Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
How Many Large Companies Are Warning Their Investors About the Risks of AI?
Of the 87 largest US companies that describe using AI in their annual reports, at least 55 also warn investors about it. 55% of all US public companies list AI as a risk, against at least 62 of the top 100. Only 13 of the top 100 name AI agents, and only 3 of the largest banks and insurers.
At least 62 of the 100 largest US public companies warn their investors about the risks of AI in the risk factors of their latest annual report, by RedactSure's read of every one of those filings with the Securities and Exchange Commission. AI is everywhere at the top: 87 of the 100 describe using it in their business, and at least 55 of those 87 warn investors about it in the same filing. Across all US public companies, 55% list AI as a risk. The warnings have not caught up with agents, though. Only 13 of the 100 name AI agents as a risk. Annual reports that mention AI agents at all went from 6 in 2024 to 352 in 2026.
Key findings
- Of the 87 largest US companies that describe using AI in their annual reports, at least 55 also warn investors about it (U.S. Securities and Exchange Commission, 2026).
- 55% of all US public companies list AI as a risk in their 2026 annual reports, against at least 62 of the 100 largest. Only 2.8% of all public companies name AI agents as a risk, against 13 of the 100 largest (U.S. Securities and Exchange Commission, 2026).
- 87 of the 100 largest companies describe using AI in their business, but only 13 name AI agents or agentic AI as a risk (U.S. Securities and Exchange Commission, 2026).
- At least 24 of the 46 largest US banks and at least 24 of the 42 largest insurers warn investors about AI. Only 2 banks and 1 insurer name AI agents, and none describes using them (U.S. Securities and Exchange Commission, 2026).
- Annual reports that mention AI agents or agentic AI rose from 2 in 2023 and 6 in 2024 to 96 in 2025 and 352 in 2026, through October 27 (U.S. Securities and Exchange Commission, 2026).
How do the largest companies, banks and insurers compare?
| Group | Annual reports read | Describe using AI | List AI as a risk | Use or build AI agents | Name AI agents as a risk |
|---|---|---|---|---|---|
| 100 largest US public companies | 100 | 87 | at least 62 | 11 | 13 |
| Largest US banks | 46 | at least 27 | at least 24 | 0 | 2 |
| Largest US insurers | 42 | at least 26 | at least 24 | 0 | 1 |
"At least" marks counts where some filings could not be settled: 9 of the 100 on AI risk, 7 banks and 1 insurer on AI risk, and 6 banks and 1 insurer on AI use. Those filings are counted as not listing the item, so each figure is a floor.
How do the largest companies compare with all public companies?
| Group | Annual reports read | List AI as a risk | Name AI agents as a risk |
|---|---|---|---|
| All US public companies (random sample) | 320 | 177 (55.3%) | 9 (2.8%) |
| Large accelerated filers in the sample | 113 | 83 (73.5%) | 6 (5.3%) |
| 100 largest US public companies | 100 | at least 62 | 13 |
The larger the company, the more likely it is to warn investors about AI, and the gap is widest on agents. The sample figures carry a margin: the 95% range is 49.8% to 60.7% for all public companies and 64.6% to 80.7% for large accelerated filers, the companies with at least $700 million in public float. All three groups were coded the same way, from the risk factors section.
Which companies name AI agents as a risk?
| Company | Group | What the risk factors say |
|---|---|---|
| Microsoft | 100 largest companies | Agentic computing named among the changes its cloud and AI business must keep up with |
| Meta Platforms | 100 largest companies | Prompt injection, errors and other issues related to AI agents named as novel risks |
| Walmart | 100 largest companies | Customers shopping through emerging agentic platforms named in its competition risks |
| American Express | 100 largest companies | Agentic commerce named among the areas where it must compete |
| Salesforce | 100 largest companies | Threat actors exploiting generative and agentic AI named among security risks |
| Booking Holdings | 100 largest companies | AI agents that become full-service booking platforms named as a competitive risk |
| Lam Research | 100 largest companies | Prompt injection and issues related to AI agents named; autonomous agents raise the risk |
| Progressive | 100 largest companies and 50 largest insurers | Its development and use of generative and agentic AI named as a risk |
| Shopify | 100 largest companies | Turning agentic commerce into solutions merchants adopt named as a risk |
| Intuit | 100 largest companies | Use of AI, including agentic AI, named as a risk to its business and reputation |
| Accenture | 100 largest companies | Keeping pace with advanced AI, including agentic AI, named as a risk |
| Palo Alto Networks | 100 largest companies | AI agents emerging as a new class of identity named as a risk |
| Arista Networks | 100 largest companies | The uncertain long-term path of generative and agentic AI named as a risk |
| State Street | 50 largest banks | Incorporating AI and agentic AI named among technologies that introduce risk |
| Atlantic Union Bankshares | 50 largest banks | Rapid developments in AI, including agentic AI, named with third-party model risks |
The risks they describe fall into three groups: security (prompt injection, agents as a new kind of identity, attackers using agentic AI), competition (agents that shop, book or buy on a customer's behalf), and the company's own use of agentic AI. Each name links to the annual report it comes from.
