6%, 2026-Q2 5.7%, 2026-Q3 6.1%. Share of all 10-Q filings in each calendar quarter whose text contains the phrase, computed as for the 10-K chart.

The 10-Q line rises more steadily than the 10-K line because 10-Qs are spread across three quarters of the year and 10-Ks are bunched in the first.[4] “Generative AI” stays low in 10-Qs: 6.1% of those filed in 2026-Q3.[3][4]

## By SIC division

[Figure] Manufacturers filed the most 2025 10-Ks naming artificial intelligence, 1,150 of 3,271; drug makers and banks are large inside the bigger groups. SIC division by 10-K filings. 10-Ks naming "artificial intelligence": Manufacturing 1,150, Finance, insurance, real estate 734, Services 720, Transportation, communications, utilities 225, Retail trade 132, Mining 91, Wholesale trade 57, Construction 39, Agriculture, forestry, fishing 9. 10-K filings filed in calendar 2025 whose text contains “artificial intelligence”, by the SIC division of the filer’s code on EDGAR. 114 filings whose filer has no SIC code are left out.

EDGAR lists a Standard Industrial Classification code for most filers, and full-text search returns it with every hit.[1] Grouped into the SIC manual’s divisions, the 3,271 10-Ks filed in 2025 that name artificial intelligence come first from manufacturing (1,150), then finance, insurance and real estate (734) and services (720).[1] Transportation, communications and utilities follow with 225, retail with 132 and mining with 91.[1]

Inside the divisions, single codes stand out. Pharmaceutical preparations (SIC 2834) account for 248 of the manufacturing filings and biological products (2836) for 93; prepackaged software (7372) accounts for 196 of the services filings; real estate investment trusts (6798) for 133 and state commercial banks (6022) for 122 of the finance filings, by the SEC’s code list.[1][5] A count by division is not a share: the search caps at 10,000 hits, which rules out a whole-population query for the denominator in a single quarter, so this page reports where the filings come from, not how likely a company in each division is to use the phrase.

## Where the language sits in the 10-K

A phrase count cannot say which Item a mention sits in. Item 1A risk factors are where most of the 10-K passages this site logs come from: of the 41 10-K and 10-K/A entries in the [filings log](https://cfonews.ai/filings), 22 quote Item 1A, 10 Item 1, 3 Item 1C and 2 Item 7, and 4 give no Item. A typical Item 1A entry puts AI next to the finance function in one sentence.[6]

[Excerpt] "In the future, we may increasingly use automated tools, including AI and machine learning technologies, in connection with data analysis, financial reporting processes, and internal controls." (https://www.sec.gov/Archives/edgar/data/1434621/000162828026016084/tree-20251231.htm)

The controls section is the rarest home for the language. Of the 66 entries in the log, 2 carry the CONTROLS label, both quoting Item 4 of a 10-Q, against 32 RISK FACTOR entries. The two are described in this site’s [SOX testing explainer](https://cfonews.ai/explainers/sox-testing-ai-controls-explained).

## The queries, for anyone who wants to rerun them

Each line is one EDGAR full-text search, run once per calendar quarter from 2019-01-01 to 2026-11-10, every page read:

- “artificial intelligence”, form 10-K, and the same for form 10-Q
- “generative AI”, form 10-K, and the same for form 10-Q
- “artificial intelligence”, form 10-K, filed in 2025, with the filer’s SIC code kept

The denominators are the 32 quarterly form indexes from 2019 QTR1 to 2026 QTR4, counted for form types 10-K and 10-Q.[4] The quarter-by-quarter counts are in the tables under each chart (“The numbers”), and the script that reruns everything is scripts/cfonews-ai/articles/research.mjs in the site’s repository. A full rerun is about 600 search requests at four a second, plus the 32 index files.

## What the counts cannot tell

Three limits apply to every number above. First, a phrase hit is not a disclosure about AI in the business. Boilerplate counts: a forward-looking-statements legend listing “artificial intelligence” among risks, a cybersecurity paragraph about AI-enabled phishing, an exhibit. Second, the counts are of filings in the stated windows. They are not extrapolated to companies that do not file with the SEC, and a 10-K is counted in the quarter it was filed, not the fiscal year it covers. Third, the denominator includes every 10-K filer: operating companies, shell companies, trusts and funds that file on Form 10-K.

What the counts do show is timing. The jump from 18.0% of 10-Ks in 2023 to 36.4% in 2024 happened in one annual cycle, and the term “generative AI” went from two filings to 870 in three years.[1][2]

For how to read a risk factor once you have found one, see [how to read an AI risk factor](https://cfonews.ai/explainers/how-to-read-an-ai-risk-factor). How the filings log itself is assembled is on the [methodology page](https://cfonews.ai/methodology), and the controls side of the same filings is in the [controls and audit topic](https://cfonews.ai/topics/controls-and-audit).

Sources:
[1] SEC EDGAR full-text search, form 10-K, phrase "artificial intelligence", run quarter by quarter from 2019-01-01, 2026-11-10. https://efts.sec.gov/LATEST/search-index?q=%22artificial%20intelligence%22&forms=10-K
[2] SEC EDGAR full-text search, form 10-K, phrase "generative AI", run quarter by quarter from 2019-01-01, 2026-11-10. https://efts.sec.gov/LATEST/search-index?q=%22generative%20AI%22&forms=10-K
[3] SEC EDGAR full-text search, form 10-Q, phrases "artificial intelligence" and "generative AI", run quarter by quarter, 2026-11-10. https://efts.sec.gov/LATEST/search-index?q=%22artificial%20intelligence%22&forms=10-Q
[4] SEC EDGAR quarterly form indexes, 2019 QTR1 to 2026 QTR4, forms 10-K and 10-Q, 2026-11-10. https://www.sec.gov/Archives/edgar/full-index/
[5] SEC, Standard Industrial Classification (SIC) code list, 2026-11-10. https://www.sec.gov/search-filings/standard-industrial-classification-sic-code-list
[6] SEC EDGAR, LendingTree, Inc. Form 10-K for 2025, Item 1A, 2026-03-09. https://www.sec.gov/Archives/edgar/data/1434621/000162828026016084/tree-20251231.htm

### ASU 2025-06 and internal-use software: what changed, and what 10-Q filers say about it

URL: https://cfonews.ai/explainers/asu-2025-06-internal-use-software-explained
Published: 2026-11-10
Question: What is FASB ASU 2025-06 and how does it change the accounting for internal-use software?
FASB's ASU 2025-06 drops the project stages for internal-use software. What the update says, and what 7,014 10-Q and 10-K filings have said about it, counted.

ASU 2025-06 is the Financial Accounting Standards Board’s September 2025 update to Subtopic 350-40 that removes the project stages from internal-use software accounting: a company starts capitalizing costs once management has authorized and committed to funding the project and it is probable the software will be completed and used as intended.[1] From 2025-09-01 to 2026-11-10, 7,014 10-Q and 10-K filings on EDGAR named “ASU 2025-06”, and most of the ones this site read say the company is still working out what it will change.[2]

The update is effective for annual reporting periods beginning after December 15, 2027, and interim periods within them, with early adoption allowed from the start of an annual period.[1] For a calendar-year company that is the 2028 fiscal year. Until then the disclosure sits where new standards always sit: the “recently issued accounting pronouncements” paragraph of the notes.

## What the ASU says, in FASB’s words

The Board says it is issuing the update “to modernize the accounting for software costs that are accounted for under Subtopic 350-40.”[1] The trigger was its 2021 agenda consultation. Preparers and practitioners told FASB that software accounting should be a top priority, because the guidance assumes a “prescriptive and sequential development method (for example, waterfall)” while many companies now build software “using an incremental and iterative development method (for example, agile).”[1] Under the old text, the ASU says, companies had “challenges in determining when to begin capitalizing internal-use software costs.”[1]

Scope is wide. The amendments apply to every entity subject to Subtopic 350-40, and to every entity that accounts for website development costs under Subtopic 350-50, which the update supersedes and folds into 350-40.[1] They do not touch Subtopic 985-20, the guidance for software to be sold, leased or marketed.[1]

FASB issued the proposal on October 29, 2024, with comments due January 27, 2025, and received 40 comment letters.[1] The basis for conclusions records that a majority of respondents supported the proposal, and that many raised operability concerns about the significant-development-uncertainty test and a proposed cash flow presentation requirement.[1]

## The old model: three project stages

The Subtopic as it stood sorted every cost by when it was incurred. The ASU prints the old paragraphs struck through, which makes the old model easy to read off the page.[1]

- **Preliminary project stage.** Costs were expensed. The superseded glossary entry describes the work of the stage: making strategic decisions to allocate resources between projects, determining performance and system requirements, inviting vendor demonstrations and exploring alternatives such as make or buy.[1]
- **Application development stage.** The superseded paragraph 350-40-25-2 said internal and external costs “incurred to develop internal-use computer software during the application development stage shall be capitalized.”[1]
- **Post-implementation-operation stage.** Training and maintenance costs incurred in the stage were expensed (superseded paragraph 350-40-25-6).[1]

Capitalization began under old paragraph 350-40-25-12 when the preliminary project stage was completed and management, “with the relevant authority,” authorized and committed to funding the project, and it was probable the project would be completed and the software used as intended.[1]

## The new model: funding, probable to complete, and significant development uncertainty

The amendments remove every reference to project stages.[1] Capitalization begins when both of these occur:

1. Management has authorized and committed to funding the software project.
2. It is probable that the project will be completed and the software will be used to perform the function intended, which the ASU calls the “probable-to-complete recognition threshold.”[1]

The second condition carries a test that did not exist before. In assessing the threshold, a company must consider whether there is “significant development uncertainty”, and paragraph 350-40-25-12A says the threshold is not met until that uncertainty is resolved.[1]

[Excerpt] "If significant development uncertainty exists, the probable-to-complete recognition threshold in paragraph 350-40-25-12(c) is not met until that significant development uncertainty has been resolved." (https://storage.fasb.org/ASU%202025-06.pdf)

The two factors in the paragraph are, first, that the software has “technological innovations or novel, unique, or unproven functions or features” whose uncertainty has not been resolved “through coding and testing”; and second, that the significant performance requirements have not been identified or “continue to be substantially revised.”[1]

Two disclosure changes come with it. The property, plant and equipment disclosures of Subtopic 360-10 apply to all capitalized internal-use software costs however they are presented, and the intangibles disclosures in paragraphs 350-30-50-1 through 50-3 do not.[1]

FASB’s own expectation of the effect is narrow. The Board “expects that capitalization of internal-use software costs generally will not change significantly for most types of software,” and expects a possible decrease in capitalization for software to be provided through a cloud computing arrangement.[1]

## Effective dates and the three transition methods

Every entity has the same date: annual reporting periods beginning after December 15, 2027, and interim periods within those annual periods. Early adoption is permitted as of the beginning of an annual reporting period.[1] The ASU permits three transition approaches.[1]

- **Prospective.** Apply the amendments to new software costs incurred from the beginning of the period of adoption, for all projects, including projects in process.
- **Modified.** Prospective for new costs, except for in-process projects that meet the old capitalization requirements but not the new ones; for those, derecognize capitalized costs through a cumulative-effect adjustment to opening retained earnings at the date of adoption.
- **Retrospective.** Recast comparative periods and record a cumulative-effect adjustment to opening retained earnings at the beginning of the first period presented.

## What filers have said so far: counts by month and by stance

The count is of filings, not of mentions. Each month from September 2025 to November 2026 was searched on EDGAR full-text search for the exact phrase “ASU 2025-06” in forms 10-Q and 10-K, every page of results was read, and hits were reduced to distinct accession numbers, so a filing that names the standard ten times counts once.[2] The result is 7,014 filings: 5,354 10-Qs and 1,660 10-Ks.[2] For scale, EDGAR’s quarterly form indexes list 6,431 10-Ks filed in calendar 2025.[3]

[Figure] Filings naming ASU 2025-06 peak in the months 10-Qs and 10-Ks are due. Filings by Filing month. 10-Q: 2025-09 2, 2025-10 333, 2025-11 843, 2025-12 95, 2026-01 60, 2026-02 125, 2026-03 38, 2026-04 275, 2026-05 1,028, 2026-06 81, 2026-07 325, 2026-08 991, 2026-09 77, 2026-10 310, 2026-11 771. 10-K: 2025-09 1, 2025-10 7, 2025-11 48, 2025-12 26, 2026-01 16, 2026-02 807, 2026-03 488, 2026-04 60, 2026-05 41, 2026-06 38, 2026-07 22, 2026-08 44, 2026-09 27, 2026-10 26, 2026-11 9. 10-Q and 10-K filings whose text contains "ASU 2025-06", by calendar month of the filing date, from September 2025.

The months follow the filing calendar, which is what a standard moving through the “recently issued” note looks like. Three filings named the ASU in September 2025, the month it was issued. Then 340 in October, 891 in November as third-quarter 10-Qs came in, 932 in February 2026 as calendar-year 10-Ks arrived, 1,069 in May and 1,035 in August.[2] The quarters in between drop to a few hundred. In the first 10 days of November 2026, 780 filings had already named it.[2]

A count of names says nothing about what companies said, so a sample was read. Up to 14 filings were drawn at random from each month’s search results, 197 in all, and each filing’s own text was opened on sec.gov. The reader kept every sentence naming 2025-06 and up to five sentences after it, stopping at a sentence about a different update. In 7 of the 197, no such sentence was found in the main document, which leaves 190 coded filings: 133 10-Qs and 57 10-Ks.[2]

The codebook has four rules, applied in order, the first match winning. A filing is coded as having adopted the standard if a kept sentence says it early adopted or adopted it; as expecting no material effect if a sentence says the effect is not expected to be material or significant; as evaluating if a sentence says it is evaluating, assessing or analyzing the effect; and otherwise as describing the standard without a stance. The rules are regular expressions, published with the data under the chart, so anyone can recode the same sentences.

[Figure] Three in four sampled filings say the company is still evaluating ASU 2025-06; 7 of 190 matched the adoption rule. Stance coded from the filing's own sentences by Sampled filings. Says it has early adopted: 10-Q 7, 10-K 0, Both 7. Expects no material effect: 10-Q 19, 10-K 3, Both 22. Says it is evaluating the effect: 10-Q 97, 10-K 46, Both 143. Describes the standard, states no stance: 10-Q 10, 10-K 8, Both 18. A seeded random sample of 10-Q and 10-K filings naming ASU 2025-06, up to 14 per filing month, each read on sec.gov and coded by the codebook in the text. The first rule that matches wins.

Evaluating is the default. 143 of the 190 filings, 75%, say the company is evaluating or assessing the effect.[2] A typical sentence, from a Progress Software 10-Q filed 2025-09-29: “The Company is currently evaluating the impact that the adoption of this standard will have on its consolidated financial statements and disclosures.”[4] 22 filings, 12%, go further and say they expect no material or significant effect, often in the same sentence; Southwest Airlines wrote on 2025-10-23 that it “is evaluating this new standard, but does not expect it to have a significant impact on its financial statement presentation or results.”[5] Under the codebook’s order, that filing counts as expecting no material effect.

Seven filings, all 10-Qs, matched the adoption rule. Two state it plainly. Group 1 Automotive’s 10-Q filed 2026-10-29 says the company “adopted ASU 2025-06 … on a prospective basis effective January 1, 2026.”[6] SANUWAVE Health’s 10-Q filed 2026-11-10 describes its internal-use software costs as accounted for under ASC 350-40 “as amended by Accounting Standards Update (“ASU”) No. 2025-06, which the Company early adopted prospectively effective January 1”.[7] Both chose the prospective method. None of the 57 sampled 10-Ks matched the adoption rule.[2] The remaining 18 filings describe the standard without a stance.

The effective date is quoted consistently. 132 of the 190 coded filings repeat the ASU’s own words for it, periods “beginning after December 15, 2027.”[1][2]

## AI development costs: what the ASU says and leaves open

The ASU takes up the question in two paragraphs of its basis for conclusions, and leaves it open. Paragraph BC66 of the basis for conclusions states that Subtopic 350-40 “does not provide specific guidance for AI development costs, and the amendments in this Update do not specifically address how to apply the current guidance to those costs.”[1] Some comment letters asked FASB to clarify whether parts of the Subtopic apply to training an AI model and to data conversion costs.[1]

The Board declined. In BC67 it decided “not to provide specific guidance for training an AI model and data conversion costs,” and called changes to clarify which costs are eligible for capitalization beyond the scope of the targeted improvements.[1]

What the text does say still bears on an AI build. The first factor of significant development uncertainty is written around “technological innovations or novel, unique, or unproven functions or features” that coding and testing have not yet resolved.[1] Whether a given model-training cost is a development cost at all is the question FASB left open. The amended paragraph 350-40-25-5 keeps data conversion costs expensed except as paragraph 350-40-30-1(d) allows, and moves the old rule that software for accessing or converting old data is capitalized into that paragraph.[1]

## Where to find the disclosure in a 10-Q or 10-K

In the sample, the paragraph sits in the notes to the financial statements, in the note on accounting policies. For 96 of the 190 coded filings, the reader found a short heading line containing the word “pronouncements” within the 4,000 characters before the first mention, such as “Recently Issued Accounting Pronouncements” or “Recent Accounting Pronouncements Not Yet Adopted”; the rest use headings such as “Recently Issued Accounting Standards” or run the standard into a policy paragraph.[2] Most of the paragraphs follow one order: the standard’s number and title, a sentence or two on what it changes, the effective date, and the company’s stance.

Three things in that paragraph are worth reading closely. The stated effective date should match the ASU’s: annual periods beginning after December 15, 2027.[1] The stance verb shows how far the work has gone. And a company that has early adopted must say which of the three transition methods it chose, because the ASU makes the choice the company’s.[1]

For how companies describe AI in their own finance work, see [AI in companies’ own finance work](https://cfonews.ai/explainers/ai-in-own-finance-work), and for the controls side of the same filings, the [controls and audit topic](https://cfonews.ai/topics/controls-and-audit).

Sources:
[1] Financial Accounting Standards Board, Accounting Standards Update No. 2025-06, Subtopic 350-40 (issued September 2025), 2026-11-10. https://storage.fasb.org/ASU%202025-06.pdf
[2] SEC EDGAR full-text search, forms 10-K and 10-Q, phrase "ASU 2025-06", run month by month, 2026-11-10. https://efts.sec.gov/LATEST/search-index?q=%22ASU%202025-06%22&forms=10-K,10-Q&dateRange=custom&startdt=2025-09-01&enddt=2026-11-10
[3] SEC EDGAR quarterly form indexes, 2026-11-10. https://www.sec.gov/Archives/edgar/full-index/
[4] SEC EDGAR, Progress Software Corp Form 10-Q, 2025-09-29. https://www.sec.gov/Archives/edgar/data/876167/000087616725000143/prgs-20250831.htm
[5] SEC EDGAR, Southwest Airlines Co. Form 10-Q, 2025-10-23. https://www.sec.gov/Archives/edgar/data/92380/000009238025000140/luv-20250930.htm
[6] SEC EDGAR, Group 1 Automotive, Inc. Form 10-Q, 2026-10-29. https://www.sec.gov/Archives/edgar/data/1031203/000103120326000147/gpi-20260930.htm
[7] SEC EDGAR, SANUWAVE Health, Inc. Form 10-Q, 2026-11-10. https://www.sec.gov/Archives/edgar/data/1417663/000162828026072806/snwv-20260930.htm


## Explainers

### How to read an AI risk factor

URL: https://cfonews.ai/explainers/how-to-read-an-ai-risk-factor
Published: 2026-10-29
What to look for when a 10-K or 10-Q risk factor mentions AI and the finance function, with examples quoted from filings on sec.gov.

