Key considerations for updating 2025 annual report risk factors

With the 2026 annual reporting season upon us, public companies should consider potential updates to their risk factors for their Form 10-Ks and 20-Fs in light of recent economic, political, technological, and regulatory developments.¹

As further described below, public companies should review and update their risk factors by assessing the material risks that impact their businesses. Well-drafted risk factors play a crucial role in defending public companies against allegations of fraud under the U.S. federal securities laws, and companies should therefore take the time to update their risk factor disclosure and tailor risks to their own facts and circumstances. This alert features, (i) in Part I, a list of key developments that U.S. public companies should consider as they update risk factors, and (ii) in Part II, critical drafting considerations. Each company will, of course, need to assess its own material risks and tailor its risk factor disclosure to its particular circumstances. 

Part I: Key Developments to Consider when Updating 2025 Annual Report Risk Factor Disclosures

1. Artificial Intelligence

As the adoption and use of artificial intelligence (“AI”) technologies continues to expand rapidly, AI has become a mainstream enterprise risk for many public companies. Companies that develop, deploy and increasingly rely on AI should consider whether their risk factor disclosure appropriately addresses the material risks arising from those activities, either in a standalone risk factor or as part of other risk disclosures.

AI-related risk factors materially expanded from 2024 to 2025, and we expect an even greater increase in 2026 annual reports. AI has rapidly become a mainstream enterprise risk, with 72% of S&P 500 companies disclosing at least one material AI risk in 2025, up from just 12% in 2023.² To date, AI risk factor disclosures have generally focused on, among other items, risks arising from current and evolving AI regulations, AI-specific cybersecurity exposures, risks that AI systems may fail, under-perform, or disrupt business operations if they produce incorrect or unreliable outputs, and competitive pressures if other market participants deploy AI more effectively.

Companies should evaluate the AI-related risks most relevant to their businesses, which may include: 

• operational risks, such as system failures, or disruptions to business processes;
• privacy and data protection risks, including compliance with applicable privacy laws, notice and consent requirements, and restrictions on the use of personal or sensitive data;
• intellectual property risks, including potential misuse of proprietary or confidential inputs, infringement of third-party rights, and uncertainty regarding ownership of AI-generated outputs;
• legal and regulatory risks, including compliance costs, enforcement exposure, and liability arising from rapidly evolving, potentially unclear and increasingly divergent AI regulatory regimes across jurisdictions;
• capital expenditure and implementation risks, including the costs associated with acquiring, deploying, maintaining, and updating AI technologies;
• workforce-related risks, including potential impacts on staffing, retention, and employee relations (see “Human Capital and Workforce” below);
• competitive risks, including reduced competitiveness if AI investments fail to deliver expected benefits or if competitors deploy AI more effectively or at lower cost;
• reputational risks, including those arising from implementation failures, biased, or unsafe outputs, or misuse of AI, which could lead to customer attrition, investor scrutiny, regulatory attention, or litigation³; and
• content-related risks, including inaccuracies, misrepresentations, or harmful outputs from public-facing AI-generated content or potential bias or discrimination inherent in AI algorithms or training data.

The complexity and limited transparency of many AI models, combined with the pace of technological change, may make it difficult for companies to fully understand AI system behavior, identify risks, or anticipate unintended consequences. Companies should also assess whether AI-related cybersecurity exposures, including vulnerabilities in AI systems or reliance on third-party AI providers, present material risks to their operations.

In assessing AI-related risk factor disclosure, companies should review AI-related statements across their annual reports, websites, press releases, and other public communications to ensure consistency and accuracy. Appropriate disclosure is critical to address SEC concerns regarding so-called “AI-washing,” or overstating AI capabilities or benefits. Companies should ensure that AI risk disclosures are tailored to their actual use of AI technologies and that any claims regarding AI are supported by a reasonable basis.

