What companies say about AI in 10-K risk factors: an EDGAR read

Every public company that files a 10-K has to describe the material risks to its business in Item 1A, and since 2023 a growing share of those descriptions mention artificial intelligence. That is measurable, because EDGAR's full-text search indexes every filing since 2001 and returns a document count for any exact phrase. This article runs four phrases against 10-K filings for each year since 2019, ships the counts and a 40-filing sample with accession numbers, quotes one filing to show what the counts are counting, and spends its last section on what a count of this kind cannot tell you.

The query

EDGAR's full-text search API takes a quoted phrase, a form filter, and a date range, and returns hits.total.value, the number of matching documents. The script queries four phrases for each calendar year of filing dates from 2019 through 2026 (year-to-date on the retrieval day), 32 requests in all, spaced a quarter second apart, well under the 10-per-second limit the SEC states on its access page.

def query(phrase: str, start: str, end: str):
    return get(BASE + urllib.parse.quote(f'"{phrase}"') + f"&forms=10-K&dateRange=custom&startdt={start}&enddt={end}")

for p in PHRASES:
    for y in YEARS:
        end = today.isoformat() if y == today.year else f"{y}-12-31"
        rows.append({"phrase": p, "year": y, "documents": int(query(p, f"{y}-01-01", end)["hits"]["total"]["value"])})

The counts

Output of python code/ai-in-10-k-risk-factors-edgar-full-text.py, retrieved 2026-09-06:

Documents matching "artificial intelligence" went from 445 in 2019 to 3,324 in 2025, 7.5 times. "Generative artificial intelligence" did not appear in a single 10-K document in the index before 2023, had 20 that year, and 541 in 2025; by 2025 it appeared in 16.3 percent of the documents that matched the broader phrase. "Large language model" remains rare in the formal filing vocabulary: 44 documents in 2025 against 1,645 for "machine learning". The 2026 row already exceeds every full year for all four phrases with almost four months of filings still to come, most of them from companies with fiscal years ending in the autumn.

Two things about the unit. A "document" is a file in a filing, and a 10-K is several files (the main document plus exhibits), so a company whose phrase appears in the main document and again in an exhibit counts twice. And the filing-year cut is by the date filed, so a fiscal 2025 10-K filed in February 2026 lands in 2026. The table measures the vocabulary of filings by the year they were filed, no more.

A sample of filings

With --fetch the script also saves the 40 newest 10-K hits for "generative artificial intelligence" since 2025-01-01 to a second CSV, ai-in-10-k-risk-factors-edgar-full-text-filings.csv, with entity, CIK, accession number, and archive URL. The sample has 33 distinct filers (seven companies appear with both their 2025 and 2026 10-K, which itself says the language persists once adopted), 38 10-Ks and two 10-K/As, and 17 filings dated in 2026. The newest twelve:

The spread of industries is the point of the sample. A medical device maker, a wind-tower manufacturer, an apparel group, a discount retailer, two business development companies, and a biotech all used the phrase "generative artificial intelligence" in a 10-K in the first half of 2026. The search API ranks by relevance, not by size, so the sample is not the largest filers; it is a cross-section of who uses the words.

What one filing says

Target Corporation's 10-K for the fiscal year ended 2026-01-31 (accession 0000027419-26-000016, filed 2026-03-11) is the retailer in the sample, and a separate brief on this site quotes it sentence by sentence. Two sentences from Item 1A show the two registers the phrase is used in. The first is the risk of using it: "If our use of generative or agentic artificial intelligence becomes controversial or is ineffective, or if the outputs generated are inaccurate or controversial, our reputation and competitive position could be adversely affected." The second is the risk of others using it: it may be difficult to address negative publicity "including as a result of fictitious media content (such as content produced by generative artificial intelligence or bad actors)." Elsewhere the same filing lists AI among cyber threats ("the use of enhanced and rapidly advancing technologies and capabilities (including artificial intelligence) by threat actors"), among third-party dependencies ("certain generative artificial intelligence services"), and among workforce pressures.

That is what the count of 604 documents in 2026 is made of: not a single claim about AI but a set of disclosures that the technology is a competitive factor, an operational input, a reputational exposure, a security threat, a supplier dependency, and a labour-market force, usually all in the same Item 1A.

What the counts cannot say

They cannot say whether a disclosure is substantive or boilerplate. Risk-factor language propagates between filers through counsel and peer review, and a phrase that appears in 3,790 documents is by now partly a template. Full-text search matches words, not meaning.

They cannot say how many companies. Documents are not filings and filings are not filers. The 40-filing sample has 33 filers; scaling that ratio to the full count would be a guess and is not done here.

They cannot say anything about sentiment or exposure. A company that uses AI heavily and one that fears it write similar sentences, because Item 1A is where risks go, not where strategy goes. Studies that try to score 10-K text (one on this site's reading list, arXiv:2607.14174, compares full-filing and Item 1A sentiment on 1,383 filings from 94 technology firms) work at the level of the whole document for that reason.

And they cannot be reproduced exactly next week. The index grows daily, filings are amended, and the 2026 row is year-to-date. The counts CSV carries the retrieval date and the script carries the queries, so the table can be rerun and the difference read as new filings, which is the only honest way to use a count like this.