An AI risk factor that touches the finance function usually says one of three things: that AI output could be wrong and the error could reach the financial statements, that the company does or does not use AI in its reporting and controls, or that criminals use AI to impersonate people who can move money. Reading one well means asking which of those it says, how specific it is, and where in the filing it sits. This page uses passages from the [filings stream](https://cfonews.ai/filings) as examples; it describes them and does not grade them.

## Start with where it sits

In the filings quoted here, risk factors sit under the heading Item 1A, Risk Factors, in both 10-Ks and 10-Qs.[2][9] The same subject can appear elsewhere: in Item 1, Business, where a company describes what it sells; in Item 1C, Cybersecurity, where it describes how it manages cyber risk; or in management's discussion and analysis. Each entry on this site names the item heading the passage sits under, read from the filing's own headings, so the same words can be weighed in context.

## Question 1: is the risk about AI output reaching the numbers?

Some companies now name financial reporting among the places a faulty AI output could do harm. Super Micro Computer's 10-K filed 2026-08-31 says AI technology "may also produce inaccurate, incomplete, biased, misleading or fabricated responses that could lead to errors in our decision-making, solution development, financial reporting, compliance activities" and other activities.[2] Winnebago Industries' 10-K filed 2026-10-21 lists "forecasting, financial reporting processes, compliance activities" among the functions unreliable AI outputs could adversely affect.[3]

What to notice: both name financial reporting inside a longer list. Neither passage, as quoted, says the company uses AI in its close or its controls; it says outputs could cause errors in areas that include reporting. A reader who wants to know whether AI touches the ledger has to look for a separate statement of use.

## Question 2: does the company say whether it uses AI in reporting or controls?

A few filings answer directly. LendingTree's 10-K filed 2026-03-09 says: "In the future, we may increasingly use automated tools, including AI and machine learning technologies, in connection with data analysis, financial reporting processes, and internal controls."[4] That is a statement about possible future use, in a risk factor. Linkhome Holdings' 10-K filed 2026-03-26 says the opposite for the present: "we've yet to utilize AI within our financial reporting or internal control over financial reporting functions," while using AI in its application and in certain agent activities.[5]

UMB Financial's 10-K filed 2026-02-26 treats AI as a control area in its own right, saying the company must "develop and maintain information, financial reporting, disclosure, privacy, data protection, data security, artificial intelligence, and other controls."[6] Upstart's 10-Q filed 2025-11-04 lists "AI models and technology" beside "disclosure controls and procedures, internal control over financial reporting" as areas its ability to improve could be strained.[9]

What to notice: tense and modality. "We may increasingly use" (LendingTree), "we've yet to utilize" (Linkhome) and "must successfully develop and maintain" (UMB) are three different statements, and the risk factor heading alone does not tell them apart.

## Question 3: is the risk about impersonation and payments?

The most concrete finance-function passages concern fraud. TriplePoint Venture Growth BDC's 10-K filed 2026-03-04 names "AI-generated impersonations of senior executives to authorize fraudulent wire transfers."[7] Verano Holdings' 10-K filed 2026-03-12 says: "We have seen a global rise in cyber-enabled fraud, where bad actors use AI to impersonate executives or vendors to authorize fraudulent wire transfers."[8] These describe a mechanism that runs through accounts payable and treasury: a forged instruction from someone with authority to pay. The explainer on [deepfakes and payment fraud](https://cfonews.ai/explainers/deepfakes-and-payment-fraud) sets out what regulators have said about the same pattern.

## Question 4: is it specific to the company?

On 2024-02-13 SEC Chair Gary Gensler said that when disclosing material risks about AI, "investors benefit from disclosures particularized to the company, not from boilerplate language."[1] That is one official's view, not a rule, but it is a useful test. Phrases that recur across many filings, such as long lists of AI-enabled attack types, say less about one company than a sentence that names its own process, product or past experience. Verano's "we have seen" is a statement about the company's own observation; a list of threats that could apply to anyone is not.

## What a risk factor cannot tell you

A risk factor states that something could happen. It does not say the event has happened, how likely it is, or how large it would be, unless the company says so. Nothing on this page is a view on any company's securities. Each example above is footnoted to its filing on sec.gov and has an entry in the filings stream; the [companies index](https://cfonews.ai/companies) groups companies with more than one entry.

Sources:
[1] AI, Finance, Movies, and the Law, Chair Gary Gensler. U.S. Securities and Exchange Commission, 2024-02-13. https://www.sec.gov/newsroom/speeches-statements/gensler-ai-021324
[2] SEC EDGAR, Super Micro Computer, Inc. Form 10-K, 2026-08-31. https://www.sec.gov/Archives/edgar/data/1375365/000137536526000022/smci-20260630.htm
[3] SEC EDGAR, Winnebago Industries, Inc. Form 10-K, 2026-10-21. https://www.sec.gov/Archives/edgar/data/107687/000162828026066701/wgo-20260829.htm
[4] SEC EDGAR, LendingTree, Inc. Form 10-K, 2026-03-09. https://www.sec.gov/Archives/edgar/data/1434621/000162828026016084/tree-20251231.htm
[5] SEC EDGAR, Linkhome Holdings Inc. Form 10-K, 2026-03-26. https://www.sec.gov/Archives/edgar/data/2017758/000121390026034538/ea0281818-10k_linkhome.htm
[6] SEC EDGAR, UMB Financial Corp Form 10-K, 2026-02-26. https://www.sec.gov/Archives/edgar/data/101382/000119312526076496/umbf-20251231.htm
[7] SEC EDGAR, TriplePoint Venture Growth BDC Corp. Form 10-K, 2026-03-04. https://www.sec.gov/Archives/edgar/data/1580345/000158034526000008/tpvg-20251231.htm
[8] SEC EDGAR, Verano Holdings Corp. Form 10-K, 2026-03-12. https://www.sec.gov/Archives/edgar/data/1848416/000162828026017011/vrnof-20251231.htm
[9] SEC EDGAR, Upstart Holdings, Inc. Form 10-Q, 2025-11-04. https://www.sec.gov/Archives/edgar/data/1647639/000164763925000134/upst-20250930.htm

### AI washing: what the SEC has charged, and what it said

URL: https://cfonews.ai/explainers/ai-washing-enforcement
Published: 2026-10-29
The SEC's AI-washing cases against investment advisers, what the orders found, the penalties, and what agency officials said about AI claims.

"AI washing" is the SEC's shorthand for claiming to use artificial intelligence when a firm does not, or overstating how it does. The SEC's published cases so far have been settled actions against investment advisers, and they turned on ordinary antifraud and marketing rules rather than on any AI-specific rule.[1][2] This page sets out what the releases say. It is not legal advice.

## The first two cases: Delphia and Global Predictions

On 2024-03-18 the SEC announced settled charges against two investment advisers, Delphia (USA) Inc. and Global Predictions Inc., "for making false and misleading statements about their purported use of artificial intelligence (AI)."[1] The two firms agreed to pay $400,000 in total civil penalties: $225,000 for Delphia and $175,000 for Global Predictions.[1]

According to the SEC's order against Delphia, the Toronto-based firm made false and misleading statements from 2019 to 2023 in its SEC filings, in a press release and on its website about its purported use of AI and machine learning that incorporated client data in its investment process.[1] In the order against Global Predictions, the SEC found that the San Francisco-based firm made false and misleading claims in 2023 on its website and on social media; the release says the firm falsely claimed to be the "first regulated AI financial advisor" and misrepresented that its platform provided "[e]xpert AI-driven forecasts."[1] Global Predictions was also found to have violated the Marketing Rule, which the release says prohibits a registered investment adviser from disseminating any advertisement that includes an untrue statement of material fact.[1]

Without admitting or denying the findings, both firms consented to orders finding that they violated the Advisers Act, censuring them and ordering them to cease and desist.[1] SEC Chair Gary Gensler was quoted in the release: "We find that Delphia and Global Predictions marketed to their clients and prospective clients that they were using AI in certain ways when, in fact, they were not."[1] The Director of Enforcement, Gurbir S. Grewal, used the phrase directly, saying the agency was "committed to protecting them against those engaged in 'AI washing.'"[1]

## Rimar Capital

On 2024-10-10 the SEC announced charges against Rimar Capital USA, Inc., Rimar Capital, LLC, its owner and chief executive Itai Liptz, and a Rimar USA board member, Clifford Boro.[2] The release says they made false and misleading statements about Rimar LLC's purported use of AI to perform automated trading for client accounts, along with other material misrepresentations, and agreed to settle and pay $310,000 in total civil penalties.[2]

According to the order, Rimar raised nearly $4 million from 45 investors for an investment adviser that "was falsely described as having an AI-driven platform for trading securities." The order also found misrepresentations about the adviser's assets under management and its investment returns.[2] Without admitting or denying the findings, the parties consented to an order finding antifraud violations. Mr. Liptz agreed to pay disgorgement and prejudgment interest totaling $213,611 and a $250,000 civil penalty, and Mr. Boro agreed to pay a $60,000 civil penalty.[2] A co-chief of the SEC's Asset Management Unit, Andrew Dean, said the agency would "pursue those who lie about their firms' technological capabilities and engage in 'AI washing'."[2]

## What the SEC said about AI claims by public companies

The cases above involve advisers. For companies raising money from the public, the clearest statement in the record is a speech. On 2024-02-13 Chair Gensler told an audience at Yale Law School that if a company is raising money from the public, "it needs to be truthful about its use of AI and associated risk."[3] He said claims about prospects should have a reasonable basis, that investors should be told that basis, and that when disclosing material risks about AI, "investors benefit from disclosures particularized to the company, not from boilerplate language."[3] A speech states the speaker's own views, not a rule of the Commission.

## Where enforcement sits

On 2025-02-20 the SEC announced a Cyber and Emerging Technologies Unit, replacing its Crypto Assets and Cyber Unit, with approximately 30 fraud specialists and attorneys.[4] The first priority area the release lists is "fraud committed using emerging technologies, such as artificial intelligence and machine learning."[4]

## Reading the cases

Three points follow from the releases themselves. The claims at issue were public statements: filings, a press release, websites and social media.[1] The violations charged were existing ones, such as antifraud provisions and the Marketing Rule.[1][2] And the orders were settled without admission or denial.[1][2] For how public companies are describing AI in their own filings, see the [filings stream](https://cfonews.ai/filings) and the explainer on [how to read an AI risk factor](https://cfonews.ai/explainers/how-to-read-an-ai-risk-factor); the [regulation tracker](https://cfonews.ai/regulation) lists each release with its date.

Sources:
[1] SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence. U.S. Securities and Exchange Commission, 2024-03-18. https://www.sec.gov/newsroom/press-releases/2024-36
[2] SEC Charges Rimar Capital Entities and Owner Itai Liptz for Defrauding Investors by Making False and Misleading Statements About Use of Artificial Intelligence. U.S. Securities and Exchange Commission, 2024-10-10. https://www.sec.gov/newsroom/press-releases/2024-167
[3] AI, Finance, Movies, and the Law, Chair Gary Gensler. U.S. Securities and Exchange Commission, 2024-02-13. https://www.sec.gov/newsroom/speeches-statements/gensler-ai-021324
[4] SEC Announces Cyber and Emerging Technologies Unit to Protect Retail Investors. U.S. Securities and Exchange Commission, 2025-02-20. https://www.sec.gov/newsroom/press-releases/2025-42

### AI in the close, payables and planning: what filers describe

URL: https://cfonews.ai/explainers/ai-in-the-close-and-payables
Published: 2026-10-29
What companies' own SEC filings say about AI in invoice processing, reconciliation, the financial close, tax compliance and planning, quoted and linked.

Companies describe AI in finance operations in two kinds of filing passage: a company saying it applies AI to its own accounting work, and a company that sells finance software describing what its AI does. Both appear in the [filings stream](https://cfonews.ai/filings); this page sets them side by side, in the filers' own words, and keeps the two kinds apart. It does not compare or recommend any product.

## Companies describing their own finance work

The clearest own-use statement in the stream is OLB Group's 10-Q filed 2026-08-14: "In accounting and finance, we are developing AI agents intended to automate invoice processing, reconciliation, residual calculations, expense categorization and routine financial close activities."[1] The next sentence in the same filing sets a boundary: "Human review and oversight remain in place for underwriting, risk, compliance and financial reporting activities, and our internal control over financial reporting is not dependent on these tools."[1] The two sentences together describe work in development, with people still reviewing reporting and with the company's control framework stated not to rely on the tools.

Data I/O's 10-K filed 2026-04-16, in management's discussion and analysis, says "AI tools were applied" across several functions, ending with "internal business operations including financial reporting and analysis."[2] The passage uses the past tense and names financial reporting and analysis among the areas, without describing which tasks.

Two different verbs mark the difference between these statements and the risk factors elsewhere in the stream: "are developing" and "were applied" describe activity, while a risk factor says what "may" or "could" happen. See [how to read an AI risk factor](https://cfonews.ai/explainers/how-to-read-an-ai-risk-factor).

## Vendors describing finance products

Companies that sell finance software describe AI in their products, usually under Item 1, Business. These are descriptions of what is sold, in the seller's words, not evidence of how any customer uses it.

- **Payables and receivables.** BILL Holdings' 10-K filed 2026-08-20 says it uses AI "to deliver strategic finance capabilities in one integrated platform that includes accounts payable (AP), accounts receivable (AR), expenses, forecasting, procurement, and more."[3] Its 10-Q filed 2026-02-06 describes AI agents "to enable automatic W-9 collection, transaction reconciliation and invoice coding."[4]
- **Accounts payable automation.** Paylocity's 10-K filed 2026-08-05 describes an AI-powered product that covers the process "from vendor onboarding and invoice processing to bill coding, approvals, payments, syncing to the enterprise resource planning system and reconciliation."[5] XBP Global Holdings' 10-K filed 2026-03-31 says its accounts payable and procure-to-pay solution "leverages artificial intelligence to simplify the complexities of supplier onboarding, management, and invoice processing."[6]
- **The financial close.** A statement in BlackLine's 8-K exhibit filed 2026-05-05 describes its "vision for trusted, auditable AI" in the financial close.[8] Workday's 10-K filed 2026-03-06 says it announced AI agents "expected to be available in fiscal 2027," built to assist with finance processes "such as performance reviews, workforce planning, and financial close."[7]
- **Planning.** OneStream's 10-K filed 2026-02-26 says "CFOs recognize the potential of AI" for processes "such as demand forecasting, workforce planning and budgeting." The same filing says that for the finance function, "concerns about data accuracy, auditability, security and the specialized nature of financial processes present additional hurdles for the adoption of AI."[9]
- **Tax.** Vertex's 10-K filed 2026-02-24 says Kintsugi powered by Vertex "automates key tax compliance functions for small- and medium-sized businesses in an AI experience."[10]

The products are listed by function, and within each function in alphabetical order of company name.

## Words that recur

Across these passages the same tasks come up: invoice processing and coding, reconciliation, vendor onboarding, approvals and payments, and the close. The same qualifiers also recur: "auditable" (BlackLine), "auditability" (OneStream), "human review and oversight" (OLB). The filings do not report results, error rates or savings from these uses, and this page does not supply any.

## What this means for reading a filing

When a company says AI touches its own close or payables, the useful follow-on questions are the ones the filings themselves answer in some cases and not others: is the use live or in development, does a person review the output, and does the company say whether its internal control over financial reporting depends on it. The explainer on [AI and internal control over financial reporting](https://cfonews.ai/explainers/ai-and-internal-control) collects what filers say on that last point.

Sources:
[1] SEC EDGAR, OLB Group, Inc. Form 10-Q, 2026-08-14. https://www.sec.gov/Archives/edgar/data/1314196/000118518526003553/olbgroup10q063026.htm
[2] SEC EDGAR, Data I/O Corp Form 10-K, 2026-04-16. https://www.sec.gov/Archives/edgar/data/351998/000165495426003625/daio_10k.htm
[3] SEC EDGAR, BILL Holdings, Inc. Form 10-K, 2026-08-20. https://www.sec.gov/Archives/edgar/data/1786352/000162828026058238/bill-20260630.htm
[4] SEC EDGAR, BILL Holdings, Inc. Form 10-Q, 2026-02-06. https://www.sec.gov/Archives/edgar/data/1786352/000162828026005879/bill-20251231.htm
[5] SEC EDGAR, Paylocity Holding Corp Form 10-K, 2026-08-05. https://www.sec.gov/Archives/edgar/data/1591698/000159169826000069/pcty-20260630.htm
[6] SEC EDGAR, XBP Global Holdings, Inc. Form 10-K, 2026-03-31. https://www.sec.gov/Archives/edgar/data/1839530/000110465926037421/xbp-20251231x10k.htm
[7] SEC EDGAR, Workday, Inc. Form 10-K, 2026-03-06. https://www.sec.gov/Archives/edgar/data/1327811/000132781126000014/wday-20260131.htm
[8] SEC EDGAR, BlackLine, Inc. Form 8-K, Exhibit 99.1, 2026-05-05. https://www.sec.gov/Archives/edgar/data/1666134/000117184326003023/exh_991.htm
[9] SEC EDGAR, OneStream, Inc. Form 10-K, 2026-02-26. https://www.sec.gov/Archives/edgar/data/1889956/000119312526076771/ck0001889956-20251231.htm
[10] SEC EDGAR, Vertex, Inc. Form 10-K, 2026-02-24. https://www.sec.gov/Archives/edgar/data/1806837/000110465926019165/verx-20251231x10k.htm

### Deepfakes and payment fraud: what regulators have told finance teams

URL: https://cfonews.ai/explainers/deepfakes-and-payment-fraud
Published: 2026-10-29
What FinCEN, the Federal Reserve and Treasury have published about deepfake fraud, and the payment controls their documents describe.

US regulators have described deepfake fraud as a payments problem as much as a technology problem: generative AI is used to imitate a trusted person's voice, face or documents so that someone moves money. FinCEN has published red flags for it, and a Federal Reserve governor has set out the controls banks and their customers use against it.[1][2] This page sets out what those documents say. It does not tell any company what controls to adopt.

