On October 30, 2026, David Woodcock, Director of the Division of Enforcement at the Securities and Exchange Commission (the “SEC”), confirmed in separate interviews with Reuters and Law360 that the agency is scrutinizing companies’ disclosures about artificial intelligence (“AI”). His comments reinforce the need for companies to assess both what they say about their AI capabilities and what they may be omitting about material AI use and risks.

Scrutiny of Both Overstatements and Omissions. In the Law360 interview, Woodcock said that the SEC’s Division of Enforcement will scrutinize statements by publicly traded companies that may exaggerate their AI capabilities or fail to disclose AI use or risks in a fundamental part of their business. In doing so, he referenced private company cases involving overstated AI and robotics capabilities and said he expects further investigations of public companies that follow the template of these prior matters.

Woodcock told Reuters that the SEC does not want to impede technological innovation but that investors need accurate disclosures about AI use and potential risks. He warned that enforcement risks arise when those disclosures may be insufficient.

Woodcock’s comments underscore that public companies must align claims about AI with actual use, capabilities, and risks.

Key Takeaways for AI Disclosures. As discussed in our earlier posts on continued AI-washing enforcement under the Trump administration, AI-related securities fraud class actions, and agent washing, companies should consider the following:

• Review Public and Investor-Facing Statements. Involve legal, compliance, and technical personnel in the review of SEC filings, earnings-call scripts, investor presentations, websites, and marketing materials. Private companies should apply similar scrutiny to fundraising communications. Reviews should test for inaccurate claims and material omissions, including statements that conceal or downplay a company’s use of AI or the associated financial and strategic resources, a practice sometimes called “AI hushing.”

• Define AI and Agentic Capabilities Precisely. Use consistent AI terminology internally and externally, reflecting what AI systems actually do. Distinguish conventional automation from agentic functionality, and avoid portraying pilots as scaled deployments or human-supervised workflows as fully autonomous. Descriptions of safeguards should match the controls actually in place.

• Substantiate—and Revisit—Claims About Results. Document the basis for claims about AI functionality, reliability, revenue, productivity, or staffing impacts through testing, deployment records, and other reasonable evidence. Distinguish existing capabilities and demonstrated benefits from future plans, and reassess claims as systems, adoption, and performance change.

• Use Risk Assessments to Inform Disclosures. For higher-risk AI uses, consider conducting impact assessments to identify foreseeable risks and mitigation measures. Use those findings to evaluate whether disclosures adequately address material AI uses and risks, including hallucinations, confidentiality, cybersecurity, and reliance on human review. These practices can also help mitigate securities class action risk.

This publication is for general information purposes only. It is not intended to provide, nor is it to be used as, a substitute for legal advice. In some jurisdictions it may be considered attorney advertising.