Cybersecurity Policy Report, Defining ‘artificial intelligence’ key to recommending framework on disclosure, panelists tell IAC, (Mar 6, 2025)

By Mark S. Nelson, J.D.

Panelists also were concerned about the “different” risks associated with AI and the potential for AI uses cases to diminish companies’ institutional knowledge.

Panelists told members of the SEC’s Investor Advisory Committee that it will be critical for any committee recommendation to the Commission on artificial intelligence (AI) to precisely define what is meant by “AI.” Among the several themes that arose during today’s IAC meeting were whether AI is sufficiently different from other technologies to justify AI-specific disclosures, whether regulators should create a framework for companies to make public disclosure about AI or instead provide companies a framework to mull AI issues internally, and whether any framework for public disclosures should be tailored to address specific industry sectors. However, the panelists agreed that companies’ public disclosures about AI thus far have been inconsistent.

Setting the table. Alvin Velazquez, Associate Professor of Law at Indiana University’s Maurer School of Law and Vice-Chair of the Disclosure Subcommittee of the Investor Advisory Committee, set a lofty goal for the panel, which is to develop a recommendation on AI. He explained that AI disclosures by public companies to date have been uneven, but any recommendation likely would need to account for specific industries and include an all-important definition of AI.

According to Matthew T. Bodie, Robins Kaplan Professor of Law at University of Minnesota Law School, the material risks associated with AI include effectiveness, fraud (AI washing), cybersecurity, legal risks, workforce risks, and a combination of systemic overreliance and end-user overconfidence. He added that systemic risks include the concentration of AI in a “small pool” of developers and more generalized risks arising from technological volatility. Here he likened the risk from AI to the risks posed by the Long Term Capital Management rescue, the Great Recession, the Flash Crash, and the recent DeepSeek announcement in which a China-based company claimed to have bested U.S. AI companies by building a product that ran more efficient code on less powerful chips.

Panelist Hamish Macalaster, CEO and Founder of Transparently AI, spoke of the AI adoption rate at large companies, which he said was “quite low” because of “fear and uncertainty.” He noted media stories about companies that have blanket bans on the use of AI.

Rekha Vaitla, Investment Officer for Sustainable Investment and Stewardship Strategies at CalSTRS, said her employer seeks to engage with some of its portfolio companies on AI issues. She explained that CalSTRS tends to focus on “buckets” of companies, especially technology companies, where the concerns are about bias, safety, and hallucinations by generative artificial intelligence (GenAI) chatbots. She explained that CalSTRS also seeks to query its portfolio companies that are suppliers of AI infrastructure (e.g., chip producers and mining companies), as well as end users of AI.

According to Deep Ratna Srivastav, Chief AI Officer at Franklin Templeton, there is a sense that AI is omnipresent but does not necessarily manifest at companies as expected. That sense was also picked up in a slide presented by Bodie that suggested that slightly less than half of companies surveyed on the speed of companies’ adoption of AI said they were moving too slowly.

SEC Acting Chair Mark T. Uyeda briefly mentioned AI when he delivered opening remarks for the afternoon session of the IAC from the SEC’s New York Regional Office. Uyeda observed that the speed of development of AI was remarkable and that the promise of AI comes with risks.

At the start of the AI segment of the meeting, SEC Commissioner Hester M. Peirce commented that despite the change of administration and the new policy direction of the SEC, there remains a shared desire for vibrant capital markets and informed investors. However, Peirce also said that disclosures should be principles-based rather than topic-specific disclosure requirements, which for AI like other topics could raise costs for companies with nothing material to say on the topic, may put the SEC in the position of micromanaging companies, may distract mangers of companies from more important tasks, and could drown out information that is more material.

SEC Commissioner Caroline A. Crenshaw, like Uyeda and Peirce, sees a similar landscape of AI advancing at break-neck speed but with both opportunities and risks. Crenshaw departs from Peirce in that she hopes for an agreement in which everyone supports evergreen rules on AI disclosure. To achieve this goal, Crenshaw said regulators need information on whether changes are needed to the existing disclosure regime, whether they should send a message to companies about AI washing, what the ancillary risks are, and how to craft a common definition of “AI.”

Why AI is different. The main reason for considering whether the SEC should impose a disclosure regime for AI or, alternatively, provide guidance to companies about AI disclosures, centers on the extent to which AI is different from other technologies, such as cloud computing, quantum computing, or even just routine computing for creating documents or sending emails.