## What FinCEN said

On 2024-11-13 the Financial Crimes Enforcement Network, the Treasury bureau that administers the Bank Secrecy Act, issued an alert on fraud schemes that use deepfake media created with generative AI tools.[1] FinCEN said the alert explains the typologies of these schemes, gives red flag indicators to help institutions identify and report the activity, and reminds financial institutions of their reporting requirements under the Bank Secrecy Act.[1]

FinCEN also said it had observed an increase in suspicious activity reports describing the suspected use of deepfake media, "particularly the use of fraudulent identity documents to circumvent identity verification and authentication methods."[1] It placed the abuse of generative AI tools under cybercrime and fraud, which it named as two of its anti-money laundering and countering the financing of terrorism national priorities.[1] The alert is addressed to financial institutions, the firms that file those reports, but the schemes it describes reach the businesses that bank with them.

## What the Federal Reserve heard and said

On 2025-04-17 Governor Michael S. Barr gave a speech on deepfakes and bank cybersecurity.[2] He described a deepfake attack as one in which an attacker uses generative AI to create a doppelganger with a person's voice or image and uses it to interact with individuals or institutions to commit fraud. He said deepfake attacks had seen a twentyfold increase over the previous three years, and that deepfakes "are also being used to commit payment fraud."[2]

The example he gave is a finance function case. He said that in 2024 a deepfake of the chief financial officer of the British engineering firm Arup "was reportedly deployed in a video meeting and convinced an Arup financial employee to transfer $25 million to thieves."[2] The speech used the word "reportedly"; the figure is the governor's account of a reported case, not a finding by the Board.

## The controls the speech describes

Governor Barr's speech described controls at three points.[2]

- **At the bank.** Banks verify payors through identity verification processes, including multi-factor authentication. He said banks have two points of control over a transaction: confirming the sender's identity and the legitimacy of the recipient. Banks can scrutinize the recipients of large or unusual transactions, use analytics to flag suspicious patterns, and perform additional reviews before authorizing a payment to a recipient that raises flags.
- **At the customer.** He said customers should enable multi-factor authentication and verify unusual requests "through a separate channel, even if the person making the request seems genuine."
- **At the regulator.** He said regulators can reinforce cyber defenses through updates to guidance and regulation, with attention to the burden on smaller institutions, and should consider using AI to detect patterns of fraud at regulated institutions.

He also noted that identity verification at banks often relies on voice detection, which he said may become vulnerable to generative AI tools.[2]

## Treasury's view of the fraud data gap

Treasury's March 2024 report on AI-specific cybersecurity risks in financial services listed fraud among the immediate operational risks it addressed.[3] Among its next steps, Treasury described a "fraud data divide": as more firms deploy AI, there is a gap in the data available for training fraud models, and large institutions hold an advantage because they have more internal data.[3] Treasury's December 2024 report on AI in financial services, which followed its 2024 request for information, recommended further sharing of AI information specific to financial services, alongside the AI cybersecurity forum proposed in the March report.[5]

## Payments made by AI agents

In a speech dated 2026-09-29, Governor Christopher J. Waller said the payments industry "was also an early adopter of large language models (LLMs) for payment reconciliation and similar tasks," and that machine learning has long been used against payments fraud.[4] For payments made by AI agents on a buyer's behalf, he named three challenges: authentication, liability and fraud. He said the question shifts from proving that a buyer is an authorized payer to proving that an agent has the authority to pay on the buyer's behalf.[4]

## What the documents do not do

None of these documents is a rule for companies outside the financial sector. The FinCEN alert is addressed to financial institutions with reporting duties; the speeches are the views of individual governors, not of the Board; the Treasury reports recommend next steps for agencies and the industry. For a company's own disclosures about these risks, see the [filings stream](https://cfonews.ai/filings), where several companies' risk factors name AI-enabled impersonation and payment fraud, and the explainer on [how to read an AI risk factor](https://cfonews.ai/explainers/how-to-read-an-ai-risk-factor).

Sources:
[1] FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions. Financial Crimes Enforcement Network, 2024-11-13. https://www.fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial
[2] Deepfakes and the AI Arms Race in Bank Cybersecurity, Governor Michael S. Barr. Federal Reserve Board, 2025-04-17. https://www.federalreserve.gov/newsevents/speech/barr20250417a.htm
[3] Report on Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Sector. U.S. Department of the Treasury, 2024-03-27. https://home.treasury.gov/news/press-releases/jy2212
[4] Payments in the Age of AI Agents, Governor Christopher J. Waller. Federal Reserve Board, 2026-09-29. https://www.federalreserve.gov/newsevents/speech/waller20260928a.htm
[5] Report on the Uses, Opportunities, and Risks of Artificial Intelligence in Financial Services. U.S. Department of the Treasury, 2024-12-19. https://home.treasury.gov/news/press-releases/jy2760

### AI and internal control over financial reporting, in filers' words

URL: https://cfonews.ai/explainers/ai-and-internal-control
Published: 2026-10-29
What companies tell the SEC about AI and their internal control over financial reporting, disclosure controls and audit committee oversight, quoted and linked.

Few companies say outright whether AI is part of their internal control over financial reporting, but those that do fall into four groups: some say it is not, some say it may become so, some say AI projects could affect their controls, and some say who oversees AI risk. This page collects those statements from the [filings stream](https://cfonews.ai/filings) in the filers' own words. It does not assess any company's controls and is not accounting or legal advice.

## "Not yet" and "not dependent"

Two filings state a boundary. Linkhome Holdings' 10-K filed 2026-03-26, in its risk factors, says that notwithstanding its use of AI in its application and in certain agent activities, "we've yet to utilize AI within our financial reporting or internal control over financial reporting functions."[1]

OLB Group's 10-Q filed 2026-08-14 describes AI agents in development for invoice processing, reconciliation and routine close activities, and then says: "Human review and oversight remain in place for underwriting, risk, compliance and financial reporting activities, and our internal control over financial reporting is not dependent on these tools."[2]

Both are statements of the company's present position. Neither filing says the position will last, and the site records them as made on the dates shown.

## "May increasingly use"

LendingTree's 10-K filed 2026-03-09 looks ahead: "In the future, we may increasingly use automated tools, including AI and machine learning technologies, in connection with data analysis, financial reporting processes, and internal controls."[3] The sentence sits under Item 1A, Risk Factors. It names internal controls as a possible place for AI, which is different from saying AI is already part of them.

## AI projects as a risk to controls

Other companies connect AI initiatives to their controls through the projects themselves. Cardinal Health's 10-K filed 2026-08-11 says that if initiatives, including "initiatives related to artificial intelligence and machine learning, are not successfully or efficiently implemented or maintained," it could experience negative impacts on its business, financial results "and our internal control over financial reporting."[4]

UMB Financial's 10-K filed 2026-02-26 names AI as a category of control in a list that also includes financial reporting and disclosure: the company "must successfully develop and maintain information, financial reporting, disclosure, privacy, data protection, data security, artificial intelligence, and other controls adapted to the Company's reliance on outside platforms and providers."[5]

Upstart's 10-Q filed 2025-11-04 puts its AI models in the same sentence as its controls, saying fluctuations in its business "will strain our ability to develop and improve" areas including "AI models and technology, disclosure controls and procedures, internal control over financial reporting."[6]

World Acceptance's 10-K filed 2026-06-04 approaches controls from the other side: it says malicious actors "may exploit AI to create convincing false identities or manipulate internal controls and/or verification processes."[9]

## Who oversees it

Two filings place AI risk with the board or its audit committee. ABM Industries' 10-K filed 2025-12-19, under Item 1C, Cybersecurity, says its board oversees its cybersecurity and AI programs, including "the Company's disclosure controls and procedures with respect to material cybersecurity or AI-related risks and incidents."[7] Olaplex Holdings' 10-K/A filed 2026-04-30 lists among its Audit Committee's responsibilities assisting the Board in overseeing the company's internal control over financial reporting and its risk management practices, including risks related to "the development, deployment or use of artificial intelligence."[8]

## A point on wording

On 2024-02-13 SEC Chair Gary Gensler said that investors "benefit from disclosures particularized to the company, not from boilerplate language" when companies disclose material AI risks.[10] The passages above differ in exactly that respect. Linkhome and OLB say what the company does and does not do; LendingTree, Cardinal Health and UMB say what could happen or what must be maintained. Both kinds are useful to a reader who keeps them apart.

## Where to find more

Each statement above is footnoted to the filing on sec.gov and has an entry in the filings stream with its section and dates. For how the same companies describe AI in the close and in payables, see [AI in the close, payables and planning](https://cfonews.ai/explainers/ai-in-the-close-and-payables); for how to weigh the wording of a risk factor, see [how to read an AI risk factor](https://cfonews.ai/explainers/how-to-read-an-ai-risk-factor).

Sources:
[1] SEC EDGAR, Linkhome Holdings Inc. Form 10-K, 2026-03-26. https://www.sec.gov/Archives/edgar/data/2017758/000121390026034538/ea0281818-10k_linkhome.htm
[2] SEC EDGAR, OLB Group, Inc. Form 10-Q, 2026-08-14. https://www.sec.gov/Archives/edgar/data/1314196/000118518526003553/olbgroup10q063026.htm
[3] SEC EDGAR, LendingTree, Inc. Form 10-K, 2026-03-09. https://www.sec.gov/Archives/edgar/data/1434621/000162828026016084/tree-20251231.htm
[4] SEC EDGAR, Cardinal Health, Inc. Form 10-K, 2026-08-11. https://www.sec.gov/Archives/edgar/data/721371/000072137126000038/cah-20260630.htm
[5] SEC EDGAR, UMB Financial Corp Form 10-K, 2026-02-26. https://www.sec.gov/Archives/edgar/data/101382/000119312526076496/umbf-20251231.htm
[6] SEC EDGAR, Upstart Holdings, Inc. Form 10-Q, 2025-11-04. https://www.sec.gov/Archives/edgar/data/1647639/000164763925000134/upst-20250930.htm
[7] SEC EDGAR, ABM Industries Inc Form 10-K, 2025-12-19. https://www.sec.gov/Archives/edgar/data/771497/000077149725000031/abm-20251031.htm
[8] SEC EDGAR, Olaplex Holdings, Inc. Form 10-K/A, 2026-04-30. https://www.sec.gov/Archives/edgar/data/1868726/000119312526197345/d132542d10ka.htm
[9] SEC EDGAR, World Acceptance Corp Form 10-K, 2026-06-04. https://www.sec.gov/Archives/edgar/data/108385/000010838526000014/wrld-20260331.htm
[10] AI, Finance, Movies, and the Law, Chair Gary Gensler. U.S. Securities and Exchange Commission, 2024-02-13. https://www.sec.gov/newsroom/speeches-statements/gensler-ai-021324

### The SEC and AI since 2023, from its own releases

URL: https://cfonews.ai/explainers/the-secs-ai-agenda
Published: 2026-10-29
What the SEC has proposed, announced, charged and said about AI since 2023, from its press releases and speeches, with dates and links.

The SEC's published record on AI since 2023 runs along four lines: a 2023 rule proposal on predictive data analytics, enforcement against false AI claims, a 2025 public roundtable, and the agency's own use of AI, alongside speeches on how disclosure is read by machines. None of the documents below is an AI-specific disclosure rule for public companies. This page lists what each says, in date order, with links; the [regulation tracker](https://cfonews.ai/regulation/sec) carries the same documents as rows.

## 2023: the predictive data analytics proposal

On 2023-07-26 the SEC proposed rules that "would require broker-dealers and investment advisers" to take steps to address conflicts of interest associated with their use of predictive data analytics and similar technologies when they interact with investors.[1] The release says the proposed rules would generally require a firm to evaluate whether its use of certain technologies in investor interactions involves a conflict that places the firm's interests ahead of investors', and to "eliminate, or neutralize the effect of," any such conflicts.[1]

The proposal is addressed to brokers and advisers, not to companies' finance functions. The tracker shows it with the status the release itself gives, proposed; this site has not yet opened a later release on its fate, and records nothing further until it does.

## 2024: disclosure and enforcement

On 2024-02-13 Chair Gary Gensler said in a speech that a company raising money from the public "needs to be truthful about its use of AI and associated risk," and that AI risk disclosures should be particular to the company rather than boilerplate.[2] On 2024-03-18 the SEC announced settled charges against two investment advisers over false and misleading statements about their use of AI, one of the "AI washing" cases described in the explainer on [AI-washing enforcement](https://cfonews.ai/explainers/ai-washing-enforcement).[3]

## 2025: a new enforcement unit and a roundtable

On 2025-02-20 the SEC announced its Cyber and Emerging Technologies Unit, which replaced the Crypto Assets and Cyber Unit. The release names "fraud committed using emerging technologies, such as artificial intelligence and machine learning" first among the unit's priority areas.[4]

On 2025-02-28 the SEC announced a public roundtable on AI in the financial industry, to be held on March 27, that would "discuss the risks, benefits, and governance of AI in the financial industry."[5] When it published the agenda on 2025-03-20, Acting Chairman Mark T. Uyeda encouraged the public "to provide data and other evidence on how artificial intelligence can be used to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation."[6]

## 2025: AI inside the agency

On 2025-08-01 the SEC announced a task force on AI to "enhance innovation and efficiency in its operations through the responsible use of AI," led by Valerie Szczepanik, named the agency's Chief AI Officer.[7] Chairman Paul S. Atkins was quoted saying the task force "will empower staff across the SEC with AI-enabled tools and systems."[7] This is about how the regulator works, not a requirement on filers.

## 2026: disclosure read by machines

On 2026-09-17 Joshua White, the SEC's Chief Economist and Director of the Division of Economic and Risk Analysis, gave a speech titled "Information in the Age of AI."[8] He said that "Financial information increasingly has two audiences: people and machines," and that AI "may also lower some of the costs involved in preparing disclosures."[8] He also said that as investors, intermediaries, academics and regulators analyze information through automated systems, it becomes more important that information be presented in a form machines can understand reliably.[8] A speech states the speaker's views, not the Commission's.

## What this adds up to

From these releases alone: the SEC has used existing antifraud and marketing rules against false AI claims, has created an enforcement unit that names AI-enabled fraud as a priority, has invited public input through a roundtable, and has put AI to work in its own operations. For what public companies are saying in their filings while this record develops, see the [filings stream](https://cfonews.ai/filings).

Sources:
[1] SEC Proposes New Requirements to Address Risks to Investors From Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers. U.S. Securities and Exchange Commission, 2023-07-26. https://www.sec.gov/newsroom/press-releases/2023-140
[2] AI, Finance, Movies, and the Law, Chair Gary Gensler. U.S. Securities and Exchange Commission, 2024-02-13. https://www.sec.gov/newsroom/speeches-statements/gensler-ai-021324
[3] SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence. U.S. Securities and Exchange Commission, 2024-03-18. https://www.sec.gov/newsroom/press-releases/2024-36
[4] SEC Announces Cyber and Emerging Technologies Unit to Protect Retail Investors. U.S. Securities and Exchange Commission, 2025-02-20. https://www.sec.gov/newsroom/press-releases/2025-42
[5] SEC to Host Roundtable on Artificial Intelligence. U.S. Securities and Exchange Commission, 2025-02-28. https://www.sec.gov/newsroom/press-releases/2025-48
[6] SEC Announces Agenda, Panelists for Roundtable on Artificial Intelligence. U.S. Securities and Exchange Commission, 2025-03-20. https://www.sec.gov/newsroom/press-releases/2025-56-sec-announces-agenda-panelists-roundtable-artificial-intelligence
[7] SEC Creates Task Force to Tap Artificial Intelligence for Enhanced Innovation and Efficiency Across the Agency. U.S. Securities and Exchange Commission, 2025-08-01. https://www.sec.gov/newsroom/press-releases/2025-103-sec-creates-task-force-tap-artificial-intelligence-enhanced-innovation-efficiency-across-agency
[8] Information in the Age of AI, Joshua White. U.S. Securities and Exchange Commission, 2026-09-17. https://www.sec.gov/newsroom/speeches-statements/white-remarks-ici-compliance-091726

### AI in the controls section: what filers put under Item 4 and Item 9A

URL: https://cfonews.ai/explainers/ai-in-the-controls-section
Published: 2026-11-01
What 10-K and 10-Q filers say about AI in control remediation and financial review, and the limits they set on AI in financial reporting, quoted and linked.

In the filings the desk searched, AI rarely appears in the controls section of a 10-K or 10-Q, and the two that name it there describe a tool added while remediating control weaknesses. The searches, run over 10-K and 10-Q filings dated 2025-10-29 to 2026-11-01, found those two filings naming AI under Item 4 or Item 9A, Controls and Procedures; this page reads them closely and sets them beside the risk-factor and business passages where other companies draw a line around AI and their financial reporting. It does not assess any company's controls and is not accounting or legal advice.

## Two filings that put AI under Controls and Procedures

TOMI Environmental Solutions' 10-Q filed 2026-08-14 describes control deficiencies that management "has determined" constitute material weaknesses, and then lists its remediation progress.[1] One of the listed actions reads: "Integrated AI-assisted technical research tools to support complex U.S. GAAP research and financial statement disclosures."[1] The same list includes updated close procedures, monthly physical inventory counts and a 13-week rolling cash flow forecast, so the AI item is one action among several. The filing says the remediation actions "are fully disclosed in our previously filed Form 10-K."[1]

Brownie's Marine Group's amended 10-Q filed 2026-08-24 is more specific about what the tool does. The company says it believes "weaknesses in our financial reporting review and verification processes contributed to the errors requiring the restatement" of financial statements in its 10-Q for the quarter ended June 30, 2026.[2] Among the measures it lists is "technology-assisted financial review procedures, including AI-enabled analytical testing, as a supplemental control designed to identify period inconsistencies, mathematical discrepancies, unusual variances, internal inconsistencies and other potential reporting anomalies for further human review."[2] The next item requires that exceptions found this way "be investigated and resolved prior to authorization of applicable SEC filings."[2]

Three details in that wording matter to a reader. The AI testing is called "supplemental", so the filing does not present it as the primary control. Its output goes "for further human review", so a person decides what an anomaly means.[2] And the procedure sits before filing authorization, which places it in the review step rather than in the preparation of the numbers.

## Boundaries drawn elsewhere in the filing

Other companies make statements about AI and financial reporting outside the controls section, usually in risk factors or the business description. Oil-Dri's 10-K filed 2026-10-08 says "we do not currently utilize artificial intelligence ("AI") technologies within our financial reporting or internal control over financial reporting functions," while it uses AI elsewhere in its business.[3] Linkhome Holdings' 10-K filed 2026-03-26 says "we've yet to utilize AI within our financial reporting or internal control over financial reporting functions."[5]

Lightbridge's 10-K filed 2026-02-26 draws a narrower line. It says its AI tools "do not replace the professional judgment of our management, engineers, or other technical personnel," and that the company "does not rely exclusively on AI-generated content or recommendations for any material regulatory submissions, safety decisions, or financial reporting."[4] Saying not exclusively is a different claim from saying not at all: it allows AI output to inform financial reporting while saying it is not the only basis.

