The SEC’s enforcement chief says the agency is watching how companies describe their artificial intelligence, just as investors start asking whether AI spending can pay for itself. There is no new AI rule. Existing antifraud and disclosure law is enough, and “AI-washing” is the likeliest target. The practical response is an evidence file: for every AI claim a company makes, a record of what the system does, how it was tested and what could go wrong.
On October 30, 2026, SEC Enforcement Director David Woodcock told Reuters that the agency is monitoring corporate disclosures by AI companies. The timing matters. Big Tech stocks had recently sold off after companies disclosed heavy cash spending on AI infrastructure, and investors were openly debating whether a bubble, helped along by “circular deals” between suppliers and customers, was inflating valuations. Woodcock’s message was measured but unmistakable: the SEC does not want to stand in the way of innovation, but “enforcement will be present” where disclosure falls short.
This article goes beyond the headline. It explains what the SEC can and cannot do with existing law, where the real exposure sits in a typical company’s paper trail, and how to build a disclosure audit that a general counsel, a chief compliance officer and an audit committee chair can all defend. For the short news summary, see our companion note, SEC Enforcement Director Flags AI Corporate Disclosures: Notes for Law.
Why this story is trending now
Search data tells part of the story. A review of Google’s US daily trending searches on October 31 found consumer topics such as weather alerts, lottery numbers and sports at the top, with no securities-law term in the list. That is typical for regulatory news: it spreads through professional channels, not mass search. The professional channels, however, lit up. Reuters broke the interview, and within hours it was syndicated or summarized by Channel NewsAsia, StreetInsider, BigGo Finance and others. Law-firm commentary on the same theme (Dentons on securities disclosure in the age of AI and cyber risk, Baker Donelson on year-end filing expectations, White & Case on individual liability for AI-related security disclosure failures, and a Harvard Law School Forum study of AI risk disclosures in the S&P 500) has been accumulating for two years. The October 30 comments are the first time in that sequence that the person who runs enforcement has tied the topic to market anxiety about AI valuations.
The angle that is gaining ground, then, is not “AI is regulated”. It is “AI claims are now a liability surface”. Three pressures meet at once: record capital expenditure on data centers, investor doubt about returns, and a regulator that has just said it is reading the filings.
What the SEC is actually signalling
Two separate signals arrived within about a week, and it helps to keep them apart.
- The enforcement interview (October 30). Woodcock, who became Enforcement Director in May 2026, said the agency is looking at AI companies’ disclosures and wants accurate information about material risks. He also noted that AI makes scams cheaper to produce at scale, which raises retail-investor risk and puts pressure on brokers to have processes that protect customers.
- The examination priorities (October 23). The Division of Examinations’ fiscal 2027 priorities include the use of AI and related technology in market operations, compliance, fraud prevention and investor protection. Examiners will test whether representations are fair and accurate, whether operations and controls match what investors were told, and whether algorithms give advice consistent with a client’s profile. The priorities also cover readiness for AI-enabled cyber threats such as AI-written phishing and deepfake voice or video used for social engineering.
None of these creates a new AI-specific rule. The SEC is applying technology-neutral standards: the antifraud provisions, the requirement that filings not omit material facts needed to make statements not misleading, disclosure controls, and for advisers the fiduciary duty and marketing rules.
The “AI-washing” playbook the SEC already has
“AI-washing” means overstating or misrepresenting what AI does in a product or process. The SEC has pursued it before. In 2024 it settled charges against two investment advisers, reported at the time as Delphia and Global Predictions, over claims about their use of AI that the agency said were false or misleading. In early 2025 it brought a case involving Presto Automation, a restaurant-technology company that described its voice ordering product in ways the agency said overstated how much it relied on its own AI rather than human or third-party help. (Readers should verify case details and penalties in the SEC’s releases before relying on them; we summarize from memory of the public record.) The pattern is consistent: a gap between the marketing description and the technical reality.
What is different in late 2026 is the target set. Earlier cases involved small advisers and small issuers. A regulator now speaking about AI companies in the same breath as a market-wide valuation debate may test larger issuers, and may look at kinds of statements that were considered routine: “AI-powered”, “proprietary models”, “efficiency gains of X percent”, “demand exceeds supply”, “multi-year contracted backlog”.
Where the exposure usually sits
In our experience reading public filings, the risk is rarely in the risk-factor boilerplate. It tends to cluster in five places.
- Capability claims. Statements that a product “uses AI”, “learns”, or “automates” a process. Is the model in production, in pilot, or planned? Is a human performing the task behind the interface?
- Performance and productivity numbers. Percentages of time saved, revenue lift, or error reduction. If the number came from a vendor case study or a single pilot, the statement needs that context.
- Demand and backlog language. Remaining performance obligations, committed contracts, and “circular” arrangements where a supplier invests in a customer that then buys the supplier’s product. These raise revenue-quality and related-party questions that auditors and the SEC already understand.
- Capital spending and financing. Large data-center commitments, leases not yet commenced, purchase obligations and the funding plan. MD&A is expected to discuss known trends and uncertainties; heavy cash burn with elevated interest rates is exactly that.