2. Economic Uncertainty and Related Considerations 

Economic uncertainty remains elevated due to persistent interest-rate volatility, uneven global growth, ongoing geopolitical tensions, and rapid technological and policy changes. These factors continue to create uncertainty around capital allocation, labor markets, supply chains, and long-term demand across many sectors. Annual report risk factors should address the specific sources of economic uncertainty most likely to impact the company, including potentially the following:

• liquidity and refinancing risks, including the effects of sustained higher interest rates, tighter, or uneven credit conditions, refinancing risk as debt matures, and increased sensitivity of customers and counterparties to pricing and liquidity pressures, which may affect demand, margins, working capital, covenant compliance, or access to capital;
• structural and supply-chain uncertainties, including continued supply-chain realignment, sanctions, regional conflicts, and the economic effects of evolving industrial, trade, and technology policies (see “International Geopolitics” below). This may include risks related to reshoring or nearshoring efforts, increased input costs, or reliance on limited suppliers;
• tariff and trade-related risks arising from global trade tensions and unpredictable U.S. trade policy, including the potential for increased costs, retaliatory measures, supply disruptions, or reduced competitiveness (see “International Geopolitics” below);
• cost-containment measures, including workforce reductions or restructuring initiatives (see “Human Capital and Workforce” below), which may be undertaken in response to macroeconomic pressures, operational shifts, or AI-related efficiencies; and
• financial reporting and estimation risks, including increased reliance on management judgments in areas such as asset valuations, impairment analyses, and revenue forecasts, which may heighten sensitivity to changing economic conditions and contribute to volatility in future results if material.

3. Human Capital and Workforce

Companies face a variety of risks related to human capital and workforce management that may warrant disclosure in risk factors. Labor markets remain tight in certain regions and sectors, creating ongoing challenges related to talent acquisition, retention, wage pressure, union activity, succession planning, and evolving workforce models, including remote or hybrid work arrangements.

In response to economic uncertainty, technological change (including AI-driven efficiencies), and other business or industry-specific factors, companies may implement workforce changes, including targeted or broad-based reductions. Such actions may give rise to material risks, including:

• reduced employee morale, unanticipated attrition, and challenges in recruiting or retaining key personnel;
• loss of expertise or institutional knowledge, including potential competitive disadvantage;
• operational disruptions or inefficiencies during transition periods;
• reputational harm affecting employer brand and stakeholder perception;
• increased exposure to employee claims, litigation, or regulatory scrutiny; and
• adverse effects on corporate culture, engagement, and productivity.

Risk factor disclosures should be consistent with other human capital disclosures in the Form 10-K, avoid boilerplate language, and reflect company-specific circumstances, such as reliance on key personnel, unionized workforces, or operations in jurisdictions with heightened labor or regulatory risk.

4. International Geopolitics

Ongoing conflicts across the globe, such as in Russia-Ukraine, along with international tensions or the perception of potential conflicts such as between the US and other nations, political turmoil in Europe, and growing tensions relating to control of Arctic regions and U.S. foreign policy in Latin America, all may pose material risks to companies, particularly those with significant operations or investments in impacted regions. Recent developments that should be assessed also include the political and geopolitical situation in Venezuela, in Russia and the Ukraine, and in the Middle East, where the regime in Iran and its proxies continue to pose a threat to regional stability while facing growing unrest internally.

Companies should evaluate these risks and consider updating their risk factor disclosure to reflect the current landscape. It is imperative that companies tailor these risks to their current particular situation and operations, including considerations with respect to their employee base, investments, sanctions, legal or regulatory uncertainties, commodity prices, business relationships and assets.⁴

5. U.S. Political Developments

Recent changes in the U.S. presidential administration and related governmental actions have introduced increased legal, regulatory, reputational, and operational uncertainty for companies. Shifts in environmental regulation, immigration enforcement, and the priorities and scope of federal regulatory agencies may increase costs, disrupt supply chains, limit access to visas, and reduce predictability in regulatory oversight and enforcement. Rapidly evolving U.S. trade and tariff policies, together with retaliatory measures by U.S. trading partners, have created uncertainty and may limit companies’ ability to anticipate, plan for, or effectively mitigate the adverse impacts of such measures on their operations and supply chain costs.