ARMOUR Residential REIT goes the other way in its 10-K filed 2026-02-18, listing financial reporting among the business processes in which the company, its manager or third-party service providers use AI, alongside "data analysis, investment modeling, risk management, financial reporting, and cybersecurity."[8]

## Oversight and missing controls as a stated risk

Celestica's 10-K filed 2026-02-27 describes its Audit Committee's mandate as covering risks "related to AI" and the systems to manage such risks "as they relate to financial reporting integrity and disclosure controls."[6] Medpace's 10-K filed 2026-02-10 names the opposite condition as a risk: "insufficient human oversight of AI or a lack of controls and procedures monitoring the use of AI in day-to-day operations."[7]

## What regulators have said about the same questions

Governor Lisa D. Cook of the Federal Reserve Board said on 2025-07-17: "A central tenet of good governance should be the mindset that humans are in the loop, because it ensures that people guide AI rather than allow AI to guide us."[9] The Brownie's Marine wording, with anomalies sent "for further human review", is one concrete form of that idea in a filing.[2]

SEC Chairman Paul S. Atkins said on 2026-03-04 that the SEC's materiality-based approach should inform how a public company discloses developments concerning AI, "just as it guides disclosures about any other development."[10] None of the filings above says why it placed its AI statement in one section rather than another, and this page does not guess.

## Where to find more

Each passage above has an entry in the [filings stream](https://cfonews.ai/filings) under its kicker, with the section and dates. The earlier explainer on [AI and internal control over financial reporting](https://cfonews.ai/explainers/ai-and-internal-control) collects the risk-factor statements on the same subject, and the [regulation tracker](https://cfonews.ai/regulation) lists the speeches cited here.

Sources:
[1] SEC EDGAR, TOMI Environmental Solutions, Inc. Form 10-Q, 2026-08-14. https://www.sec.gov/Archives/edgar/data/314227/000165495426007620/tomz_10q.htm
[2] SEC EDGAR, Brownie's Marine Group, Inc. Form 10-Q/A, 2026-08-24. https://www.sec.gov/Archives/edgar/data/1166708/000149315226039921/form10-qa.htm
[3] SEC EDGAR, Oil-Dri Corp of America Form 10-K, 2026-10-08. https://www.sec.gov/Archives/edgar/data/74046/000162828026065453/odc-20260731.htm
[4] SEC EDGAR, Lightbridge Corp Form 10-K, 2026-02-26. https://www.sec.gov/Archives/edgar/data/1084554/000147793226001076/ltbr_10k.htm
[5] SEC EDGAR, Linkhome Holdings Inc. Form 10-K, 2026-03-26. https://www.sec.gov/Archives/edgar/data/2017758/000121390026034538/ea0281818-10k_linkhome.htm
[6] SEC EDGAR, Celestica Inc. Form 10-K, 2026-02-27. https://www.sec.gov/Archives/edgar/data/1030894/000103089426000011/cls-20251231.htm
[7] SEC EDGAR, Medpace Holdings, Inc. Form 10-K, 2026-02-10. https://www.sec.gov/Archives/edgar/data/1668397/000166839726000006/medp-20251231.htm
[8] SEC EDGAR, ARMOUR Residential REIT, Inc. Form 10-K, 2026-02-18. https://www.sec.gov/Archives/edgar/data/1428205/000142820526000029/arr-20251231.htm
[9] AI: A Fed Policymaker's View, Governor Lisa D. Cook. Federal Reserve Board, 2025-07-17. https://www.federalreserve.gov/newsevents/speech/cook20250717a.htm
[10] Remarks at FSOC Artificial Intelligence Innovation Series Roundtable, Chairman Paul S. Atkins. U.S. Securities and Exchange Commission, 2026-03-04. https://www.sec.gov/newsroom/speeches-statements/atkins-remarks-at-financial-stability-oversight-council-artificial-intelligence-innovation-series-roundtable-030426

### AI in companies' own finance work: what filers say they use it for

URL: https://cfonews.ai/explainers/ai-in-own-finance-work
Published: 2026-11-01
What companies' SEC filings say about AI in their own finance and accounting work, from invoices to revenue assurance, beside Federal Reserve remarks on adoption.

When a company tells the SEC that it uses AI in its own finance work, it usually does so in a single clause inside a list, and the tasks named most often are invoices, reconciliation and reporting. This page collects the own-use statements in the [filings stream](https://cfonews.ai/filings), in the filers' words, and separates them from passages in which a company describes AI products it sells. It does not rank, endorse or compare any company.

## Named tasks

Some filings name the task. Expensify's 10-K filed 2026-02-26 says that "we use AI Technologies to optimize our internal processes, including, but not limited to, analyzing and processing receipts, bills, and invoices."[1] The same paragraph says the company uses third-party AI, machine learning and automated decision-making technologies "throughout our business, and are making significant investments in this area."[1] Expensify sells expense software, but this sentence is about its own internal processes.

Global Business Travel Group's 10-K filed 2026-03-09 gives a short inventory by function. After saying "we are systematically deploying next-generation AI technologies while maintaining rigorous governance and data security standards," it says: "In finance, AI supports revenue assurance and contract reconciliation."[2] The adjacent sentences assign other uses to traveler care and engineering, so finance is one function among several.

OLB Group's 10-Q filed 2026-08-14 is the most detailed own-use statement in the stream. It says the company is "developing AI agents intended to automate invoice processing, reconciliation, residual calculations, expense categorization and routine financial close activities."[6] The verb is "developing", so the filing describes work in progress, not a deployed system.

## Finance as one item in a list

Other filings place finance or financial reporting inside a longer list of business uses without saying what the AI does there. ARMOUR Residential REIT's 10-K filed 2026-02-18 says the company, its manager or third-party service providers use AI in "data analysis, investment modeling, risk management, financial reporting, and cybersecurity."[3] Zedge's 10-K filed 2026-10-28 says it relies on AI "for development, content moderation, personalization, marketing assets, finance, legal, user engagement, and other functions across our business."[4] Data I/O's 10-K filed 2026-04-16 says AI tools were applied to areas ending with "internal business operations including financial reporting and analysis."[7]

A list item tells a reader that the company considers finance part of its AI use. It does not say which processes, whether a person reviews the output, or whether controls changed. For those questions, see [AI in the controls section](https://cfonews.ai/explainers/ai-in-the-controls-section).

## Stated intentions and stated limits

An 8-K can carry a statement of intent. In an exhibit to Bakkt's 8-K filed 2026-08-17 announcing a new chief financial officer, a statement attributed to the chief executive says: "We intend to build a modern, data-driven and AI-enabled finance organization that can operate at speed, allocate capital intelligently and support the scale of the opportunity ahead of us."[5] The sentence describes a plan, not a present use.

Some companies state a limit instead. Oil-Dri's 10-K filed 2026-10-08 says it does not currently use AI technologies "within our financial reporting or internal control over financial reporting functions," while it uses and intends to expand AI elsewhere in its business.[8]

## What Federal Reserve officials have described

Officials speaking about the financial sector have described similar back-office uses. Governor Christopher J. Waller said on 2026-09-29 that the payments industry "was also an early adopter of large language models (LLMs) for payment reconciliation and similar tasks."[9] Vice Chair for Supervision Michelle W. Bowman said on 2026-05-01: "Financial institutions are developing their own applications and implementing vendor-assisted tools."[11]

On pace, Governor Michael S. Barr said on 2025-04-04 that "banks appear to be moving cautiously with their Gen AI use, which reflects the current state of the technology, as well as banks' internal organizational structure and the highly regulated environment in which they operate."[10] The passages quoted above describe uses rather than results: none of them reports an error rate or a cost saving from AI in the company's own finance work.

## Reading an own-use statement

Three questions sort these passages: does the filing name a task or only a function, does it use a present or a future verb, and does it say anything about review or controls. Expensify, Global Business Travel and OLB name tasks; ARMOUR, Zedge and Data I/O name functions; Bakkt states an intention and Oil-Dri states a limit. Each passage has an entry in the [filings stream](https://cfonews.ai/filings), and [AI in the close, payables and planning](https://cfonews.ai/explainers/ai-in-the-close-and-payables) covers the vendors that sell these capabilities.

Sources:
[1] SEC EDGAR, Expensify, Inc. Form 10-K, 2026-02-26. https://www.sec.gov/Archives/edgar/data/1476840/000147684026000009/exfy-20251231.htm
[2] SEC EDGAR, Global Business Travel Group, Inc. Form 10-K, 2026-03-09. https://www.sec.gov/Archives/edgar/data/1820872/000162828026015817/gbtg-20251231.htm
[3] SEC EDGAR, ARMOUR Residential REIT, Inc. Form 10-K, 2026-02-18. https://www.sec.gov/Archives/edgar/data/1428205/000142820526000029/arr-20251231.htm
[4] SEC EDGAR, Zedge, Inc. Form 10-K, 2026-10-28. https://www.sec.gov/Archives/edgar/data/1667313/000121390026113312/ea0309434-10k_zedge.htm
[5] SEC EDGAR, Bakkt, Inc. Form 8-K, Exhibit 99.1, 2026-08-17. https://www.sec.gov/Archives/edgar/data/1820302/000119312526353239/d145238dex991.htm
[6] SEC EDGAR, OLB Group, Inc. Form 10-Q, 2026-08-14. https://www.sec.gov/Archives/edgar/data/1314196/000118518526003553/olbgroup10q063026.htm
[7] SEC EDGAR, Data I/O Corp Form 10-K, 2026-04-16. https://www.sec.gov/Archives/edgar/data/351998/000165495426003625/daio_10k.htm
[8] SEC EDGAR, Oil-Dri Corp of America Form 10-K, 2026-10-08. https://www.sec.gov/Archives/edgar/data/74046/000162828026065453/odc-20260731.htm
[9] Payments in the Age of AI Agents, Governor Christopher J. Waller. Federal Reserve Board, 2026-09-29. https://www.federalreserve.gov/newsevents/speech/waller20260928a.htm
[10] AI, Fintechs, and Banks, Governor Michael S. Barr. Federal Reserve Board, 2025-04-04. https://www.federalreserve.gov/newsevents/speech/barr20250404a.htm
[11] Artificial Intelligence in the Financial System, Vice Chair for Supervision Michelle W. Bowman. Federal Reserve Board, 2026-05-01. https://www.federalreserve.gov/newsevents/speech/bowman20260501a.htm

### What the PCAOB has said about generative AI in audits

URL: https://cfonews.ai/explainers/pcaob-and-generative-ai-in-audits
Published: 2026-11-04
What PCAOB staff found when it asked audit firms and companies how they use generative AI in audits and financial reporting, and what it did not find.

The PCAOB's main public statement on generative AI in audits is a July 2024 staff Spotlight, and its finding is narrow: the audit firms its staff spoke to appeared to use generative AI mainly for administrative and research work, and firms investing in it expected it to augment, not replace, people in auditing and financial reporting.[1] The document is staff observation from limited outreach. It is not a rule, a standard or guidance, and the PCAOB says so on its cover.[1]

## What the document is

The Spotlight states that it "represents the views of PCAOB staff and not necessarily those of the Board. It is not a rule, policy, or statement of the Board."[1] It reports on what staff called "limited outreach to several audit firms and companies," made to understand their views on integrating generative AI in audits and financial reporting.[1] The firms were mainly larger ones: in a footnote, staff said they consisted of the U.S. global network firms and several U.S. non-affiliated firms that audit more than 100 issuers, which together audit the majority of issuers' market capitalization.[1]

Staff placed the work inside a research project on the PCAOB's standard-setting agenda, one that assesses whether there is a need for guidance, changes to PCAOB standards or other regulatory action given the increased use of technology-based tools in preparing and auditing financial statements.[1] The tracker on this site lists the Spotlight and the PCAOB's later standard-setting agenda page under [the PCAOB](https://cfonews.ai/regulation/pcaob).

## What audit firms told staff

Staff reported six observations from the audit firms.[1]

- **Current use.** Some firms said staff can use generative AI to prepare certain administrative documents or first drafts of memos and presentations related to the audit, and some had built tools to help staff research internal accounting and auditing guidance. The global network firms were generally further along than non-affiliated firms.
- **Investment.** Most firms said they were continuing to invest, either by building tools or by partnering with third parties. The future uses they named included summarizing accounting policy and legal documents, checking audit documentation for completeness, certain risk assessment procedures, scoping the audit, evaluating the completeness of financial statement disclosures, and comparing amounts in the statements or notes with audited amounts.
- **Limits.** Data privacy and security remained a focus. Some firms limited what information could be uploaded to their tools, some limited how far staff could use generative AI in an audit, and some did not allow it in audit or attest procedures at all, citing data privacy and the reliability of the output.
- **Supervision and review.** Firms said an engagement team member who uses a generative AI tool is still responsible for the results and documentation of the work, and that reviewers are expected to apply the same diligence as for work done without it.
- **Input and output.** Some firms stressed that both the source data and the generated content must be auditable, and noted that output may be false or misleading, which staff described as "so-called 'hallucinations'," or may be skewed or biased.
- **Other risks.** Some firms said a company's own use of generative AI could amplify existing information technology risks, such as risks related to the segregation of duties, or create new ones.

Staff also wrote that these firms indicated "that PCAOB auditing standards are not currently viewed as impediments to the development and use of GenAI in the audit."[1] That is the firms' view as staff reported it, not a finding by the Board.

## What companies told staff

On the preparer side, staff said that integrating generative AI into accounting and financial reporting "appears to be secondary to integrating GenAI in operational and customer-facing areas."[1] Some preparers used it for first drafts of internal documents, such as summaries of accounting standards, and some used it for "less complex and repetitive processes, such as preparing account reconciliations or to assist with identifying reconciling items."[1]

Preparers named two problems for wider use in financial reporting: the "black-box" nature of some tools and the lack of consistent output, both of which raise questions about whether the output can be audited.[1] Some said they were setting up controls over the reliability and accuracy of the data used to train models, and acknowledged that this may be hard for models developed or trained by third parties.[1] Some were testing single use cases to work out what controls would be needed before wider use.[1]

## What the Spotlight does not say

The Spotlight does not change any auditing standard, does not tell auditors how to test a company's AI, and does not count how many companies use generative AI in their close. It ends by asking auditors, preparers, audit committee members, investors and academics to share their experience with staff.[1] For what companies themselves tell the SEC about AI in their controls, see [AI in the controls section](https://cfonews.ai/explainers/ai-in-the-controls-section) and the [controls and audit topic](https://cfonews.ai/topics/controls-and-audit), where the log quotes the filings directly.

Sources:
[1] Spotlight: Staff Update on Outreach Activities Related to the Integration of Generative Artificial Intelligence in Audits and Financial Reporting. Public Company Accounting Oversight Board, 2024-07-01. https://pcaobus.org/documents/generative-ai-spotlight.pdf

### What the CFTC has published on AI, and what it asks of firms

URL: https://cfonews.ai/explainers/what-the-cftc-has-said-about-ai
Published: 2026-11-04
The CFTC's 2024 request for comment on AI, its customer advisory on AI scams and its staff advisory reminding registrants of their existing duties, from cftc.gov.

The Commodity Futures Trading Commission's documents on artificial intelligence are a 2024 staff request for comment, a customer advisory on AI scams, and a December 2024 staff advisory whose message is that the existing Commodity Exchange Act and CFTC regulations apply whether or not a firm uses AI.[1][2][4] None of the three is a rule: the advisory says it creates no new binding rules or regulations.[4] This page sets out what those documents say, in their order, with the parts that touch finance and reporting work.

## January 2024: the request for comment

On 2024-01-25 four CFTC divisions and its Office of Technology Innovation issued a request for comment on "the current and potential uses and risks of artificial intelligence (AI) in the derivatives markets the CFTC regulates."[1] The release said the request sought comment on the definition of AI and its uses in trading, risk management, compliance, cybersecurity, recordkeeping, data processing and analytics, and customer interactions.[1] It also asked about risks: market manipulation and fraud, governance, explainability, data quality, concentration, bias, privacy and confidentiality, and customer protection.[1]

The release said staff would use the responses in analyzing possible future actions, "such as new or amended guidance, interpretations, policy statements, or regulations."[1] Comments were accepted until 2024-04-24.[1]

## January 2024: the customer advisory on AI scams

The same day, the CFTC's Office of Customer Education and Outreach issued a customer advisory titled "AI Won't Turn Trading Bots into Money Machines."[2] The release said scammers were claiming that bots, trade signal algorithms, crypto-asset arbitrage algorithms and other AI-assisted technology could generate huge returns, and that the advisory warns that claims of high or guaranteed returns are red flags of fraud.[2] The advisory itself says: "AI technology can't predict the future or sudden market changes."[2] It is addressed to the public, not to firms.

## December 2024: the staff advisory

On 2024-12-05 the Divisions of Clearing and Risk, Data, Market Oversight, and the Market Participants Division issued CFTC Letter No. 24-17, a staff advisory to registered entities and registrants.[3][4] The press release said it "reminds CFTC-regulated entities of their obligations under the Commodity Exchange Act and the CFTC's regulations as these entities begin to implement AI," and that it was informed in part by the comments on the January request.[3]

The letter is explicit about what it is not. It says it "is not a compliance checklist or substitute for appropriate risk assessments or governance," and that it is not intended to create enforceable rights or new binding rules.[4] It represents the views of the four divisions, not necessarily the Commission's.[4] Staff wrote that it expects regulated entities to "assess the risks of using AI and update policies, procedures, controls, and systems, as appropriate."[4]

The advisory then walks through existing requirements by type of firm.[4]

- **Exchanges, swap execution facilities and swap data repositories.** Uses in order processing, trade matching and market surveillance, and system safeguards whether a tool is built in house or bought from a third party.
- **Clearing organizations.** System safeguards, member assessment, and settlement, where staff said AI might be used to validate data, find anomalies before settlement or identify failed trades. Staff noted that a clearing organization keeps responsibility when it outsources.
- **Intermediaries and other registrants.** Risk management, such as margin calculation for uncleared swaps; compliance and recordkeeping; and customer protection, including the segregation of customer funds.

## The parts closest to finance work

Two passages speak to reporting and accounting. On recordkeeping and reporting, staff said AI "may support the accuracy and timeliness of financial information and risk disclosures" provided to the Commission, the National Futures Association and customers, and reminded registrants that they remain responsible for those disclosures meeting the requirements.[4] Its example: a commodity pool operator that used generative AI to update a disclosure document or prepare periodic account statements would still be subject to all of Part 4 of the regulations.[4]

On customer funds, staff said a futures commission merchant that uses AI to account for segregated funds "would still be required to ensure" that the requirements of Part 1 are met.[4] Staff added that it may make AI a topic in routine oversight such as examinations and will keep evaluating the need for future regulation or guidance.[4]

## What this means for the record

The staff advisory is addressed to CFTC-registered entities and registrants, the firms in the derivatives markets, not to public companies in general.[4] For companies that file with the SEC, the closest parallels are in the [SEC's own releases](https://cfonews.ai/explainers/the-secs-ai-agenda) and in the filings this site logs. The CFTC's two documents are also listed, dated, on the [CFTC tracker page](https://cfonews.ai/regulation/cftc).

