How often did reported AI incidents appear in SEC filings?
A preregistered study matched 307 externally recorded AI incidents to 21 U.S.-listed companies. Four received incident-specific disclosure and seven any substantive disclosure—but the sample is media-derived, concentrated and cannot establish legal noncompliance.
The short version
- What happened
- The researchers started with 1,389 AI Incident Database records from 2019–2026 and matched 307 incidents to 21 U.S.-listed domestic issuers.
- Who it affects
- Workers, customers and communities may experience an AI incident before investors can see it in a company's formal filings. Better event-specific reporting could improve accountability, but any reporting rule would still need a workable materiality threshold.
- What remains unproven
- The denominator is a media-derived incident database, not a census of all AI failures. Inclusion depends on external reporting and successful matching to a U.S.-listed issuer.
Keep in mind
The denominator is a media-derived incident database, not a census of all AI failures. Inclusion depends on external reporting and successful matching to a U.S.-listed issuer.
The 307 incidents involved 21 issuers and were concentrated among a few large technology and automotive companies, limiting generalisation across markets and sectors.
The study examined 8-K, 10-K and 10-Q filings for 12 months, not every investor communication. It did not determine legal materiality or noncompliance.
Only seven incidents received substantive disclosure, limiting exploratory comparisons by severity or issuer role. The authors report no funding and no conflicts of interest.
Source analysis · 1 linked source. Primary analysed source date: 21 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
Generic AI-risk language was common; incident-specific disclosure was rare
A peer-reviewed study found that public-company filings rarely identified AI incidents that had already appeared in an external incident database. Using a preregistered design, the authors matched 1,389 AI Incident Database records from 2019 to 2026 to U.S.-listed domestic filers. That produced 307 incidents involving 21 issuers. They then reviewed Forms 8-K, 10-K and 10-Q filed during the following 12 months.
Only four incidents received incident-specific disclosure: 1.3%, with a 95% confidence interval of 0.4% to 3.3%. Seven received either incident-specific disclosure or disclosure of a directly related legal consequence: 2.3% (0.9%–4.6%). Generic risk language accompanied 278 incidents, but only 84 matched both the incident's technology and harm. The authors call the remaining 97.7% a disclosure 'shadow'.[1]
The denominator is useful but narrower than the headline number may suggest
Validation included a blind second-coder audit of issuer matching, a full-filing audit independent of the keyword search and robustness checks for filing windows, issuer concentration and attribution. The estimated shadow remained between 92.5% and 99.0% across specifications. Substantive cases clustered around financial-statement effects or formal legal and regulatory consequences, but only seven cases qualified—too few for a strong severity analysis.
Investors should not read 97.7% as a noncompliance rate. The AI Incident Database depends on public reporting; the study includes only incidents that could be matched to 21 listed issuers, with Alphabet, Meta, Tesla and Microsoft accounting for much of the sample. It did not examine every investor communication, and legal materiality was outside its design. The practical finding is a visibility gap: filings often discuss AI risk in general terms without reconstructing the external incident record.[1]
The distinction that matters
How the 307 incidents were classified
The strongest disclosure found in the next 12 months determined each incident's tier.
Incident-specific
Filing identifies the event
4 incidents (1.3%)
Related consequence
Filing identifies a directly related legal effect
3 additional incidents; 7 substantive in total
Generic or none
Risk language is generic, weakly related or absent
300 incidents (97.7%)