Vaitla said that from the perspective of an institutional investor there has been a lot of investment in AI so investors want to see the return on investment, such as cost savings and workforce transformation training. Although she said AI is not necessarily so different from other technologies, the spending on AI is significant.

Paul Washington, President and CEO of the Society of Corporate Governance, said that AI’s autonomy makes it different from other technologies. He cited AI’s unpredictability and potential for drift. By way of background, “drift” refers to the incrementally poorer performance of an AI model over time related to multiple factors.

According to Srivastav, AI is different because of the fact that the designer of the AI system may not always be in control of the output. He cited the example of an end user who asks an AI chatbot to provide a bullish and a bearish response to a query; the AI chatbot will provide both responses uncritically.

What does an AI framework look like? There was disagreement among some of the panelists about whether the SEC should create a rules-based framework, issue guidance, or do nothing more such that companies would continue to think about AI internally only and disclose, as necessary, under existing disclosure rules. However, two panelists, Bodie and Washington, suggested the outlines of a framework that, in some respects, overlap.

According to Bodie, the key questions are whether the SEC should have “uniform categories” regarding AI disclosures and how long they might remain relevant. He also asked whether AI disclosures would help investors and to what extent companies should have to address workforce issues associated with the use of AI.

As a result, Bodie places emphasis on a framework that would: (1) define what is meant by AI; (2) detail the business use of AI, which includes the impact of AI on the business itself and on the company’s employees; (3) address the risks associated with AI; and (4) address the management of AI risks at the board, c-suite, and employee levels.

For Washington, the current variation in AI disclosures is “understandable” because not all companies within a sector experience AI in the same way. That is why, he said, communications companies tend to provide more detailed AI disclosures than energy companies. Washington said he would prefer a regime in which disclosures are material to individual companies rather than an artificial standardized AI disclosure regime.

Despite such reservations from a regulatory standpoint, Washington did suggest a framework that he said is less focused on materiality analysis in order to emphasize how AI impacts company strategy. In reply to a follow-up question from an IAC member, Washington clarified that he was less interested in disclosure and more interested in companies thinking about AI internally.

As a result, Washington would have companies think about: (1) the marketplace (by this he meant a company’s business model); (2) the products and services offered by the company and its sales, supply chain, and distribution chain; (3) operational concerns such as the workplace and the workforce; (4) the public space (i.e., the regulatory environment); and (5) governance, which would include the controls that accompany board- and management-level oversight of AI.

Bodie also suggested the SEC’s cybersecurity disclosure regime as a potential roadmap for AI disclosures. Item 106 of Regulation S-K requires public companies to make disclosures about their cybersecurity risks, including about their processes and relationships with third-party providers, any risks that materially affected or are reasonably likely to materially affect the company, and the company's governance of cybersecurity risks (i.e., board and management oversight).

Several panelists noted that AI will likely have a significant impact on employees. Here too, some panelists suggested a model for workforce-related AI disclosures that could be part of a larger AI disclosure regime and which might track the SEC’s human capital disclosure requirement. Item 101 of Regulation S-K, to the extent material to an understanding of a company’s business, requires a description of a company’s human capital resources (e.g., the number of employees and the measures or objectives used by the company to develop, attract, and retain employees).

Institutional knowledge drain? The panelists also tended to agree that the use of AI over time could result in the loss of institutional knowledge at companies. This is not a new phenomenon since many technologies result in the loss of knowledge about how they operate over time as they are replaced by newer technologies, such that only a few persons who once operated the older technologies are able to use them today. That technology could be the old main frame computers that once occupied entire rooms or the know-how to fly spacecraft to the moon, something that had to be re-invented recently for a lunar return mission decades after Eugene A. Cernan became the last person to walk on the moon in 1972.

Bodie characterized the loss of institutional knowledge as a “really big risk.” Likewise, Vaitla said this was a “pretty significant risk.”

According to Srivastav, we “really don’t know the arc of where AI goes.” He suggested that many observers initially thought AI would close knowledge gaps but that later research suggested AI may widen those gaps.

Washington was more circumspect, noting that AI is a significant risk but that it might also enhance institutional knowledge. Nevertheless, he added that AI lacks “EQ” or an emotional quotient.

Companies: Transparently AI; Franklin Templeton; CalSTRS

MainStory: TopStory AINews CorporateGovernance CyberPrivacyFeed FederalLegislation ExchangesMarketRegulation FedTracker Securities FinancialIntermediaries InvestorEducation PublicCompanyReportingDisclosure RiskManagement SecuritiesOfferings DataPrivacy DataSecurity