Sources:
[1] CFTC Staff Releases Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets. Commodity Futures Trading Commission, 2024-01-25. https://www.cftc.gov/PressRoom/PressReleases/8853-24
[2] CFTC Customer Advisory Cautions the Public to Beware of Artificial Intelligence Scams. Commodity Futures Trading Commission, 2024-01-25. https://www.cftc.gov/PressRoom/PressReleases/8854-24
[3] CFTC Staff Issues Advisory Related to the Use of Artificial Intelligence by CFTC-Registered Entities and Registrants. Commodity Futures Trading Commission, 2024-12-05. https://www.cftc.gov/PressRoom/PressReleases/9013-24
[4] CFTC Letter No. 24-17, Staff Advisory: Use of Artificial Intelligence in CFTC-Regulated Markets. Commodity Futures Trading Commission, 2024-12-05. https://www.cftc.gov/csl/24-17/download

### The EU AI Act and finance: credit scoring, insurance pricing and the dates

URL: https://cfonews.ai/explainers/eu-ai-act-credit-scoring-and-finance
Published: 2026-11-04
Which finance uses the EU AI Act lists as high-risk, what deployers must do, the AI literacy duty, and when each part applies, from the European Commission's own pages.

The EU AI Act reaches some finance uses directly. It lists AI systems "intended to be used to evaluate the creditworthiness of natural persons or establish their credit score" as high-risk, with an exception for systems used to detect financial fraud, and it lists risk assessment and pricing for natural persons in life and health insurance.[2] The European Commission says the rules for these high-risk uses apply from 2 December 2027, while the AI literacy duty has applied to every provider and deployer since 2 February 2025.[1]

## What the Act is, in the Commission's words

The AI Act is Regulation (EU) 2024/1689. The Commission's page calls it a risk-based framework with four levels: unacceptable risk (banned practices), high risk, transparency risk and minimal or no risk.[1] It says "the vast majority of AI systems currently used in the EU" fall in the minimal or no risk category, for which the Act introduces no rules, and gives spam filters as an example.[1] The text on the Commission's AI Act Service Desk is the consolidated version as at 27 July 2026, which includes the amendments made by the Digital Omnibus on AI and marks them.[4]

## The finance uses Annex III lists

Annex III is the list of high-risk areas. Point 5 covers access to essential private and public services.[2] Two of its items are finance uses:

- **Credit.** Point 5(b): AI systems to evaluate the creditworthiness of natural persons or establish their credit score, "with the exception of AI systems used for the purpose of detecting financial fraud."[2]
- **Insurance.** Point 5(c): AI systems "intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance."[2]

Both items are about natural persons. The Commission's own example for this area is "credit scoring denying citizens opportunity to obtain a loan."[1] Point 4, employment, also reaches finance teams as employers: it lists AI systems used to recruit or select people, including to "analyse and filter job applications," and systems used to monitor and evaluate the performance and behaviour of workers.[2]

Annex III has no item for accounting, invoice processing, the financial close or financial reporting tools. A finance team's use of AI for that work is not listed as high-risk by this annex; whether another part of the Act reaches a given system depends on that system, and this page does not decide it.

## What a deployer of a high-risk system must do

Article 26 sets the duties of deployers of high-risk systems.[3] Deployers must use the system in line with its instructions for use, assign human oversight "to natural persons who have the necessary competence, training and authority," ensure input data they control is relevant and sufficiently representative, monitor the system, and keep its automatically generated logs for at least six months unless other law provides otherwise.[3] An employer must inform workers' representatives and affected workers before putting a high-risk system into use at the workplace.[3]

Article 26 has two provisions written for banks and other regulated finance firms. For deployers that are financial institutions subject to internal governance requirements under Union financial services law, the monitoring duty "shall be deemed to be fulfilled" by complying with those governance rules, and the logs are kept as part of the documentation that financial services law already requires.[3]

## The AI literacy duty

Article 4 applies to providers and deployers of any AI system, high-risk or not. As amended, it says they "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf," and adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual."[4] The Service Desk marks both sentences as amended by the Digital Omnibus.[4]

## The dates

The Commission's timeline, as its page gives it:[1]

- The Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions.
- Prohibited practices and the AI literacy obligations applied from 2 February 2025.
- Governance rules and the obligations for general-purpose AI models applied from 2 August 2025.
- Rules for the Annex III high-risk uses, which include credit scoring, were extended to 2 December 2027 under the AI Omnibus; rules for high-risk systems built into regulated products apply from 2 August 2028.
- The transparency rules, such as telling people they are dealing with a chatbot and labelling deep fakes, apply from August 2026.

The Commission says the AI Omnibus was adopted as a proposal on 19 November 2025, reached political agreement on 7 May 2026 and entered into force on 27 July 2026.[1]

## Where this meets the filings

The log on this site quotes what US filers tell the SEC about AI next to their finance work. For those passages see [how to read an AI risk factor](https://cfonews.ai/explainers/how-to-read-an-ai-risk-factor) and the [risk-factor tracker](https://cfonews.ai/stats/ai-in-10-k-risk-factors). This page describes what the Commission's pages say. It is not legal advice, and it does not say whether any company's system is high-risk.

Sources:
[1] AI Act, Shaping Europe's digital future. European Commission, 2026-10-19. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
[2] Annex III: High-Risk AI Systems Referred to in Article 6(2). European Commission, AI Act Service Desk, 2026-07-27. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
[3] Article 26: Obligations of deployers of high-risk AI systems. European Commission, AI Act Service Desk, 2026-07-27. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26
[4] Article 4: AI literacy. European Commission, AI Act Service Desk, 2026-07-27. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4


## Regulation tracker

- 2026-10-09 IOSCO, Media release: IOSCO announces winners of its first TechSprint on Investor Education in the Age of Artificial Intelligence (AI). IOSCO named Altara and Swipewise the winners of its first TechSprint, whose problem statements asked how to help retail investors identify and avoid AI-enabled fraud and scams and how to educate them to use AI as a learning tool. https://www.iosco.org/news/pdf/IOSCONEWS804.pdf?v=4 (checked 2026-11-02)

- 2026-09-30 PCAOB, Standard-setting agenda: Standard-Setting, Research, Rulemaking, and Related Activities. The PCAOB staff is considering guidance for auditors on how a company's use of super intelligence in financial reporting affects the audit, and on auditors' own use of it. https://pcaobus.org/oversight/standards/standard-setting-research-rulemaking-related-activities (checked 2026-11-02)

- 2026-09-29 Fed, Speech: Payments in the Age of AI Agents. Governor Christopher J. Waller said the payments industry was an early adopter of large language models for payment reconciliation and named authentication, liability and fraud as challenges for payments made by AI agents. https://www.federalreserve.gov/newsevents/speech/waller20260928a.htm (checked 2026-10-29)

- 2026-09-28 Fed, Speech: An Update on AI and the Economy. Governor Lisa D. Cook said the Federal Reserve, as a supervisor of banking organizations, has encouraged responsible use of AI in the financial sector consistent with safe and sound practices and applicable law. https://www.federalreserve.gov/newsevents/speech/cook20260928a.htm (checked 2026-11-01)

- 2026-09-17 SEC, Speech: Information in the Age of AI. Joshua White, Chief Economist and Director of the Division of Economic and Risk Analysis, said financial information increasingly has two audiences, people and machines, and that AI may lower some costs of preparing disclosures. https://www.sec.gov/newsroom/speeches-statements/white-remarks-ici-compliance-091726 (checked 2026-10-29)

- 2026-07-07 Fed, Speech: Opening Remarks on Sound Practices for Artificial Intelligence. Vice Chair for Supervision Michelle W. Bowman discussed the Financial Stability Board's consultation report on sound practices for responsible adoption of AI, which she said is to be finalized later in 2026 as a U.S. G-20 deliverable. https://www.federalreserve.gov/newsevents/speech/bowman20260707a.htm (checked 2026-10-29)

- 2026-06-18 IOSCO, Media release: IOSCO publishes Report on Supervisory Technology (SupTech). IOSCO's report on a survey of 49 jurisdictions said authorities see artificial intelligence, data access and cloud infrastructure as critical enablers of supervisory technology. https://www.iosco.org/news/pdf/IOSCONEWS800.pdf?v=4 (checked 2026-11-02)

- 2026-05-27 Fed, Speech: The Opportunities and Risks AI Presents for the Economy and Financial System. Governor Lisa D. Cook said that, alongside experimentation, strong governance and risk management must be the foundation for the use of AI. https://www.federalreserve.gov/newsevents/speech/cook20260527a.htm (checked 2026-10-29)

- 2026-05-25 IOSCO, Media release: IOSCO publishes AI Supervisory Toolkit. IOSCO published a Supervisory Toolkit for AI Use in Capital Markets with tools for overseeing governance and risk management, third-party and outsourcing risk, disclosure, and recordkeeping and reporting of AI systems used by regulated entities. https://www.iosco.org/news/pdf/IOSCONEWS796.pdf?v=4 (checked 2026-11-02)

- 2026-05-08 SEC, Speech: Remarks at the Special Competitive Studies Project AI+ Expo. Chairman Paul S. Atkins said SEC staff had issued statements, FAQs and no-action letters to reduce legal uncertainty for issuers, registrants and other market participants seeking to apply AI to their operations. https://www.sec.gov/newsroom/speeches-statements/atkins-remarks-scsp-ai-expo-050826 (checked 2026-11-01)

- 2026-05-01 Fed, Speech: Artificial Intelligence in the Financial System. Speaking at a Financial Stability Oversight Council roundtable on cybersecurity and risk management, Vice Chair for Supervision Michelle W. Bowman said financial institutions are developing their own AI applications and implementing vendor-assisted tools. https://www.federalreserve.gov/newsevents/speech/bowman20260501a.htm (checked 2026-10-29)

- 2026-03-04 SEC, Speech: Remarks at Financial Stability Oversight Council Artificial Intelligence Innovation Series Roundtable on Strategy and Governance Principles. Chairman Paul S. Atkins said materiality-based disclosure principles should guide how a public company discloses developments concerning AI and warned against treating each new technology as a pretext for new line items. https://www.sec.gov/newsroom/speeches-statements/atkins-remarks-at-financial-stability-oversight-council-artificial-intelligence-innovation-series-roundtable-030426 (checked 2026-11-01)

- 2026-02-24 Fed, Speech: Operationalizing AI at the Federal Reserve. Governor Christopher J. Waller described how the Federal Reserve System uses AI in its operational work, which he said includes payments, financial management and financial services to the U.S. Treasury. https://www.federalreserve.gov/newsevents/speech/waller20260224a.htm (checked 2026-10-29)

- 2026-02-03 SEC, Speech: Artificial Intelligence and the Future of Investment Management. Brian Daly, Director of the Division of Investment Management, offered the idea of reimagining fund disclosure with large language models as a conversation starter, saying it was not a mandate or guidance. https://www.sec.gov/newsroom/speeches-statements/daly-020326-artificial-intelligence-future-investment-management (checked 2026-11-01)

- 2025-12-09 FINRA, Report section: GenAI: Continuing and Emerging Trends. A section new to FINRA's 2026 Annual Regulatory Oversight Report says FINRA's rules continue to apply when firms use GenAI and that firms have started to implement GenAI with a focus on efficiency in internal processes. https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai (checked 2026-10-29)

- 2025-11-21 Fed, Speech: AI, the Economy, and Financial Stability. Vice Chair Philip N. Jefferson said 30 percent of market contacts in the Federal Reserve's most recent financial stability survey cited a turn in sentiment toward AI as a salient risk, up from 9 percent in the spring survey. https://www.federalreserve.gov/newsevents/speech/jefferson20251121a.htm (checked 2026-11-01)

- 2025-11-11 Fed, Speech: AI and Central Banking. Governor Michael S. Barr said financial-sector tasks including credit decision support, fraud detection and trading are using AI-specific tools and that firms need AI-driven processes to be consistent with relevant laws and appropriate risk management. https://www.federalreserve.gov/newsevents/speech/barr20251111a.htm (checked 2026-11-01)

- 2025-10-21 Fed, Speech: Embracing New Technologies and Players in Payments. Governor Christopher J. Waller said the Federal Reserve is conducting hands-on research on tokenization, smart contracts and the intersection of AI and payments for use in its own payment systems. https://www.federalreserve.gov/newsevents/speech/waller20251021a.htm (checked 2026-11-01)

- 2025-10-16 Fed, Speech: Exploring the Possibilities and Risks of New Payment Technologies. Governor Michael S. Barr said AI may be well suited to flag payments that are outliers relative to typical patterns, potentially reducing false positives and unnecessary filings. https://www.federalreserve.gov/newsevents/speech/barr20251016a.htm (checked 2026-11-01)

- 2025-08-01 SEC, Press release: SEC Creates Task Force to Tap Artificial Intelligence for Enhanced Innovation and Efficiency Across the Agency. The SEC launched an AI task force for its own operations, led by Valerie Szczepanik, who was named the SEC's Chief AI Officer. https://www.sec.gov/newsroom/press-releases/2025-103-sec-creates-task-force-tap-artificial-intelligence-enhanced-innovation-efficiency-across-agency (checked 2026-10-29)

- 2025-07-17 Fed, Speech: AI: A Fed Policymaker's View. Governor Lisa D. Cook said a central tenet of good AI governance should be the mindset that humans are in the loop, so that people guide AI rather than AI guiding people. https://www.federalreserve.gov/newsevents/speech/cook20250717a.htm (checked 2026-11-01)

- 2025-05-19 GAO, Report: Artificial Intelligence: Use and Oversight in Financial Services. GAO reported that federal financial regulators primarily oversee AI using existing laws, regulations, guidance and risk-based examinations, and that some have issued AI-specific guidance or run AI-focused examinations. https://www.gao.gov/products/gao-25-107197 (checked 2026-10-29)

- 2025-04-17 Fed, Speech: Deepfakes and the AI Arms Race in Bank Cybersecurity. Governor Michael S. Barr described deepfake attacks, in which an attacker uses generative AI to imitate a person's voice or image to commit fraud, and said such attacks had seen a twentyfold increase over three years. https://www.federalreserve.gov/newsevents/speech/barr20250417a.htm (checked 2026-10-29)

- 2025-04-04 Fed, Speech: AI, Fintechs, and Banks. Governor Michael S. Barr said banks appeared to be moving cautiously with generative AI, reflecting the state of the technology, their internal organizational structure and the highly regulated environment in which they operate. https://www.federalreserve.gov/newsevents/speech/barr20250404a.htm (checked 2026-11-01)

- 2025-03-20 SEC, Press release: SEC Announces Agenda, Panelists for Roundtable on Artificial Intelligence. The SEC published the agenda and panelists for its March 27 AI roundtable, and Acting Chairman Mark T. Uyeda asked the public for data and evidence on how AI can be used to protect investors. https://www.sec.gov/newsroom/press-releases/2025-56-sec-announces-agenda-panelists-roundtable-artificial-intelligence (checked 2026-10-29)

- 2025-02-28 SEC, Press release: SEC to Host Roundtable on Artificial Intelligence. The SEC announced a public roundtable on March 27, 2025 to discuss the risks, benefits and governance of AI in the financial industry. https://www.sec.gov/newsroom/press-releases/2025-48 (checked 2026-10-29)

- 2025-02-20 SEC, Press release: SEC Announces Cyber and Emerging Technologies Unit to Protect Retail Investors. The SEC created the Cyber and Emerging Technologies Unit, replacing the Crypto Assets and Cyber Unit, and listed fraud committed using emerging technologies such as AI and machine learning among its priority areas. https://www.sec.gov/newsroom/press-releases/2025-42 (checked 2026-10-29)

- 2025 IOSCO, Consultation report: Artificial Intelligence in Capital Markets: Use Cases, Risks, and Challenges. IOSCO's consultation report found that firms are using or considering using recent advances in AI to support internal operations and processes through task automation, to enhance communications and to improve risk management functions. https://www.iosco.org/library/pubdocs/pdf/IOSCOPD788.pdf (checked 2026-11-02)

- 2024-12-19 Treasury, Report: Treasury Releases Report on the Uses, Opportunities, and Risks of Artificial Intelligence in Financial Services. Treasury released a report summarizing responses to its 2024 request for information on AI in financial services and recommending next steps, including clarifying supervisory expectations under existing risk management frameworks. https://home.treasury.gov/news/press-releases/jy2760 (checked 2026-10-29)

- 2024-12-12 BIS, FSI Insights paper: Regulating AI in the financial sector: recent developments and main challenges. A Financial Stability Institute paper, giving its authors' views, found that most financial authorities have not issued AI rules specific to financial institutions and named governance, model risk management, data governance and third-party AI providers as areas needing further attention. https://www.bis.org/fsi/publ/insights63.htm (checked 2026-11-01)

- 2024-12-05 CFTC, Staff advisory: CFTC Staff Issues Advisory Related to the Use of Artificial Intelligence by CFTC-Registered Entities and Registrants. Four CFTC divisions issued a staff advisory reminding registered entities and registrants of their obligations under the Commodity Exchange Act and CFTC regulations as they implement AI. https://www.cftc.gov/PressRoom/PressReleases/9013-24 (checked 2026-10-29)

- 2024-11-22 Fed, Speech: Artificial Intelligence in the Financial System. Governor Michelle W. Bowman asked whether existing regulatory frameworks are sufficient for AI and noted that the financial services sector has been using AI for some time. https://www.federalreserve.gov/newsevents/speech/bowman20241122a.htm (checked 2026-10-29)

- 2024-11-13 FinCEN, Alert: FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions. FinCEN issued an alert explaining fraud schemes that use deepfake media created with generative AI tools, with red flag indicators and a reminder of Bank Secrecy Act reporting requirements. https://www.fincen.gov/news/news-releases/fincen-issues-alert-fraud-schemes-involving-deepfake-media-targeting-financial (checked 2026-10-29)

- 2024-10-10 SEC, Press release: SEC Charges Rimar Capital Entities and Owner Itai Liptz for Defrauding Investors by Making False and Misleading Statements About Use of Artificial Intelligence. The SEC settled charges that Rimar Capital entities, their owner and a board member made false and misleading statements about the purported use of AI for automated trading, with $310,000 in total civil penalties. https://www.sec.gov/newsroom/press-releases/2024-167 (checked 2026-10-29)

- 2024-07 PCAOB, Staff spotlight: Spotlight: Staff Update on Outreach Activities Related to the Integration of Generative Artificial Intelligence in Audits and Financial Reporting. PCAOB staff said the audit firms it spoke to appeared to use generative AI mainly for administrative and research activities, and that firms investing in it expect it to augment, but not replace, humans in auditing or in financial reporting. https://pcaobus.org/documents/generative-ai-spotlight.pdf (checked 2026-11-02)