The 11 of the 100 largest that describe using or building AI agents are NVIDIA, Alphabet, Cisco, American Express, Salesforce, Booking Holdings, Adobe, Shopify, Palo Alto Networks, CrowdStrike and Arista Networks. Most of them sell agents or the infrastructure agents run on.
How fast are annual reports picking up AI agents?
| Year filed | Annual reports that mention AI agents | Share of all annual reports filed that year |
|---|---|---|
| 2023 | 2 | 0.03% |
| 2024 | 6 | 0.09% |
| 2025 | 96 | 1.43% |
| 2026 (through October 27) | 352 | 5.49% |
These are mentions anywhere in the report, counted across all US annual reports filed with the SEC, and most are descriptions of a company's own products or market rather than risk disclosures. In a sample of 40 of these filings, 3 used the words in an unrelated sense, so the raw counts are slightly high. The direction is not in doubt: with filings counted only through October 27, the 2026 count is already more than three times the 2025 count.
How do insurers compare by line?
| Insurance line | Insurers read | Describe using AI | List AI as a risk | Name AI agents as a risk |
|---|---|---|---|---|
| Health | 5 | 4 | 4 | 0 |
| Life | 13 | 7 | 8 | 0 |
| Life and health | 4 | 2 | 2 | 0 |
| Property and casualty | 17 | 12 | 10 | 1 |
| Other | 3 | 1 | 0 | 0 |
Health insurers hold some of the most sensitive personal data in the economy. Four of the five largest describe using AI and four list it as a risk; none names AI agents.
What do the numbers mean for boards and risk leaders?
The largest companies have absorbed AI into their risk disclosures. Agents are a different risk: an agent reads the systems it works in and takes actions on its own, so the questions are what the agent can see, who approves what it does, and what record it leaves. Thirteen of the 100 largest companies, two of the largest banks and one of the largest insurers name that risk today.
For a bank or an insurer, the gap matters most. None of the largest describes using agents yet, so the controls can be set before the first agent works a customer account: keep real customer data out of what the agent reads, require a named person to approve each consequential action, and keep a record of every step.
Methodology and limitations
The 100 largest US public companies are ranked by public float, the market value of shares held by outside investors, as reported on each company's 10-K cover and published in the SEC's XBRL frames data. The largest banks and insurers are ranked by total assets from the same data, using bank and insurance industry codes; insurance brokers are not counted as insurers. RedactSure removed public floats tagged in the wrong unit, which would otherwise have put small companies at the top, when a float was more than 100 times total assets, or more than 20 times assets with an implied share price above $5,000. Six insurance subsidiaries whose parent is on the list were removed. Six companies had no 10-K filed in the window and were excluded: Brookfield Wealth Solutions, Comerica, HDFC Bank, Pinnacle Financial Partners, RiverSource Life Insurance and Synovus Financial. That leaves 100 companies, 46 banks and 42 insurers; Progressive is on both the company and insurer lists.
For each company, the most recent 10-K filed from October 27, 2025 to October 27, 2026 was read. "Lists AI as a risk" means the risk factors section (Item 1A) mentions artificial intelligence, machine learning or a related term in a discussion of risks. "Names AI agents as a risk" means Item 1A refers to AI agents or agentic AI. "Describes using AI" means the business section or management's discussion says the company itself uses, builds, sells or invests in AI; a mention of AI as a market trend does not count. Each filing was coded by reading the relevant passages, and every "no" for a company's own AI use was checked against the full business section and management's discussion. A company that names AI agents as a risk is counted as listing AI as a risk.
The comparison with all public companies comes from a random sample of 400 annual reports on Form 10-K filed in 2026, drawn from the SEC's quarterly form indexes with a fixed seed so it can be repeated. 80 had no usable risk factors section, mostly asset-backed trusts, funds and small companies that may omit one, leaving 320. Filer category comes from each report's cover page. Shares from the sample are estimates and carry a 95% Wilson interval; the unit is a filing, not a company.
The mention counts by year come from SEC EDGAR full-text search for "AI agent," "AI agents," "agentic AI" and "autonomous agents" across all 10-K filings, by calendar year of filing. Fiscal years differ from calendar years, and 2026 is partial. Mutual insurers and other companies that file no 10-K, and foreign companies that file form 20-F, are outside every list. The counts describe what companies wrote in their filings, not what they do. One reviewer coded each filing.
Which companies were reviewed?
