It’s hardly a secret that the usage of AI tools invites risk. But to what extent are companies making their AI-related risks known to the public? As it turns out, not much until recently, but now quite a lot, according to a new study.
Almost three-fourths (72%) of S&P 500 companies that filed their 2025 annual reports by Aug. 15 disclosed at least one material AI-related risk, according to the research, conducted by The Conference Board and data-mining firm Esgauge.
The study, which analyzed the companies’ 10-K filings over the last three years, through Aug. 15, 2025, revealed that just two years ago, only 12% of S&P 500 companies disclosed such a risk, before the proportion shot to 58% last year.
The rapid shift underscores “how quickly AI has shifted from experimental pilots to business-critical applications,” The Conference Board wrote in its research report. “It also signals that boards and executives expect heightened scrutiny from investors, regulators and other stakeholders.”
The financial and information technology sectors unsurprisingly have the greatest exposure to AI risk, but all industries are at least somewhat vulnerable and becoming more so, as reflected in their risk disclosures.
The potential risks are abundant and diverse, but many fall into a few broad categories, including reputational risks (reported by 38% of the S&P 500 companies this year) and cyber risks (20%).
A particularly fast-growing category of risk is in the regulatory/legal arena, with about one in eight of the companies disclosing such a risk this year. Most cited the evolving nature of regulation and the surrounding uncertainty, while a second area of concern was around compliance and enforcement.
Another emerging risk area relates to intellectual property, mentioned in annual reports this year by just under 5% of the S&P 500 companies. Particularly prevalent in the technology and consumer sectors, the report said, it spans copyright disputes, trade-secret theft, and contested use of third-party data for model training.
The list of AI-driven technologies that pose risks is also expansive, encompassing generative AI, machine learning/algorithmic decisioning, computer vision and sensors, robots and AI-driven supply chain and infrastructure technologies.
What actions do companies take that expose them to AI risks? The most prevalent types, as ascertained from the 10-K filings, lead to reputational risks. Most prominent among these are risks associated with the adoption and implementation of new technologies, followed by those stemming from consumer-facing AI tools.
“AI has shifted in just the last two years from a niche technology issue to a core enterprise risk across the S&P 500,” The Conference Board concluded.