- 2024-06-30 BIS, Annual Economic Report chapter: III. Artificial intelligence and the economy: implications for central banks. The BIS Annual Economic Report 2024 said central banks are affected by AI both as stewards of monetary and financial stability and as users of AI tools, and named data availability and data governance as key enabling factors for their use of it. https://www.bis.org/publ/arpdf/ar2024e3.htm (checked 2026-11-01)

- 2024-06-27 FINRA, Regulatory notice: FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models. Regulatory Notice 24-09 reminds member firms of their obligations when using generative AI and states that it does not create new legal or regulatory requirements. https://www.finra.org/rules-guidance/notices/24-09 (checked 2026-10-29)

- 2024-06-06 Treasury, Request for information: U.S. Department of Treasury Releases Request for Information on Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector. Treasury asked for public comment, within 60 days, on how AI is used in financial services and on the opportunities and risks it presents. https://home.treasury.gov/news/press-releases/jy2393 (checked 2026-10-29)

- 2024-03-27 Treasury, Report: U.S. Department of the Treasury Releases Report on Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Sector. Treasury released a report on AI-specific cybersecurity risks in financial services that outlines next steps on AI-related operational risk, cybersecurity and fraud, including a widening gap between large and small institutions. https://home.treasury.gov/news/press-releases/jy2212 (checked 2026-10-29)

- 2024-03-18 SEC, Press release: SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence. The SEC announced settled charges against Delphia (USA) Inc. and Global Predictions Inc. for false and misleading statements about their purported use of AI, with $400,000 in total civil penalties. https://www.sec.gov/newsroom/press-releases/2024-36 (checked 2026-10-29)

- 2024-02-13 SEC, Speech: AI, Finance, Movies, and the Law - Prepared Remarks Before the Yale Law School. Chair Gary Gensler said a company raising money from the public needs to be truthful about its use of AI and associated risk, and that investors benefit from AI risk disclosures particularized to the company rather than boilerplate. https://www.sec.gov/newsroom/speeches-statements/gensler-ai-021324 (checked 2026-10-29)

- 2024-01-25 CFTC, Request for comment: CFTC Staff Releases Request for Comment on the Use of Artificial Intelligence in CFTC-Regulated Markets. CFTC staff asked for comment on uses of AI in derivatives markets, including trading, risk management, compliance and recordkeeping, and on risks including fraud, governance and explainability. https://www.cftc.gov/PressRoom/PressReleases/8853-24 (checked 2026-10-29)

- 2023-07-26 SEC, Proposed rule: SEC Proposes New Requirements to Address Risks to Investors From Conflicts of Interest Associated With the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers. The SEC proposed rules that would require broker-dealers and investment advisers to address conflicts of interest associated with their use of predictive data analytics and similar technologies when interacting with investors. https://www.sec.gov/newsroom/press-releases/2023-140 (checked 2026-10-29)

- 2021-09 IOSCO, Final report: The use of artificial intelligence and machine learning by market intermediaries and asset managers. IOSCO's final report set out six measures of guidance for supervising market intermediaries and asset managers that use AI and machine learning, starting with designated senior management responsible for oversight of the technology. https://www.iosco.org/library/pubdocs/pdf/IOSCOPD684.pdf (checked 2026-11-02)


## Filings

- 2026-11-13 LFTD Partners says its use of AI could result in errors in its tax filings or financial reporting. LFTD Partners says its use of artificial intelligence technologies could result in errors in its operations, tax filings or financial reporting, or expose confidential information. The passage is from the company's Form 10-Q filed 2026-11-13. Quoted: "Our use of artificial intelligence technologies could result in errors in our operations, tax filings, or financial reporting, or expose confidential information." (LFTD PARTNERS INC. (LIFD), Form 10-Q, accession 0001096906-26-001745, https://www.sec.gov/Archives/edgar/data/1391135/000109690626001745/lftp_10q.htm). https://cfonews.ai/filings/lftd-partners-inc-10-q-2026-11-13

- 2026-11-10 Focus Universal names SEC financial reporting automation and a Deterministic AI engine as development areas. Focus Universal says its announced development areas include SEC financial reporting automation, financial auditing automation and the Deterministic AI Forms Auto-Populate Engine. The passage appears under Item 2, Management's Discussion and Analysis, in the 10-Q filed 2026-11-10. Quoted: "The Company’s announced development areas include SEC financial reporting automation, financial auditing automation and the Deterministic AI Forms Auto-Populate Engine." (FOCUS UNIVERSAL INC. (FCUV), Form 10-Q, Item 2, MD&A, accession 0001683168-26-008451, https://www.sec.gov/Archives/edgar/data/1590418/000168316826008451/focus_i10q-093026.htm). https://cfonews.ai/filings/focus-universal-inc-10-q-2026-11-10

- 2026-11-05 American Coastal Insurance says AI output errors could reach its financial reporting. American Coastal Insurance says reliance on inaccurate AI output could result in underwriting, claims, financial reporting or other operational errors, and that AI-assisted software code may contain defects or security vulnerabilities. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2026-11-05. Quoted: "Reliance on inaccurate output could result in underwriting, claims, financial reporting or other operational errors, and software code generated with the assistance of AI may contain defects or security vulnerabilities." (AMERICAN COASTAL INSURANCE Corp (ACIC), Form 10-Q, Item 1A, Risk Factors, accession 0001401521-26-000045, https://www.sec.gov/Archives/edgar/data/1401521/000140152126000045/acic-20260930.htm). https://cfonews.ai/filings/american-coastal-insurance-corp-10-q-2026-11-05

- 2026-11-03 EchoStar names offensive use of AI Technologies among risks that could cause errors in its financial reporting. EchoStar says improperly licensed data, inadequate oversight, defects, cybersecurity threats including offensive use of AI Technologies, or other negative results could cause errors in its regulatory filings, contracts, financial reporting and business decisions. The passage appears under Part II, Item 1A, Risk Factors, in the 10-Q filed 2026-11-03. Quoted: "... improperly licensed data, inadequate oversight, defects, cybersecurity threats (including offensive use of AI Technologies) or other negative results, could impair our networks and services, cause errors in our regulatory filings, contracts, financial reporting and business decisions, harm our ..." (EchoStar CORP (ECHO), Form 10-Q, Item 1A, Risk Factors, accession 0001104659-26-121675, https://www.sec.gov/Archives/edgar/data/1415404/000110465926121675/sats-20260930x10q.htm). https://cfonews.ai/filings/echostar-corp-10-q-2026-11-03

- 2026-11-03 Redwood Trust says it deployed agents in technology support and FP&A work. A Redwood Trust presentation slide headed Technology & AI Update Q3’26, filed as Exhibit 99.3, says the company deployed agents in technology support and FP&A handling work that once required manual effort from staff and executives alike. The passage is from the company's Form 8-K filed 2026-11-03. Quoted: "RWT Horizons: Technology & AI Update Q3’26 ▪ Deployed agents in technology support and FP&A handling work that once required manual effort from staff and executives alike ▪ Delivered self-service data access to our Capital Markets Teams ..." (REDWOOD TRUST INC (RWT, RWTN, RWTO, RWTP, RWTQ, RWTS, RWT-PA), Form 8-K, accession 0000930236-26-000030, https://www.sec.gov/Archives/edgar/data/930236/000093023626000030/q326redwoodreview.htm). https://cfonews.ai/filings/redwood-trust-inc-8-k-2026-11-03

- 2026-11-02 Clorox says its increasing use of artificial intelligence may result in changes to its internal controls. Clorox names its increasing use of emerging technologies such as artificial intelligence, along with digital capabilities, productivity enhancements and the integration of acquired businesses, as developments that may result in changes to its internal controls over financial reporting. The passage appears under Item 2, Management's Discussion and Analysis, in the 10-Q filed 2026-11-02. Quoted: "... digital capabilities and productivity enhancements, its increasing use of emerging technologies such as artificial intelligence, and the integration of acquired businesses (including Clorox Purell ProCare) that may result in changes to the Company's internal controls over financial reporting ..." (CLOROX CO /DE/ (CLX), Form 10-Q, Item 2, MD&A, accession 0000021076-26-000046, https://www.sec.gov/Archives/edgar/data/21076/000002107626000046/clx-20260930.htm). https://cfonews.ai/filings/clorox-co-10-q-2026-11-02

- 2026-10-28 Zedge lists finance among the functions where it relies on AI. Zedge says it relies on AI for functions across its business, among them development, content moderation, marketing assets, finance and legal. The passage appears under Item 7, Management's Discussion and Analysis, in the 10-K filed 2026-10-28. Quoted: "We incorporate AI into products such as pAInt and rely on AI for development, content moderation, personalization, marketing assets, finance, legal, user engagement, and other functions across our business ..." (Zedge, Inc. (ZDGE), Form 10-K, Item 7, MD&A, accession 0001213900-26-113312, https://www.sec.gov/Archives/edgar/data/1667313/000121390026113312/ea0309434-10k_zedge.htm). https://cfonews.ai/filings/zedge-inc-10-k-2026-10-28

- 2026-10-21 Winnebago says unreliable AI outputs could affect forecasting and financial reporting. Winnebago Industries says AI systems may produce inaccurate or otherwise unreliable outputs that could adversely affect functions including forecasting, financial reporting processes and compliance activities. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-10-21. Quoted: "AI systems may produce inaccurate, misleading, biased, incomplete, inconsistent, or otherwise unreliable outputs, which could adversely affect business decisions, operational execution, customer interactions, product development, forecasting, financial reporting processes, compliance activities, or other business functions." (WINNEBAGO INDUSTRIES INC (WGO), Form 10-K, Item 1A, Risk Factors, accession 0001628280-26-066701, https://www.sec.gov/Archives/edgar/data/107687/000162828026066701/wgo-20260829.htm). https://cfonews.ai/filings/winnebago-industries-inc-10-k-2026-10-21

- 2026-10-08 Oil-Dri says it does not currently use AI in financial reporting or its internal controls. Oil-Dri says it does not currently utilize AI technologies within its financial reporting or internal control over financial reporting functions, while it uses and intends to expand its use of AI to support its business. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-10-08. Quoted: "While we do not currently utilize artificial intelligence ("AI") technologies within our financial reporting or internal control over financial reporting functions, we utilize and intend to expand our use of AI technologies to support our business." (Oil-Dri Corp of America (ODC), Form 10-K, Item 1A, Risk Factors, accession 0001628280-26-065453, https://www.sec.gov/Archives/edgar/data/74046/000162828026065453/odc-20260731.htm). https://cfonews.ai/filings/oil-dri-corp-of-america-10-k-2026-10-08

- 2026-09-10 IBEX names AI-enabled social engineering among routes to fraudulent payments. IBEX says threat actors may attempt to induce its personnel or its vendors' personnel to make fraudulent payments, including through business email compromise, AI-enabled social engineering or wire fraud schemes. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-09-10. Quoted: "Threat actors may again attempt to ... fraudulently induce our personnel or the personnel of our vendors ... to obtain fraudulent payments, including through phishing, business email compromise, AI-enabled social engineering or wire fraud schemes." (IBEX Ltd (IBEX), Form 10-K, Item 1A, Risk Factors, accession 0001720420-26-000025, https://www.sec.gov/Archives/edgar/data/1720420/000172042026000025/ibex-20260630.htm). https://cfonews.ai/filings/ibex-ltd-10-k-2026-09-10

- 2026-08-31 Super Micro Computer says AI output errors could reach its financial reporting. Super Micro Computer says AI technology may produce inaccurate, incomplete, biased, misleading or fabricated responses that could lead to errors in areas including its financial reporting and compliance activities. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-08-31. Quoted: "AI technology may also produce inaccurate, incomplete, biased, misleading or fabricated responses that could lead to errors in our decision-making, solution development, financial reporting, compliance activities, customer communications or other business activities ..." (Super Micro Computer, Inc. (SMCI, SMCIP), Form 10-K, Item 1A, Risk Factors, accession 0001375365-26-000022, https://www.sec.gov/Archives/edgar/data/1375365/000137536526000022/smci-20260630.htm). https://cfonews.ai/filings/super-micro-computer-inc-10-k-2026-08-31

- 2026-08-24 Brownie's Marine Group describes AI-enabled analytical testing as a supplemental financial review control. Brownie's Marine Group says it is implementing technology-assisted financial review procedures, including AI-enabled analytical testing, as a supplemental control to identify reporting anomalies for further human review. The passage appears under Item 4, Controls and Procedures, in the 10-Q/A filed 2026-08-24. Quoted: "Implementing technology-assisted financial review procedures, including AI-enabled analytical testing, as a supplemental control designed to identify period inconsistencies, mathematical discrepancies, unusual variances, internal inconsistencies and other potential reporting anomalies for further human review" (Brownie's Marine Group, Inc (BWMG), Form 10-Q/A, Item 4, Controls and Procedures, accession 0001493152-26-039921, https://www.sec.gov/Archives/edgar/data/1166708/000149315226039921/form10-qa.htm). https://cfonews.ai/filings/brownies-marine-group-inc-10-q-a-2026-08-24

- 2026-08-21 Prospect Capital says portfolio company Pacific World uses AI on receivables collections. Prospect Capital's earnings release, filed as an 8-K exhibit, lists Pacific World as using AI for work that includes optimizing accounts receivable collections review and dispute processes and building a data warehouse that unifies finance, marketing and sales data. The passage is from the company's Form 8-K filed 2026-08-21. Quoted: "Pacific World using AI for consumer insight testing for new product development, optimizing accounts receivable collections review and dispute processes, and building an enterprise data warehouse unifying finance, marketing, and sales data ..." (PROSPECT CAPITAL CORP (PSEC, PSEC-PA), Form 8-K, accession 0001287032-26-000270, https://www.sec.gov/Archives/edgar/data/1287032/000128703226000270/a2026-6x30xpsecearningsrel.htm). https://cfonews.ai/filings/prospect-capital-corp-8-k-2026-08-21

- 2026-08-20 BILL says AI runs across its payables, receivables and forecasting platform. BILL Holdings says it uses artificial intelligence to deliver finance capabilities in one platform that includes accounts payable, accounts receivable, expenses, forecasting and procurement. The passage appears under Item 1, Business, in the 10-K filed 2026-08-20. Quoted: "We use artificial intelligence (AI) to deliver strategic finance capabilities in one integrated platform that includes accounts payable (AP), accounts receivable (AR), expenses, forecasting, procurement, and more." (BILL Holdings, Inc. (BILL), Form 10-K, Item 1, Business, accession 0001628280-26-058238, https://www.sec.gov/Archives/edgar/data/1786352/000162828026058238/bill-20260630.htm). https://cfonews.ai/filings/bill-holdings-inc-10-k-2026-08-20

- 2026-08-17 Bakkt says it intends to build an AI-enabled finance organization. A statement attributed to Bakkt's chief executive in an 8-K exhibit says the company intends to build a modern, data-driven and AI-enabled finance organization. The passage is from the company's Form 8-K filed 2026-08-17. Quoted: "We intend to build a modern, data-driven and AI-enabled finance organization that can operate at speed, allocate capital intelligently and support the scale of the opportunity ahead of us." (Bakkt, Inc. (BKKT, BKKT-WT), Form 8-K, accession 0001193125-26-353239, https://www.sec.gov/Archives/edgar/data/1820302/000119312526353239/d145238dex991.htm). https://cfonews.ai/filings/bakkt-inc-8-k-2026-08-17

- 2026-08-14 OLB Group says it is building AI agents for invoices, reconciliation and the close. OLB Group says that in accounting and finance it is developing AI agents intended to automate invoice processing, reconciliation, residual calculations, expense categorization and routine financial close activities. The passage appears under Item 2, Management's Discussion and Analysis, in the 10-Q filed 2026-08-14. Quoted: "In accounting and finance, we are developing AI agents intended to automate invoice processing, reconciliation, residual calculations, expense categorization and routine financial close activities." (OLB GROUP, INC. (OLB), Form 10-Q, Item 2, MD&A, accession 0001185185-26-003553, https://www.sec.gov/Archives/edgar/data/1314196/000118518526003553/olbgroup10q063026.htm). https://cfonews.ai/filings/olb-group-inc-10-q-2026-08-14

- 2026-08-14 TOMI Environmental Solutions lists AI-assisted GAAP research tools among its remediation actions. TOMI Environmental Solutions lists, under remediation progress and actions taken, the integration of AI-assisted technical research tools to support complex U.S. GAAP research and financial statement disclosures. The passage appears under Item 4, Controls and Procedures, in the 10-Q filed 2026-08-14. Quoted: "Remediation - Progress and Actions Taken ... Integrated AI-assisted technical research tools to support complex U.S. GAAP research and financial statement disclosures." (TOMI Environmental Solutions, Inc. (TOMZ), Form 10-Q, Item 4, Controls and Procedures, accession 0001654954-26-007620, https://www.sec.gov/Archives/edgar/data/314227/000165495426007620/tomz_10q.htm). https://cfonews.ai/filings/tomi-environmental-solutions-inc-10-q-2026-08-14

- 2026-08-13 Cabaletta Bio warns of deepfakes impersonating executives, banks and vendors. Cabaletta Bio says malicious actors are using AI-enabled tools, including deepfake technologies capable of impersonating company executives, financial institutions, vendors or other trusted parties. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2026-08-13. Quoted: "Malicious actors are increasingly using AI‑enabled tools to automate attacks, generate highly convincing phishing communications, and deploy “deepfake” technologies capable of impersonating company executives, financial institutions, vendors or other trusted parties." (Cabaletta Bio, Inc. (CABA), Form 10-Q, Item 1A, Risk Factors, accession 0001759138-26-000039, https://www.sec.gov/Archives/edgar/data/1759138/000175913826000039/caba-20260630.htm). https://cfonews.ai/filings/cabaletta-bio-inc-10-q-2026-08-13

- 2026-08-12 Sutro Biopharma says AI tools can impersonate executives through synthetic voice or video. Sutro Biopharma says generative AI and other AI-enabled tools can be used to generate convincing phishing and social engineering campaigns and to impersonate executives and business partners through synthetic voice or video content. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2026-08-12. Quoted: "Generative AI and other AI-enabled tools can be used to ... generate highly convincing phishing and social engineering campaigns, impersonate executives and business partners through synthetic voice or video content ..." (SUTRO BIOPHARMA, INC. (STRO), Form 10-Q, Item 1A, Risk Factors, accession 0001193125-26-345748, https://www.sec.gov/Archives/edgar/data/1382101/000119312526345748/stro-20260630.htm). https://cfonews.ai/filings/sutro-biopharma-inc-10-q-2026-08-12