Further, U.S. tax and fiscal legislation, including initiatives such as the recently-enacted “One Big Beautiful Bill,” have or may result in material changes to corporate tax rates, deductions, credits, and incentives. Companies should assess the potential impact of any enacted or proposed changes on their effective tax rate, cash flows, deferred tax assets and liabilities, and financial reporting, including the potential modification or elimination of energy-related or other tax credits. Uncertainty around the timing, scope, and final form of such legislation may also affect capital allocation decisions, investment strategies, and overall results of operations.

In addition, heightened fiscal and political uncertainty—including the risk of future government shutdowns and efforts to reduce federal spending and the federal workforce—may adversely affect companies that rely on government contracts, regulatory approvals, or federal funding. Increased scrutiny of federal contractors, including certification requirements, contract reviews, and potential enforcement actions, could result in compliance burdens, contract delays or terminations, pricing pressure, and reduced procurement activity, which may materially affect business operations and financial results. When discussing the risks of shutdowns, companies should consider whether the most recent government shutdown materially impacted them so as to avoid presenting these risks as being purely hypothetical.

6. Cybersecurity

Cybersecurity incidents, data misuse, and ransomware attacks continue to be top of mind for both companies and investors, particularly in light of evolving technologies such as AI.  Cybersecurity disclosures in 2025 added specificity when discussing cyber-related risks, including risks related to threat actors' use of AI/deepfakes, zero-day sophistication, supply-chain and third-party service provider related risks, logging gaps, and regulatory reporting exposure. In addition, several companies noted risks related to tighter regulatory reporting windows, limitations on insurance coverage for cybersecurity related losses, costly remediations, service disruptions, and reputational harm. Companies should also consider disclosures around the potential impact of a cybersecurity incident on customer and vendor relationships, goodwill, reputation and competitiveness.

The SEC has indicated it is shifting its attention on cybersecurity disclosures, focusing on deliberately fraudulent cybersecurity disclosures. This aligns with the SEC’s recent voluntary dismissal of its high-profile enforcement action against SolarWinds, which focused in large part on what the prior SEC deemed to represent risk factor disclosure failures.⁵ However, companies should continue to be mindful regarding hypothetical disclosures when they have already been warned of risks that have materialized. Risk factor disclosure should sufficiently alert investors about the types and nature of the specific cybersecurity risks faced, taking into account the company’s specific business model, and the potential consequences to the company stemming from a cyber incident. In addition to not characterizing already-experienced risks as hypothetical or generic, companies should be sure to evaluate and update existing disclosure to reflect changing circumstances and the company's changed risk profile as a result of any recent cybersecurity incidents.

Cyber disclosure must also be consistent across the annual report and accurately reflect a company’s cybersecurity risk profile, particularly in light of the cybersecurity disclosure companies make under Part I, Item 1C.⁶ Companies should also continue to consider the SEC’s 2018 cybersecurity disclosure guidance, which emphasizes disclosure of prior or ongoing incidents to provide context, identification of relevant risk factors such as cybersecurity costs and third-party risks, and consideration of business aspects that give rise to material cybersecurity risks and their potential consequences.⁷ Comment letters have highlighted disclosure inconsistencies, underscoring the need for alignment across all filings, as appropriate.⁸

7. Climate Change and Environmental Risks

Although the SEC has withdrawn its defense of its climate disclosure rules, companies should continue to evaluate climate- and environmental-related risks in light of the evolving regulatory, market, and investor landscape. While overall climate and sustainability disclosure has declined for many issuers, investor, customer, and regulatory scrutiny remains significant, and companies should ensure that risk factor disclosure accurately reflects material environmental risks.

Relevant risks may include: 

• physical impacts of climate change, including extreme weather, rising sea levels, and other environmental changes that can disrupt operations, supply chains, and infrastructure, and increase costs;
• evolving climate- and environmental-related laws and regulations, including emissions limits, permitting requirements, decarbonization mandates, carbon pricing, and disclosure obligations, which can result in compliance costs, fines, or enforcement actions;
• transition-related risks, including shifts in consumer demand, technology, capital allocation, and reputational expectations; and
• litigation and activism risks, including claims by regulators, shareholders, or other stakeholders.

