AI Failures Make Headlines, But Most Corporate AI Incidents Never Appear in SEC Filings

Researchers traced 307 recorded AI incidents involving 21 U.S.-listed companies and found that only seven received either a specific description or disclosure of a directly related legal consequence in the filings examined.

An AI system can cause harm, attract news coverage and enter a public incident database without the event being identifiable in the company reports investors read. A warning about unreliable technology or privacy risks might appear in those documents, giving readers little sense of what actually happened.

Researchers Samir Chincholikar and Robin Chawla examined that gap in their study, "The AI incident disclosure shadow: tracking AI incidents into U.S. securities filings," published in Frontiers in Artificial Intelligence. They traced 307 recorded AI incidents involving 21 U.S.-listed companies and found that only seven received either a specific description or disclosure of a directly related legal consequence in the filings examined.

The finding raises a practical question about corporate transparency: how much can readers learn about a company's experience with AI failures from reports that describe the risks mainly in general terms?

Following AI incidents into company reports

The researchers started with 1,389 incidents dated between 2019 and 2026 in the AI Incident Database, a public collection built largely from media reporting. Matching named organizations and their corporate parents to eligible U.S.-listed companies narrowed the sample to 307 incidents.

Their search covered annual reports, quarterly reports and current-event reports, known as Forms 10-K, 10-Q and 8-K, within a standard 12-month period following each incident. Searches included names of products and systems, the technology involved and the reported harm, with relevant passages reviewed in context.

Each incident received one of four classifications, based on the strongest disclosure found: a specific account of the event, disclosure of a directly related legal consequence, general language about the same technology or type of harm, or no related disclosure.

This approach separated a company acknowledging that something could go wrong from a company identifying something that had already happened. A filing did not need to use the words "artificial intelligence" to count as an incident disclosure if its details clearly identified the event.

General warnings leave much of the story untold

Under the study's original classification, four incidents received specific disclosure, representing 1.3% of the sample. Three more appeared through related legal consequences, bringing the broader disclosure total to seven incidents, or 2.3%.

The remaining 300 incidents formed what the researchers call the "AI incident disclosure shadow," covering 97.7% of the sample. That term describes events the researchers could not identify through either specific disclosure or a directly related legal consequence in the selected filings.

For 278 incidents, filings discussed the same technology or harm category without identifying the event; another 22 had no related disclosure located. A closer reading showed that only 84 of those 278 cases had general language matching both the technology involved and the kind of harm reported. Across the full sample, 70.4% of incidents had, at best, weakly related language.

A broad warning about AI errors offers limited help to someone trying to understand a particular failure, its consequences and the company's response. The researchers did not check whether that language existed before the incident, so its presence cannot be treated as evidence that the company changed its reporting because of the event.

Financial costs and legal cases were the clearest routes into filings

The seven disclosed incidents clustered around financial effects, lawsuits, investigations and regulatory matters, with disclosures appearing at just four of the 21 companies. Zillow's algorithm-driven homebuying business was associated with a reported inventory write-down of roughly $304 million. General Motors reported a $478 million Cruise restructuring adjustment associated with the suspension and restructuring of its autonomous-vehicle operations. Other disclosed matters involved legal or regulatory proceedings at General Motors, Meta and Tesla.

Two large incident categories produced no specific-event or related legal-consequence disclosures: 70 misinformation or content-related incidents and 57 generative-AI error incidents. These patterns suggest that AI failures become more visible in filings when they connect with established financial and legal reporting processes. The study cannot establish that those consequences caused disclosure.

Disclosure appeared for two of 42 incidents classified as severe, one of 50 moderate incidents and four of 215 limited incidents. Seven disclosed cases provide too little evidence to conclude that severity does not matter. None of the 58 incidents attributed to developer-only companies received either type of disclosure; all seven involved companies that deployed the technology or both developed and deployed it.

That pattern changed enough under alternative analyses and individual-case adjustments that the authors treated it as a lead for further research. They also found no clear increase in disclosure across the incident years studied.

A large gap with important limits

Across checks involving different reporting windows, company concentrations and attribution choices, the disclosure shadow ranged from 92.5% to 99.0%. Removing the five companies contributing the most incidents still left 92.5% outside specific-event or related legal-consequence disclosure.

An independent review of complete filings for 40 selected incidents found no missed disclosures of those kinds, supporting the search method without proving that every relevant passage had been captured. A second reviewer disagreed with all three original legal-consequence-only classifications. Reassessment moved one General Motors case into the specific-event category, producing five specific disclosures and two legal-consequence disclosures. The combined total stayed at seven, which the authors treated as an upper estimate because of the disputed category.

A database built largely from public reporting cannot capture every internal failure or overlooked incident, and the results should not be generalized to all corporate AI problems. Several large technology companies contributed much of the sample, and matching an incident to a particular company sometimes required judgment.

Earnings calls, investor presentations, company websites and press releases outside the selected filings were not searched. An event missing from these reports could still have been communicated elsewhere.

The research does not establish concealment, a duty to disclose any particular event or a legal violation. Its contribution is a measurable gap between publicly recorded AI incidents and their visibility in specified company filings.

Future studies could examine other communication channels, market reactions and whether reporting systems such as those introduced under the EU AI Act change this pattern. For readers assessing corporate AI transparency, the paper offers a useful distinction: a company's discussion of possible risks reveals only part of its experience with actual failures.