- 2026-08-11 Cardinal Health links its AI initiatives to internal control over financial reporting. Cardinal Health says that if initiatives, including those related to artificial intelligence and machine learning, are not successfully or efficiently implemented or maintained, its internal control over financial reporting could be negatively affected. The passage appears in the 10-K filed 2026-08-11. Quoted: "If any of these initiatives ... and initiatives related to artificial intelligence and machine learning, are not successfully or efficiently implemented or maintained ... we could experience negative impacts on our business, financial results, and our internal control over financial reporting." (CARDINAL HEALTH INC (CAH), Form 10-K, accession 0000721371-26-000038, https://www.sec.gov/Archives/edgar/data/721371/000072137126000038/cah-20260630.htm). https://cfonews.ai/filings/cardinal-health-inc-10-k-2026-08-11

- 2026-08-06 International Bancshares lists AI-driven fraud and deepfake impersonation as a risk. International Bancshares lists increased cybersecurity and fraud risks from threat actors' use of AI, including deepfake impersonations and social engineering. The passage appears under Item 2, Management's Discussion and Analysis, in the 10-Q filed 2026-08-06. Quoted: "Increased cybersecurity and fraud risks resulting from threat actors’ use of AI and other advanced technologies to conduct more sophisticated phishing schemes, social engineering, deepfake impersonations, and other cyberattacks ..." (INTERNATIONAL BANCSHARES CORP (IBOC), Form 10-Q, Item 2, MD&A, accession 0001104659-26-091933, https://www.sec.gov/Archives/edgar/data/315709/000110465926091933/iboc-20260630x10q.htm). https://cfonews.ai/filings/international-bancshares-corp-10-q-2026-08-06

- 2026-08-05 ACADIA Pharmaceuticals names AI-assisted business email compromise among threats. ACADIA Pharmaceuticals says threat actors use AI technologies to enhance attacks including phishing, business email compromise, impersonation and deepfake-enabled social engineering. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2026-08-05. Quoted: "Threat actors increasingly utilize AI technologies to enhance cyberattacks, including phishing, business email compromise, impersonation, deepfake-enabled social engineering, automated reconnaissance, credential theft, and other malicious activities." (ACADIA PHARMACEUTICALS INC (ACAD), Form 10-Q, Item 1A, Risk Factors, accession 0001193125-26-333243, https://www.sec.gov/Archives/edgar/data/1070494/000119312526333243/acad-20260630.htm). https://cfonews.ai/filings/acadia-pharmaceuticals-inc-10-q-2026-08-05

- 2026-08-05 Akebia names AI-generated deep fake communications among routes to fraudulent payments. Akebia Therapeutics says outside parties may try to induce employees, collaborators or contractors to take actions including making fraudulent payments, using spoofing and phishing emails and artificial intelligence-generated deep fake communications. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2026-08-05. Quoted: "Additionally, outside parties may attempt to fraudulently induce employees, collaborators, or other contractors to disclose sensitive information or take other actions, including making fraudulent payments or downloading malware, by using “spoofing” and “phishing” emails, artificial intelligence-generated deep fake communications ..." (Akebia Therapeutics, Inc. (AKBA), Form 10-Q, Item 1A, Risk Factors, accession 0001517022-26-000051, https://www.sec.gov/Archives/edgar/data/1517022/000151702226000051/akba-20260630.htm). https://cfonews.ai/filings/akebia-therapeutics-inc-10-q-2026-08-05

- 2026-08-05 Flywire says payments companies are frequent targets of AI deepfake attacks. Flywire says payments companies are frequent targets of social engineering and AI deepfake attacks. The passage appears in the 10-Q filed 2026-08-05. Quoted: "Payments companies are frequent targets of social engineering and AI "deepfake" attacks." (Flywire Corp (FLYW), Form 10-Q, accession 0001580560-26-000016, https://www.sec.gov/Archives/edgar/data/1580560/000158056026000016/flyw-20260630.htm). https://cfonews.ai/filings/flywire-corp-10-q-2026-08-05

- 2026-08-05 Paylocity describes AI accounts payable automation from onboarding to reconciliation. Paylocity says its AI-powered Accounts Payable Automation covers the accounts payable process from vendor onboarding and invoice processing to bill coding, approvals, payments, ERP syncing and reconciliation. The passage appears under Item 1, Business, in the 10-K filed 2026-08-05. Quoted: "Accounts Payable Automation – AI-powered Accounts Payable Automation automates every step of the AP process, from vendor onboarding and invoice processing to bill coding, approvals, payments, syncing to the enterprise resource planning system and reconciliation." (Paylocity Holding Corp (PCTY), Form 10-K, Item 1, Business, accession 0001591698-26-000069, https://www.sec.gov/Archives/edgar/data/1591698/000159169826000069/pcty-20260630.htm). https://cfonews.ai/filings/paylocity-holding-corp-10-k-2026-08-05

- 2026-07-31 Roper Technologies says AI is enhancing business email compromise campaigns. Roper Technologies says threat actors are using AI to automate attacks, enhance phishing and business email compromise campaigns, create convincing synthetic media and evade traditional security controls. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2026-07-31. Quoted: "Threat actors are also increasingly using AI to automate cyberattacks, enhance phishing and business email compromise campaigns, create convincing synthetic media, accelerate malware development, identify software vulnerabilities, and evade traditional security controls." (ROPER TECHNOLOGIES INC (ROP), Form 10-Q, Item 1A, Risk Factors, accession 0000882835-26-000036, https://www.sec.gov/Archives/edgar/data/882835/000088283526000036/rop-20260630.htm). https://cfonews.ai/filings/roper-technologies-inc-10-q-2026-07-31

- 2026-06-04 World Acceptance says AI could be used to manipulate internal controls. World Acceptance says malicious actors may exploit AI to create convincing false identities or to manipulate internal controls or verification processes. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-06-04. Quoted: "... malicious actors may exploit AI to create convincing false identities or manipulate internal controls and/or verification processes ..." (WORLD ACCEPTANCE CORP (WRLD), Form 10-K, Item 1A, Risk Factors, accession 0000108385-26-000014, https://www.sec.gov/Archives/edgar/data/108385/000010838526000014/wrld-20260331.htm). https://cfonews.ai/filings/world-acceptance-corp-10-k-2026-06-04

- 2026-05-14 Prestige Consumer Healthcare cites AI-enabled impersonation among threats it has faced. Prestige Consumer Healthcare says it and certain suppliers and customers have faced cybersecurity threats including business email compromise, phishing and social engineering, including AI-enabled impersonation. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-05-14. Quoted: "We and certain of our suppliers and customers have faced, and likely will continue to face evolving cybersecurity threats, including ... business email compromise, phishing, social engineering (including AI-enabled impersonation) ..." (Prestige Consumer Healthcare Inc. (PBH), Form 10-K, Item 1A, Risk Factors, accession 0001295947-26-000016, https://www.sec.gov/Archives/edgar/data/1295947/000129594726000016/pbh-20260331.htm). https://cfonews.ai/filings/prestige-consumer-healthcare-inc-10-k-2026-05-14

- 2026-05-05 BlackLine ties its financial close business to agentic AI in an 8-K. A statement quoted in a BlackLine 8-K exhibit describes the company's Agentic Financial Operations as turning its vision for trusted, auditable AI in the financial close into commercial reality. The passage is from the company's Form 8-K filed 2026-05-05. Quoted: "We are defining the future of the financial close with Agentic Financial Operations, turning our vision for trusted, auditable AI into commercial reality." (BLACKLINE, INC. (BL), Form 8-K, accession 0001171843-26-003023, https://www.sec.gov/Archives/edgar/data/1666134/000117184326003023/exh_991.htm). https://cfonews.ai/filings/blackline-inc-8-k-2026-05-05

- 2026-04-30 Olaplex lists AI risk among its audit committee's responsibilities. Olaplex lists among its Audit Committee's responsibilities assisting the Board in overseeing internal control over financial reporting and risk management practices, including risks related to the use of artificial intelligence. The passage appears in the 10-K/A filed 2026-04-30. Quoted: "... (iv) the Company’s internal control over financial reporting ... (vii) the Company’s policies, procedures and practices with respect to risk management and mitigation, including the Company’s risks related to ... the development, deployment or use of artificial intelligence ..." (OLAPLEX HOLDINGS, INC. (OLPX), Form 10-K/A, accession 0001193125-26-197345, https://www.sec.gov/Archives/edgar/data/1868726/000119312526197345/d132542d10ka.htm). https://cfonews.ai/filings/olaplex-holdings-inc-10-k-a-2026-04-30

- 2026-04-28 Teamshares slide in a Live Oak Acquisition V filing lists AI for AP reconciliation and revenue forecasting. A presentation slide filed as an exhibit by Live Oak Acquisition Corp. V lists Teamshares platform uses of AI that include revenue forecasting, AP reconciliation and cash application, chart of accounts mapping and an accounting review copilot. The passage is from the company's Form 8-K/A filed 2026-04-28. Quoted: "How AI accelerates the platform TEAMSHARES PLATFORM LEVEL Revenue forecasting Investment analysis AP reconciliation + cash application Chart of accounts mapping ... Accounting Review Copilot We can deploy AI into companies we own, measure results directly ..." (Live Oak Acquisition Corp. V (LOKV, LOKVU, LOKVW), Form 8-K/A, accession 0001213900-26-048634, https://www.sec.gov/Archives/edgar/data/2048951/000121390026048634/ea028795201ex99-1.htm). https://cfonews.ai/filings/live-oak-acquisition-corp-v-8-k-a-2026-04-28

- 2026-04-16 Data I/O says it applied AI tools to internal operations including financial reporting. Data I/O says AI tools were applied across several functions, among them ERP implementation planning, data migration and internal business operations including financial reporting and analysis. The passage appears under Item 7, Management's Discussion and Analysis, in the 10-K filed 2026-04-16. Quoted: "AI tools were applied to software engineering to accelerate programming algorithm development and device support, ERP implementation planning and data migration, customer support and service processes, and internal business operations including financial reporting and analysis." (DATA I/O CORP (DAIO), Form 10-K, Item 7, MD&A, accession 0001654954-26-003625, https://www.sec.gov/Archives/edgar/data/351998/000165495426003625/daio_10k.htm). https://cfonews.ai/filings/data-i-o-corp-10-k-2026-04-16

- 2026-04-02 Navan describes its expense management platform, including expense reconciliation, as AI-powered. Navan describes its travel, payments and expense management solution as AI-powered and designed to cover payment processing, expense reconciliation and reporting. The passage appears in the notes to the financial statements in the 10-K filed 2026-04-02. Quoted: "We offer a comprehensive, all-in-one, AI-powered travel, payments and expense management solution designed to streamline the entire travel lifecycle, from booking and policy enforcement to payment processing, expense reconciliation, and reporting." (Navan, Inc. (NAVN), Form 10-K, accession 0001628280-26-023250, https://www.sec.gov/Archives/edgar/data/1639723/000162828026023250/navn-20260131.htm). https://cfonews.ai/filings/navan-inc-10-k-2026-04-02

- 2026-03-31 XBP Global says its accounts payable product uses AI for invoice processing. XBP Global Holdings says its accounts payable and procure-to-pay solution uses artificial intelligence for supplier onboarding, supplier management and invoice processing. The passage appears under Item 1, Business, in the 10-K filed 2026-03-31. Quoted: "Our accounts payable and broader procure-to-pay (“P2P”) solution leverages artificial intelligence to simplify the complexities of supplier onboarding, management, and invoice processing." (XBP Global Holdings, Inc. (XBP, XBPEW), Form 10-K, Item 1, Business, accession 0001104659-26-037421, https://www.sec.gov/Archives/edgar/data/1839530/000110465926037421/xbp-20251231x10k.htm). https://cfonews.ai/filings/xbp-global-holdings-inc-10-k-2026-03-31

- 2026-03-27 Bank of the James names deepfake and voice-spoofing fraud among AI-assisted attacks. Bank of the James Financial Group says malicious actors are using artificial intelligence to conduct attacks including business email compromise, deepfake or voice-spoofing fraud and account takeover attempts. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-27. Quoted: "In particular, malicious actors are increasingly using artificial intelligence and other tools to conduct more sophisticated attacks, including highly targeted phishing and social‑engineering campaigns, business email compromise, deepfake or voice‑spoofing fraud, and account takeover attempts." (BANK OF THE JAMES FINANCIAL GROUP INC (BOTJ), Form 10-K, Item 1A, Risk Factors, accession 0001275101-26-000010, https://www.sec.gov/Archives/edgar/data/1275101/000127510126000010/botj-20251231x10k.htm). https://cfonews.ai/filings/bank-of-the-james-financial-group-inc-10-k-2026-03-27

- 2026-03-26 Linkhome says it has not yet used AI in financial reporting or its controls. Linkhome Holdings says that, although it uses AI in its application and in certain agent activities, it has not yet used AI within its financial reporting or internal control over financial reporting functions. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-26. Quoted: "Notwithstanding the use of AI in our application and with certain agent activities, we’ve yet to utilize AI within our financial reporting or internal control over financial reporting functions." (Linkhome Holdings Inc. (LHAI), Form 10-K, Item 1A, Risk Factors, accession 0001213900-26-034538, https://www.sec.gov/Archives/edgar/data/2017758/000121390026034538/ea0281818-10k_linkhome.htm). https://cfonews.ai/filings/linkhome-holdings-inc-10-k-2026-03-26

- 2026-03-25 Juniata Valley says its AI systems may be exposed to deepfake impersonation fraud. Juniata Valley Financial says AI systems may be vulnerable to cyberattacks, data manipulation or security breaches, including fraud such as deepfake impersonation or automated social engineering. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-25. Quoted: "In addition, AI systems may be vulnerable to cyberattacks, data manipulation, or other security breaches, including emerging forms of fraud such as deepfake impersonation or automated social engineering." (JUNIATA VALLEY FINANCIAL CORP (JUVF), Form 10-K, Item 1A, Risk Factors, accession 0001104659-26-034395, https://www.sec.gov/Archives/edgar/data/714712/000110465926034395/juvf-20251231x10k.htm). https://cfonews.ai/filings/juniata-valley-financial-corp-10-k-2026-03-25

- 2026-03-25 Navan reports launching an AI Expense Agent aimed at manual expense reports. A Navan 8-K exhibit lists the launch of a new AI Expense Agent, which it describes as eliminating manual expense reports. The passage is from the company's Form 8-K filed 2026-03-25. Quoted: "Launched New AI Expense Agent: Eliminating manual expense reports by bringing the simplicity of Navan’s corporate card transactions to the most complex segments of the expense process." (Navan, Inc. (NAVN), Form 8-K, accession 0001628280-26-021033, https://www.sec.gov/Archives/edgar/data/1639723/000162828026021033/navnq4fy26earningspressrel.htm). https://cfonews.ai/filings/navan-inc-8-k-2026-03-25

- 2026-03-19 Kohl's says deepfakes can be used to impersonate company leadership. Kohl's says generative artificial intelligence and deepfake technologies can be used to create fictitious media content, spread misinformation or impersonate company leadership. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-19. Quoted: "This risk is exacerbated by the rise of generative artificial intelligence and deepfake technologies, which can be used to create fictitious media content, spread misinformation, or impersonate company leadership." (KOHLS Corp (KSS), Form 10-K, Item 1A, Risk Factors, accession 0001193125-26-115982, https://www.sec.gov/Archives/edgar/data/885639/000119312526115982/kss-20260131.htm). https://cfonews.ai/filings/kohls-corp-10-k-2026-03-19

- 2026-03-12 Verano says AI impersonation of executives and vendors is used for wire fraud. Verano Holdings says it has seen a global rise in cyber-enabled fraud in which bad actors use AI to impersonate executives or vendors to authorize fraudulent wire transfers. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-12. Quoted: "We have seen a global rise in cyber-enabled fraud, where bad actors use AI to impersonate executives or vendors to authorize fraudulent wire transfers." (Verano Holdings Corp. (VRNO), Form 10-K, Item 1A, Risk Factors, accession 0001628280-26-017011, https://www.sec.gov/Archives/edgar/data/1848416/000162828026017011/vrnof-20251231.htm). https://cfonews.ai/filings/verano-holdings-corp-10-k-2026-03-12

- 2026-03-09 Global Business Travel says AI supports revenue assurance and contract reconciliation in its finance work. Global Business Travel Group says it is deploying AI technologies while maintaining governance and data security standards, and that in finance, AI supports revenue assurance and contract reconciliation. The passage appears under Item 1, Business, in the 10-K filed 2026-03-09. Quoted: "We are systematically deploying next-generation AI technologies while maintaining rigorous governance and data security standards. ... In finance, AI supports revenue assurance and contract reconciliation." (Global Business Travel Group, Inc. (GBTG), Form 10-K, Item 1, Business, accession 0001628280-26-015817, https://www.sec.gov/Archives/edgar/data/1820872/000162828026015817/gbtg-20251231.htm). https://cfonews.ai/filings/global-business-travel-group-inc-10-k-2026-03-09

- 2026-03-09 LendingTree says it may use more AI in financial reporting and internal controls. LendingTree says it may increasingly use automated tools, including AI and machine learning, in connection with data analysis, financial reporting processes and internal controls. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-09. Quoted: "In the future, we may increasingly use automated tools, including AI and machine learning technologies, in connection with data analysis, financial reporting processes, and internal controls." (LendingTree, Inc. (TREE), Form 10-K, Item 1A, Risk Factors, accession 0001628280-26-016084, https://www.sec.gov/Archives/edgar/data/1434621/000162828026016084/tree-20251231.htm). https://cfonews.ai/filings/lendingtree-inc-10-k-2026-03-09

- 2026-03-06 Independent Bank says AI tools and deepfakes are driving more fraud attempts. Independent Bank Corporation says the financial services industry is experiencing a rapid increase in the frequency and sophistication of fraudulent attacks, which it attributes in part to AI-powered tools and deepfake technology. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-06. Quoted: "The financial services industry is also experiencing a rapid increase in the frequency and sophistication of fraudulent attacks, driven by the proliferation of AI-powered tools, deepfake technology, and organized, transnational crime rings." (INDEPENDENT BANK CORP /MI/ (IBCP), Form 10-K, Item 1A, Risk Factors, accession 0000039311-26-000009, https://www.sec.gov/Archives/edgar/data/39311/000003931126000009/ibcp-20251231_d2.htm). https://cfonews.ai/filings/independent-bank-corp-10-k-2026-03-06

- 2026-03-06 Workday says AI agents for finance processes including the close are due in fiscal 2027. Workday says it announced AI agents, expected to be available in fiscal 2027, built to assist with human capital management and finance processes such as workforce planning and the financial close. The passage appears under Item 1, Business, in the 10-K filed 2026-03-06. Quoted: "In fiscal 2026, we also announced new Workday AI agents that are expected to be available in fiscal 2027, purpose-built to assist with complex human capital management (“HCM”) and finance processes, such as performance reviews, workforce planning, and financial close." (Workday, Inc. (WDAY), Form 10-K, Item 1, Business, accession 0001327811-26-000014, https://www.sec.gov/Archives/edgar/data/1327811/000132781126000014/wday-20260131.htm). https://cfonews.ai/filings/workday-inc-10-k-2026-03-06