Companies subject to California climate laws face ongoing disclosure uncertainty. While SB 261 is currently enjoined and the January 1, 2026 deadline for reporting is postponed, SB 253 requires certain companies to disclose greenhouse gas emissions starting in 2026, and AB 1305 continues to mandate public reporting of carbon offset methodology and verification, creating potential compliance, reputational, and reporting risks that may warrant disclosure.⁹

Disclosures should reflect company-specific circumstances and be consistent with other environmental or sustainability disclosures. Companies should avoid aspirational commitments in risk factors that are not supported by internal governance, while also avoiding generic statements that fail to provide decision-useful information.

8. Industry-Specific Risks

Certain industries face heightened or evolving risks due to current economic, regulatory, technological, and geopolitical conditions. Companies should assess whether industry-specific risks are material and warrant tailored risk factor disclosure based on their business and exposure. Examples include:

• Healthcare and Pharmaceutical Industry, where companies face heightened risk from government and payor actions aimed at reducing drug prices and healthcare spending, including expanded implementation of price negotiation and reimbursement constraints under federal programs. Increased scrutiny of pricing practices, combined with budgetary pressures on public payors, may reduce revenues, compress margins, and limit market access for key products, while also increasing compliance, litigation, and reputational risks;¹⁰
• Technology (including AI-driven businesses), where rapidly evolving and divergent global regulations governing AI, data privacy, cybersecurity, and cross-border data transfers may increase costs and constrain operations;
• Energy and Natural Resources, where geopolitical instability, sanctions regimes, and volatility in global oil, gas, and energy markets may disrupt supply, affect pricing and alter capital allocation and investment strategies (See “International Geopolitics” above); and
• Financial Services, where interest-rate volatility, credit quality deterioration, tighter or uneven credit conditions and regulatory expectations regarding capital, liquidity, consumer protection, and cybersecurity may adversely affect profitability, liquidity and asset quality.

Part II: Six Important Drafting Considerations when Updating Annual Memo Risk Factor Disclosures

1. Avoid Boilerplate Disclosures

The SEC has consistently stressed the importance of companies customizing their risk factor disclosures to reflect their unique facts and circumstances, steering clear of generic and boilerplate language. This is in line with Item 105 of Regulation S-K, which advises companies against presenting risks that are applicable to any issuer or offering. In particular, SEC Chair Atkins has expressed concern that companies risk factor disclosures have “become a repository for too much” and that risk averse firms “dump in the kitchen sink” which “is not serving investors well.”¹¹ Risk factor disclosure should inform investors as to what are the important, material risks that the company faces and companies should strive to discuss only relevant, material and decision-useful risks in their filings. 

2. Scrutinize Hypothetical Statements

It is important that hypothetical statements in risk factor disclosures (e.g., indicating that an event “could” or “may” occur rather than “has” or “did” occur) are closely reviewed. The SEC has in the past instituted enforcement actions against numerous companies for disclosing as hypothetical risks that have already transpired¹², although the current SEC has signaled that it may be less likely to do so.¹³ Beyond the potential threat of SEC enforcement, shareholders have pursued claims under Section 10(b) of the Securities Exchange Act of 1934, as amended, arguing that statements in a company’s risk factors were materially misleading because the company suggested that an event only “may” or “could” happen, when, in reality, it was no longer hypothetical at the time of disclosure.

3. A Note on Forward-Looking Statements

Well-drafted risk factors can protect a company from liability for forward-looking statements and serve as a form of free liability insurance to protect a company when disclosing both projections as they relate to financial information and non-financial information. In particular, companies should take into account financial models that support their projections and confirm that material risks related to these projections, including financial models, bases and assumptions that support them, are sufficiently disclosed. 

