S&P 500 Companies Talk About AI. Few Disclose How It's Controlled

Disclosure is becoming a 2026 problem.

The AI governance conversation has been happening for years. The documentation hasn’t caught up to it, and 2026 is the year that stops being a private problem. Events are unfolding now that will demand greater transparency and documented processes, wherever a company operates.

The Australian government is responding to the first reported AI agent breach of a government system with an investigation. The EU AI Act’s obligations are phasing in. In the U.S., California’s frontier AI transparency law takes effect this year, and more state and jurisdictional rules follow through 2027. ​

In my decades of global forensics and incident response work for enterprise organizations, I’ve watched this same story play out after an incident more times than I can count: a company that talked fluently about a particular risk internally and had limited controls on paper the moment someone officially asked for it.

That pattern is repeating with AI, and it’s what sent my team to look into the current S&P 500 annual reports, reviewing each one against the SEC’s Item 1C cybersecurity disclosure requirement, to see whether the gap between AI talk and AI governance was as wide in the official record as it is in the room.​

It is, and it’s not close. Ninety-seven percent of S&P 500 companies mention AI somewhere in their annual filing. Only 3%, 15 to 16 companies out of 503, document an actual governed process for managing AI’s cybersecurity risk: a named policy, standard, or committee tied to a specific control, not a line about AI in a general risk list.

Everything in between those two numbers is where the exposure sits. These are global companies, deploying AI in every market they serve, and the same adoption-before-documentation habit shows up wherever AI budgets are growing.​

Financial services, healthcare, utilities, energy and real estate carry the heaviest compliance load in the index, and the assumption going in was that weight would translate into better documentation. It barely does, and the shortfall holds across the board, not just in banking.​

Data risk and physical risk aren’t governed the same way.​

Utilities, energy and real estate answer to regulators built around physical infrastructure, the grid, pipelines and building systems. Those sectors tend to write about AI cyber risk with real specificity, naming systems and naming controls.

Financial services and healthcare answer to regulators built around data, and there the specificity thins out considerably, even though AI shows up in their filings just as often.​

Physical-infrastructure security has run on naming-and-ownership rules for decades: grid reliability standards, pipeline safety codes, building inspection regimes. When AI touched those systems, it slotted into a discipline that already existed.​

Banks and hospitals inherited a newer, more fragmented data-security regime, one built to reward a good growth story more than it forces anyone to name AI as a risk with an owner. A bank or hospital system can be loud about its innovation, including its AI ambitions, and quiet about how they’re contained. Meanwhile, it can still believe it’s meeting every obligation on the books, right up until a regulator asks for the process behind the language.

The same conversation is coming outside the U.S., where data-protection authorities and the EU AI Act’s oversight bodies will ask their own versions of the question.​

The filing is the only witness that shows up.​

Plenty of regulated companies run real AI reviews internally that never made it into a 10-K. However, the filing is part of what gets read after something goes wrong. Right now, that record shows AI everywhere but almost no evidence anyone was managing it.

That mismatch is exactly what the arriving wave of transparency requirements, the EU AI Act’s obligations, new state rules and the reviews now underway after Australia’s government breach will force into the open.​

A few strategies can help separate the companies that will hold up under scrutiny from the ones that won’t:

1. Name an owner. This can be a specific role or committee with AI cyber risk written into its job, the same way a CISO owns network security. Think beyond a working group called “the AI committee” in a strategy deck.

2. Get someone outside the building to check the work. Self-attestation is how most AI security gaps stay invisible until an incident forces a look.

3. Build the record while the system runs, not after it fails. Continuous monitoring and logging of AI activity, code generation, data access and model decisions turn “what was our AI doing” from a forensic reconstruction into a report that already exists.​

4. Extend the controls to every system AI touches. Legacy systems are usually where AI gets bolted on with the least oversight, precisely because nobody thinks of them as “the AI project” that’s receiving the most scrutiny.​

Two things decide most outcomes once an investigation starts. One is who reviewed the AI-generated code and controlled the data going into AI tools before anything shipped or leaked. The other is whether anyone outside the team that built the controls tested them.

A control that exists only in a slide deck or on an earnings call is indistinguishable from no control at all once there’s an official request for the paper trail. To hold up in an investigation, build the controls before they are needed.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?