- Controls and safety claims. Statements about human oversight, model testing, security and data handling. For registered firms, add Form ADV Part 2, Form CRS and client communications.
A five-step disclosure audit
The following sequence is designed to be completed in two to four weeks by a small working group of legal, finance, engineering and communications staff.
Step 1: Build the claim inventory
Collect every external AI statement made in the last 24 months: Forms 10-K, 10-Q and 8-K, earnings scripts and Q&A, investor decks, website pages, press releases, conference remarks and recruiting material. Record the date, the speaker, the exact wording and the audience. A spreadsheet is enough. The point is to see the whole narrative in one place for the first time.
Step 2: Classify each claim
Tag each statement as a present fact (the system does X today), a forward-looking statement (we expect X), a comparative or superlative (best, first, only), or a quantified outcome (X percent). Present facts and quantified outcomes need the strongest support. Forward-looking statements need meaningful cautionary language, and the safe-harbor does not protect statements known to be false.
Step 3: Build the evidence file
For each present-fact or quantified claim, ask an engineer or product owner to write down the basis: the system name, deployment status, test results, sample size, date, and known limitations. Keep it short and dated. If no one can supply the basis, that is the finding. The claim should be revised, qualified or retired.
Step 4: Reconcile with financial statements and MD&A
Have finance compare AI-related revenue, backlog, capital commitments and costs against the narrative. Check that the language in the earnings release matches the 10-K, that non-GAAP measures related to AI are reconciled, and that the funding plan for large commitments is described honestly. For circular or related-party arrangements, confirm the accounting treatment with the auditors and consider whether the filing explains the relationship clearly enough for a skeptical reader.
Step 5: Fix the process, not just the text
Add AI statements to the disclosure committee’s agenda. Require an engineering sign-off for new capability claims. Train investor relations and marketing on what they may and may not say. Update the cybersecurity and incident-response plan for AI-enabled threats, since the examination priorities explicitly mention deepfake and AI-generated social engineering. Brief the audit committee and, where relevant, the board’s risk committee, and minute the briefing.
Special considerations for registered firms
Investment advisers and broker-dealers face a second layer. The examination priorities say examiners will check whether the firm’s description of its AI matches how it works, whether supervision and compliance policies cover the tool, and whether algorithmic output suits the client. Practical points:
- Compare Form ADV Part 2 and marketing material against the actual model inputs, data sources and human review steps.
- Keep records of testing, changes to the model and exceptions. If a vendor’s model is used, understand what the vendor will and will not disclose, and document the diligence performed.
- Make sure policies address conflicts of interest where the tool favors proprietary products.
- Prepare for document requests that ask for “all documents concerning” the AI capability. A tidy evidence file turns a stressful production into a routine one.
What about individual liability?
White & Case, among others, has warned that individuals can face exposure for AI-related security and disclosure failures, and the SEC has historically charged executives who signed certifications or made the misleading statements. Practical consequence: the people who sign Sarbanes-Oxley certifications and who speak on earnings calls should see the evidence file for AI claims, not merely trust that someone else has checked. A short management representation process, similar to a sub-certification, costs little and creates a record of diligence.
How the market backdrop changes the analysis
Disclosure law asks whether a reasonable investor would find a fact important. When sentiment is buoyant, a vague claim about AI strategy rarely draws attention. When investors worry about cash burn and the durability of demand, the same sentence may be read for its implied promise about returns. Reuters described the review as linked to “investor worries about a potential AI bubble”. Counsel should therefore reread risk factors with fresh eyes: concentration in a few customers or suppliers, dependency on scarce chips or power, the pace of depreciation on AI hardware, financing terms, and the possibility that productivity gains arrive more slowly than modeled. A risk factor that describes a risk as hypothetical when it has already begun to materialize is a classic source of enforcement and class-action claims.
Frequently asked questions
Is there a new SEC rule on AI disclosure?
No. The SEC is applying existing rules on fraud, materiality, disclosure controls and adviser duties.
Are forward-looking AI statements safe?
Only when they are accompanied by meaningful, specific cautionary language and are not known to be false when made.
What is the single most useful step?
Building the claim inventory and evidence file. It is cheap, it exposes gaps early, and it is the first thing counsel will want if a regulator calls.
Bottom line
The SEC has not changed the law. It has changed the odds that someone will read your AI statements against your actual systems and your financial results, at a moment when investors are already skeptical. Companies that can show what they claimed, why they believed it and who approved it will be in a far stronger position than those who cannot. Start with the inventory this month, take the findings to the disclosure committee before the next filing, and treat every new AI sentence as a statement you may one day need to prove.
Sources: Reuters (October 30, 2026), StreetInsider, Channel NewsAsia, BigGo Finance, SEC Division of Examinations fiscal 2027 priorities, Dentons, Baker Donelson, White & Case, Harvard Law School Forum on Corporate Governance. This article is general information, not legal advice.
Discover more from Kurums | Business Intelligence
Subscribe to get the latest posts sent to your email.