- 2026-03-05 Amalgamated Financial says Fed examiners prioritize material financial risks stemming from AI. Amalgamated Financial says that under the Federal Reserve's November 2025 Supervisory Operating Principles, examiners prioritize the assessment of material financial risks stemming from AI, focusing on models used for capital, liquidity and credit decisions. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-05. Quoted: "Under the Federal Reserve’s November 2025 Supervisory Operating Principles, examiners now prioritize the assessment of "material financial risks" stemming from AI, focusing on the transparency and explainability of models used for capital, liquidity, and credit decisions." (Amalgamated Financial Corp. (AMAL), Form 10-K, Item 1A, Risk Factors, accession 0001823608-26-000048, https://www.sec.gov/Archives/edgar/data/1823608/000182360826000048/amal-20251231.htm). https://cfonews.ai/filings/amalgamated-financial-corp-10-k-2026-03-05

- 2026-03-04 TriplePoint Venture Growth names deepfakes of executives used to authorize wire transfers. TriplePoint Venture Growth BDC says threat actors are using AI tools for attacks that include AI-generated impersonations of senior executives to authorize fraudulent wire transfers. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-04. Quoted: "Threat actors are increasingly using AI tools to conduct more sophisticated and harder-to-detect attacks, including AI-generated impersonations of senior executives to authorize fraudulent wire transfers (“deepfake” fraud) ..." (TriplePoint Venture Growth BDC Corp. (TPVG), Form 10-K, Item 1A, Risk Factors, accession 0001580345-26-000008, https://www.sec.gov/Archives/edgar/data/1580345/000158034526000008/tpvg-20251231.htm). https://cfonews.ai/filings/triplepoint-venture-growth-bdc-corp-10-k-2026-03-04

- 2026-03-02 Eastern Bankshares says agentic AI makes synthetic-identity fraud easier. Eastern Bankshares says agentic AI has exacerbated risks by letting bad actors more easily facilitate fraud through synthetic identities and deepfake images and documentation. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-02. Quoted: "... “Agentic AI” has further exacerbated risks by allowing bad actors to more easily use sophisticated and iterative methods of facilitating fraud through the creation of synthetic identities and “deepfake” images and documentation." (Eastern Bankshares, Inc. (EBC), Form 10-K, Item 1A, Risk Factors, accession 0001628280-26-013126, https://www.sec.gov/Archives/edgar/data/1810546/000162828026013126/ebc-20251231.htm). https://cfonews.ai/filings/eastern-bankshares-inc-10-k-2026-03-02

- 2026-03-02 Santander Holdings USA lists deepfake-enabled fraud among AI-assisted threats. Santander Holdings USA says advances in AI, including generative AI, may be used by threat actors to facilitate attacks including convincing phishing campaigns and deepfake-enabled fraud. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-03-02. Quoted: "Advances in AI, including generative AI, may also be used by threat actors to facilitate cyber attacks, including the creation of highly convincing phishing and social-engineering campaigns, automated malware development, deepfake-enabled fraud ..." (Santander Holdings USA, Inc., Form 10-K, Item 1A, Risk Factors, accession 0000811830-26-000005, https://www.sec.gov/Archives/edgar/data/811830/000081183026000005/sov-20251231.htm). https://cfonews.ai/filings/santander-holdings-usa-inc-10-k-2026-03-02

- 2026-02-27 Celestica's audit committee mandate covers AI risk as it relates to financial reporting. Celestica says its Audit Committee's mandate requires it to discuss risk management including risks related to AI, and the systems to manage such risks as they relate to financial reporting integrity and disclosure controls. The passage appears under Item 1C, Cybersecurity, in the 10-K filed 2026-02-27. Quoted: "The Audit Committee’s Mandate also requires it to discuss ... risks related to AI ... and the establishment and management of appropriate systems to manage such risks as they relate to financial reporting integrity and disclosure controls." (CELESTICA INC (CLS), Form 10-K, Item 1C, Cybersecurity, accession 0001030894-26-000011, https://www.sec.gov/Archives/edgar/data/1030894/000103089426000011/cls-20251231.htm). https://cfonews.ai/filings/celestica-inc-10-k-2026-02-27

- 2026-02-27 Seacoast Banking says AI tools and deepfakes may make fraud harder to detect. Seacoast Banking Corporation of Florida says advances in AI-driven tools, deepfakes and synthetic identities may make fraud harder to detect and help criminals produce more convincing impersonations or documentation. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-02-27. Quoted: "Continued advances in AI‑driven tools, deepfakes, synthetic identities, and automated credential‑stuffing attacks may make fraud harder to detect and enable criminals to generate more convincing impersonations or documentation." (SEACOAST BANKING CORP OF FLORIDA (SBCF), Form 10-K, Item 1A, Risk Factors, accession 0001628280-26-012787, https://www.sec.gov/Archives/edgar/data/730708/000162828026012787/sbcf-20251231.htm). https://cfonews.ai/filings/seacoast-banking-corp-of-florida-10-k-2026-02-27

- 2026-02-26 BlackLine reports acquiring WiseLayer, a developer of AI agents for finance and accounting work. BlackLine says it acquired WiseLayer on December 15, 2025, and describes WiseLayer as having developed AI-powered agents to automate complex, judgment-based finance and accounting processes. The passage appears under Item 1, Business, in the 10-K filed 2026-02-26. Quoted: "On December 15, 2025, we acquired WiseLayer, ... a New York-based company that has pioneered a digital workforce of AI-powered agents to automate complex, judgment-based finance and accounting processes." (BLACKLINE, INC. (BL), Form 10-K, Item 1, Business, accession 0001628280-26-011915, https://www.sec.gov/Archives/edgar/data/1666134/000162828026011915/bl-20251231.htm). https://cfonews.ai/filings/blackline-inc-10-k-2026-02-26

- 2026-02-26 Expensify says it uses AI internally to process receipts, bills and invoices. Expensify says it uses AI technologies to optimize its internal processes, including analyzing and processing receipts, bills and invoices. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-02-26. Quoted: "For example we use AI Technologies to optimize our internal processes, including, but not limited to, analyzing and processing receipts, bills, and invoices, responding to customer support requests, and drafting personalized marketing communications." (Expensify, Inc. (EXFY), Form 10-K, Item 1A, Risk Factors, accession 0001476840-26-000009, https://www.sec.gov/Archives/edgar/data/1476840/000147684026000009/exfy-20251231.htm). https://cfonews.ai/filings/expensify-inc-10-k-2026-02-26

- 2026-02-26 Lightbridge says it does not rely exclusively on AI output for financial reporting. Lightbridge says it does not rely exclusively on AI-generated content or recommendations for any material regulatory submissions, safety decisions or financial reporting. The passage appears under Item 1, Business, in the 10-K filed 2026-02-26. Quoted: "The Company does not rely exclusively on AI-generated content or recommendations for any material regulatory submissions, safety decisions, or financial reporting." (LIGHTBRIDGE Corp (LTBR), Form 10-K, Item 1, Business, accession 0001477932-26-001076, https://www.sec.gov/Archives/edgar/data/1084554/000147793226001076/ltbr_10k.htm). https://cfonews.ai/filings/lightbridge-corp-10-k-2026-02-26

- 2026-02-26 OneStream describes finance chiefs' interest in AI for forecasting and budgeting. OneStream's annual report says CFOs recognize the potential of AI for financial and business processes such as demand forecasting, workforce planning and budgeting. The passage appears in the 10-K filed 2026-02-26. Quoted: "CFOs recognize the potential of AI to deliver advanced insights, productivity and accuracy to specific financial and business processes, such as demand forecasting, workforce planning and budgeting ..." (OneStream, Inc. (OS), Form 10-K, accession 0001193125-26-076771, https://www.sec.gov/Archives/edgar/data/1889956/000119312526076771/ck0001889956-20251231.htm). https://cfonews.ai/filings/onestream-inc-10-k-2026-02-26

- 2026-02-26 UMB Financial names AI controls alongside financial reporting controls. UMB Financial says it must develop and maintain controls covering areas including financial reporting, disclosure and artificial intelligence, adapted to its reliance on outside platforms and providers. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-02-26. Quoted: "The Company must successfully develop and maintain information, financial reporting, disclosure, privacy, data protection, data security, artificial intelligence, and other controls adapted to the Company’s reliance on outside platforms and providers." (UMB FINANCIAL CORP (UMBF, UMBFO), Form 10-K, Item 1A, Risk Factors, accession 0001193125-26-076496, https://www.sec.gov/Archives/edgar/data/101382/000119312526076496/umbf-20251231.htm). https://cfonews.ai/filings/umb-financial-corp-10-k-2026-02-26

- 2026-02-24 ExlService describes AI-led finance and accounting services, from FP&A to GAAP accounting. ExlService says it provides data and AI-led finance and accounting services, including financial planning and analysis, GAAP and STAT accounting, regulatory and statutory reporting and core finance operations. The passage appears under Item 1, Business, in the 10-K filed 2026-02-24. Quoted: "In addition, we provide a suite of data and AI-led finance and accounting services that include financial planning and analysis, decision support, GAAP and STAT accounting, regulatory and statutory reporting, and compliance services in addition to core finance operations." (ExlService Holdings, Inc. (EXLS), Form 10-K, Item 1, Business, accession 0001297989-26-000008, https://www.sec.gov/Archives/edgar/data/1297989/000129798926000008/exls-20251231.htm). https://cfonews.ai/filings/exlservice-holdings-inc-10-k-2026-02-24

- 2026-02-24 Vertex describes an AI tax compliance product for smaller businesses. Vertex says Kintsugi powered by Vertex automates key tax compliance functions for small and medium-sized businesses in what it calls an AI experience. The passage appears under Item 1, Business, in the 10-K filed 2026-02-24. Quoted: "Kintsugi powered by Vertex is a solution which automates key tax compliance functions for small- and medium-sized businesses in an AI experience built for agility and scale ..." (Vertex, Inc. (VERX), Form 10-K, Item 1, Business, accession 0001104659-26-019165, https://www.sec.gov/Archives/edgar/data/1806837/000110465926019165/verx-20251231x10k.htm). https://cfonews.ai/filings/vertex-inc-10-k-2026-02-24

- 2026-02-19 Workiva expects financial reporting processes to drive the need for integrated generative AI. Workiva says it expects the evolution in financial reporting processes to continue and to drive the need for expanded financial reporting capabilities, including integrated generative AI. The passage appears under Item 1, Business, in the 10-K filed 2026-02-19. Quoted: "We believe this evolution in financial reporting processes will continue, which we expect will drive the need for expanded financial reporting solution capabilities including ... integrated Generative AI (“GenAI”)." (WORKIVA INC (WK), Form 10-K, Item 1, Business, accession 0001445305-26-000016, https://www.sec.gov/Archives/edgar/data/1445305/000144530526000016/wk-20251231.htm). https://cfonews.ai/filings/workiva-inc-10-k-2026-02-19

- 2026-02-18 ARMOUR Residential REIT lists financial reporting among business processes that use AI. ARMOUR Residential REIT says it, its manager or third-party service providers use AI in certain business processes, including data analysis, investment modeling, risk management, financial reporting and cybersecurity. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-02-18. Quoted: "We, our manager, or third-party service providers use, and may continue to use, artificial intelligence (“AI”) in certain business processes, including but not limited to data analysis, investment modeling, risk management, financial reporting, and cybersecurity." (Armour Residential REIT, Inc. (ARR, ARR-PC), Form 10-K, Item 1A, Risk Factors, accession 0001428205-26-000029, https://www.sec.gov/Archives/edgar/data/1428205/000142820526000029/arr-20251231.htm). https://cfonews.ai/filings/armour-residential-reit-inc-10-k-2026-02-18

- 2026-02-18 Clearwater Analytics says its AI agents speed close cycles by 50%. A statement quoted in a Clearwater Analytics 8-K exhibit says the company has nearly 1,000 AI agents available for deployment, reducing manual reconciliation by 90% and speeding close cycles by 50%. The passage is from the company's Form 8-K filed 2026-02-18. Quoted: "We now have nearly 1,000 AI agents available for deployment across more than $10 trillion in client assets, reducing manual reconciliation by 90%, accelerating regulatory reporting by 80%, and speeding close cycles by 50%" (Clearwater Analytics Holdings, Inc. (CWAN), Form 8-K, accession 0001866368-26-000009, https://www.sec.gov/Archives/edgar/data/1866368/000186636826000009/cwan-20251231xexx991.htm). https://cfonews.ai/filings/clearwater-analytics-holdings-inc-8-k-2026-02-18

- 2026-02-12 PHINIA says staff training covers business email compromise and AI. PHINIA says it requires personnel, including new hires, to complete training on cybersecurity threats including phishing, business email compromise and new disruptors such as artificial intelligence. The passage appears under Item 1C, Cybersecurity, in the 10-K filed 2026-02-12. Quoted: "The Company requires personnel, including new hires, to complete training regarding cybersecurity threats (including phishing, business email compromise and other schemes or attacks that use social engineering, and new disruptors, such as artificial intelligence) ..." (PHINIA INC. (PHIN), Form 10-K, Item 1C, Cybersecurity, accession 0001968915-26-000023, https://www.sec.gov/Archives/edgar/data/1968915/000196891526000023/phin-20251231.htm). https://cfonews.ai/filings/phinia-inc-10-k-2026-02-12

- 2026-02-10 Medpace names insufficient human oversight of AI and missing AI controls among its risks. Medpace lists among its risks insufficient human oversight of AI and a lack of controls and procedures monitoring the use of AI in day-to-day operations. The passage appears under Item 1A, Risk Factors, in the 10-K filed 2026-02-10. Quoted: "Continued evolution and use of machine learning and generative artificial intelligence ("AI"), including risks arising from insufficient human oversight of AI or a lack of controls and procedures monitoring the use of AI in day-to-day operations ..." (Medpace Holdings, Inc. (MEDP), Form 10-K, Item 1A, Risk Factors, accession 0001668397-26-000006, https://www.sec.gov/Archives/edgar/data/1668397/000166839726000006/medp-20251231.htm). https://cfonews.ai/filings/medpace-holdings-inc-10-k-2026-02-10

- 2026-02-06 BILL describes AI agents for W-9 collection, reconciliation and invoice coding. BILL Holdings says it announced AI agents to enable automatic W-9 collection, transaction reconciliation and invoice coding, and that it plans to launch additional agents. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2026-02-06. Quoted: "We recently announced the launch of AI agents to enable automatic W-9 collection, transaction reconciliation and invoice coding, and we plan to launch additional agents in the near-term." (BILL Holdings, Inc. (BILL), Form 10-Q, Item 1A, Risk Factors, accession 0001628280-26-005879, https://www.sec.gov/Archives/edgar/data/1786352/000162828026005879/bill-20251231.htm). https://cfonews.ai/filings/bill-holdings-inc-10-q-2026-02-06

- 2026-01-20 U.S. Bancorp lists an AI-driven cash forecasting tool introduced with Kyriba. A presentation filed with a U.S. Bancorp 8-K lists the introduction of an AI-driven cash forecasting tool with Kyriba to give businesses visibility and control over their cash and liquidity positions. The passage is from the company's Form 8-K filed 2026-01-20. Quoted: "Introduced AI-driven cash forecasting tool with Kyriba to help businesses gain real-time visibility and control over their cash and liquidity positions" (US BANCORP \DE\ (USB, USB-PA, USB-PH, USB-PP, USB-PQ, USB-PR, USB-PS), Form 8-K, accession 0000036104-26-000005, https://www.sec.gov/Archives/edgar/data/36104/000003610426000005/a4q25earningscallpresent.htm). https://cfonews.ai/filings/us-bancorp-de-8-k-2026-01-20

- 2025-12-19 ABM says its board oversees disclosure controls for AI-related risks. ABM Industries says its board oversees its cybersecurity and AI programs, including its disclosure controls and procedures for material cybersecurity or AI-related risks and incidents. The passage appears under Item 1C, Cybersecurity, in the 10-K filed 2025-12-19. Quoted: "Our Board of Directors oversees the Company’s risk management and strategy related to its cybersecurity and artificial intelligence (“AI”) programs ... including ... (iv) the Company’s disclosure controls and procedures with respect to material cybersecurity or AI-related risks and incidents." (ABM INDUSTRIES INC /DE/ (ABM), Form 10-K, Item 1C, Cybersecurity, accession 0000771497-25-000031, https://www.sec.gov/Archives/edgar/data/771497/000077149725000031/abm-20251031.htm). https://cfonews.ai/filings/abm-industries-inc-10-k-2025-12-19

- 2025-11-07 BILL says it uses AI to prepopulate invoices and to evaluate creditworthiness. BILL Holdings says it leverages AI to prepopulate invoices based on the historical behavior of businesses using its solutions and to aid its evaluation of businesses' creditworthiness. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2025-11-07. Quoted: "We leverage AI to prepopulate invoices based on the historical behavior of businesses using our solutions and to aid our evaluation of businesses' creditworthiness to offer them and their counterparties expedited means of payment, among other things." (BILL Holdings, Inc. (BILL), Form 10-Q, Item 1A, Risk Factors, accession 0001628280-25-050328, https://www.sec.gov/Archives/edgar/data/1786352/000162828025050328/bill-20250930.htm). https://cfonews.ai/filings/bill-holdings-inc-10-q-2025-11-07

- 2025-11-07 BlackLine reports launching Verity, a suite of AI capabilities for finance and accounting teams. BlackLine says it launched Verity in September 2025, describing it as a suite of AI capabilities providing finance and accounting teams with a digital workforce of embedded, auditable AI. The passage appears under Item 2, Management's Discussion and Analysis, in the 10-Q filed 2025-11-07. Quoted: "In September 2025, we launched Verity, a comprehensive suite of AI capabilities providing finance and accounting teams with a digital workforce of embedded, auditable AI." (BLACKLINE, INC. (BL), Form 10-Q, Item 2, MD&A, accession 0001628280-25-050628, https://www.sec.gov/Archives/edgar/data/1666134/000162828025050628/bl-20250930.htm). https://cfonews.ai/filings/blackline-inc-10-q-2025-11-07

- 2025-11-04 Upstart lists AI models beside its controls as areas under strain. Upstart says fluctuations in the momentum of its business will strain its ability to develop and improve areas including its AI models and technology, disclosure controls and internal control over financial reporting. The passage appears under Item 1A, Risk Factors, in the 10-Q filed 2025-11-04. Quoted: "Continued fluctuations in the momentum of our business will strain our ability to develop and improve our operational policies and procedures, AI models and technology, disclosure controls and procedures, internal control over financial reporting ..." (Upstart Holdings, Inc. (UPST), Form 10-Q, Item 1A, Risk Factors, accession 0001647639-25-000134, https://www.sec.gov/Archives/edgar/data/1647639/000164763925000134/upst-20250930.htm). https://cfonews.ai/filings/upstart-holdings-inc-10-q-2025-11-04