100 largest US public companies: NVIDIA, Microsoft, Apple, Amazon, Alphabet, Meta Platforms, Broadcom, Berkshire Hathaway, Tesla, Eli Lilly, JPMorgan Chase, Visa, Netflix, Mastercard, ExxonMobil, Costco, Walmart, Home Depot, Micron Technology, Johnson & Johnson, Bank of America, Oracle, Procter & Gamble, AbbVie, Coca-Cola, Palantir Technologies, Cisco, Philip Morris International, UnitedHealth Group, IBM, General Electric, Wells Fargo, Chevron, Abbott Laboratories, American Express, Linde, Morgan Stanley, Goldman Sachs Group, McDonald's, AT&T, Merck, RTX, Intuitive Surgical, Salesforce, Texas Instruments, Uber Technologies, Booking Holdings, Verizon Communications, Caterpillar, PepsiCo, Lam Research, Walt Disney, ServiceNow, Qualcomm, S&P Global, KLA, BlackRock, Boston Scientific, Boeing, Charles Schwab, Citigroup, Progressive, Thermo Fisher Scientific, Amgen, Honeywell International, Adobe, Stryker, GE Vernova, NextEra Energy, Shopify, TJX Companies, Eaton, Pfizer, Union Pacific, Intuit, Capital One Financial, Comcast, Accenture, Lowe's, Danaher, Deere, Palo Alto Networks, MercadoLibre, Applied Materials, Medtronic, Chubb, Vertex Pharmaceuticals, T-Mobile US, ConocoPhillips, Starbucks, Parker-Hannifin, CrowdStrike, Blackstone, Marsh McLennan, Lockheed Martin, Amphenol, Arista Networks, Strategy, Intercontinental Exchange, Automatic Data Processing.
Largest US banks: JPMorgan Chase, Bank of America, Citigroup, Wells Fargo, U.S. Bancorp, Capital One Financial, PNC Financial Services, Truist Financial, Bank of New York Mellon, State Street, Fifth Third Bancorp, Huntington Bancshares, First Citizens BancShares, Citizens Financial Group, M&T Bank, Ally Financial, KeyCorp, HSBC USA, Northern Trust, Santander Holdings USA, Regions Financial, Pinnacle Financial Partners, Western Alliance Bancorporation, Zions Bancorporation, Flagstar Bank, Webster Financial, East West Bancorp, First Horizon, Popular, Wintrust Financial, Old National Bancorp, UMB Financial, SouthState Bank, Valley National Bancorp, Columbia Banking System, Cullen/Frost Bankers, BOK Financial, Associated Banc-Corp, F.N.B. Corp, Prosperity Bancshares, Atlantic Union Bankshares, Hancock Whitney, Commerce Bancshares, Banc of California, BankUnited, Fulton Financial.
Largest US insurers: Berkshire Hathaway, Prudential Financial, MetLife, Athene Holding, Lincoln National, Corebridge Financial, Jackson Financial, Principal Financial Group, UnitedHealth Group, Chubb, Brighthouse Financial, Voya Financial, Reinsurance Group of America, AIG, Cigna Group, Travelers, American National Group, Elevance Health, Progressive, Allstate, Aflac, Fidelity National Financial, F&G Annuities & Life, The Hartford, Genworth Financial, Loews, Arch Capital Group, Centene, Markel Group, CNA Financial, Unum Group, Everest Group, Humana, RenaissanceRe, W. R. Berkley, Cincinnati Financial, CNO Financial Group, AXIS Capital, Assurant, American Financial Group, Old Republic International, Globe Life.
Frequently asked questions
How many large companies are warning investors about the risks of AI?
At least 62 of the 100 largest US public companies list artificial intelligence among the risks in the risk factors section of their latest annual report, by RedactSure's read of each filing with the SEC, against 55% of all US public companies. Of the 87 largest that describe using AI, at least 55 warn investors about it. Only 13 name AI agents or agentic AI specifically. Among the largest banks, at least 24 of 46 list AI as a risk and 2 name AI agents.
Do banks use AI agents?
Not by their own annual reports. None of the 46 largest US banks reviewed describes using AI agents in its business, though at least 27 describe using AI. Two, State Street and Atlantic Union Bankshares, name agentic AI among their risks. The same is true of insurers: none of the 42 largest describes using AI agents, and one, Progressive, names them as a risk.
Why does it matter whether a company names AI agents as a risk?
An AI agent does more than answer questions. It reads the screens and records it works with and takes actions, such as sending, paying or changing a record. That raises risks a general AI disclosure may not cover: prompt injection, what customer data the agent sees, and who approves its actions. A risk factor that names agents shows the company has looked at those questions.
How RedactSure Governs AI Agents Before They Reach Customer Data
The largest companies already treat AI as a risk. Agents add a new one: software that reads customer records and acts on them.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: an agent working a customer account at a bank reads the account number and balance on the screen and moves money on its own. Inside the governed environment: render-layer tokenization shows the agent ACCT_001 instead of the account number, a named person approves the transfer under Supervised Delegation, and every screen the agent saw, every action and every approval lands in the AI Control Record for the risk team.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
If agents are coming to your customer accounts, the controls can be in place before the first one starts. Bring one workflow and see, with test values, what the agent reads and who approves each action. Book a demo