4. Review for Internal Consistency and Consistency Across Public Disclosures

When drafting or reviewing risk factors, companies should ensure consistency with other sections of their annual report, as risk factors do not exist in isolation and should make sense within the context of the entire disclosure document. This involves examining the Business and MD&A sections (for foreign private issuers, the equivalents of Items 4 and 5 of Form 20-F) and the financial statements to ensure that any significant factors, changes, and liabilities are appropriately addressed. Providing cross-references to other sections of the annual report can be effective (e.g., linking cybersecurity risk management disclosures to the cybersecurity risk factors); however, any material risks must also be disclosed within the risk factor section itself. Companies should also review all public disclosures on a given topic for consistency, as the SEC may review both filed and non-filed disclosures when assessing accuracy. 

5. Remember to Update or Delete Risk Factors That Have Changed in Importance or Are No Longer Relevant

When evaluating risk factor disclosures, it is essential not only to update for newly-realized risks but also to evaluate whether all of the enumerated risks remain material and relevant. Companies should remove, update, or revise risks that no longer present material concerns or where the potential impact has changed significantly. As a reminder, risk factors should be updated through the filing date of the annual report, rather than as of the end of the fiscal period covered by the report.

6. Reminders on the Risk Factor Presentation:

• Ordering of Risks. While it is not mandatory to order risks by their magnitude or potential impact, it is generally considered best practice to do so. Item 105 of Regulation S-K specifies that risks should be “organized logically,” and Item 3.B of Form 20-F encourages companies to list risk factors in order of their priority to the company. Companies should consider the order that makes the most sense for investors. Additionally, companies must group related risk factors under relevant headings and provide sub-captions for each risk factor. Although this is not a technical requirement for foreign private issuers, they commonly follow this practice in their Form 20-Fs. Moreover, risk factors should be specific to the company or its industry. Any risk factors that are generic and apply to any registrant or offering must be disclosed at the end of the risk factor section under the caption “General Risk Factors.” Again, while this is not a technical requirement for foreign private issuers, they often include this in their Form 20-Fs. These requirements have been in effect since 2020, and companies should review their groupings and headings annually to ensure their risk factor section is appropriately organized and updated.
• Risk Factor Summaries.  If your risk factor section exceeds 15 pages, you are required to include a summary of the principal risk factors in a series of concise, bulleted, or numbered statements that is no longer than two pages. This summary should be placed at the "forepart" or beginning of the Form 10-K. To avoid repetition, companies can combine this summary with the forward-looking statement legend, provided the legend is appropriately titled to reflect its dual purposes, such as "Cautionary Note Regarding Forward-Looking Statements and Risk Factor Summary." While this requirement does not technically apply to Form 20-F, it applies to foreign private issuers’ registration statements on Forms F-1, F-3 and F-4, because such forms specifically refer to Item 105 of Regulation S-K.

The following White & Case attorneys authored this alert: Maia Gez, Scott Levi, Melinda Anderson, and Danielle Herrick.

_{1 See Item 105 of Regulation S-K, available here.
2 See report by The Conference Board, “AI Risk Disclosures in the S&P 500: Reputation, Cybersecurity, and Regulation” (October 15, 2025). Among the Fortune 100, more than 85% addressed AI in their risk factors last year (up from over 65% in the prior year), and over one-third (or 36%) disclosed AI in a standalone 10-K risk factor (up from 14% in the prior year). See EY report, “Cyber and AI Oversight Disclosures: What Companies Shared in 2025”, (October 2025).
3 38% of S&P 500 companies disclosed reputational concerns related to AI in 2025. See report by The Conference Board, “AI Risk Disclosures in the S&P 500: Reputation, Cybersecurity, and Regulation” (October 15, 2025).
4 In May 2022, the SEC posted a sample comment letter to companies emphasizing their potential disclosure obligations related to direct or indirect impacts that Russia’s actions in Ukraine and the international response have or may have on their business. This guidance can help companies considering updates about other global conflicts that might affect their businesses. The SEC advised that, where material, companies should provide detailed disclosures regarding risks related to actual or potential disruptions in supply chains and the heightened risk of cyberattacks by state actors. 
In May 2022, the SEC posted a sample comment letter to companies emphasizing their potential disclosure obligations related to direct or indirect impacts that Russia’s actions in Ukraine and the international response have or may have on their business. This guidance can help companies considering updates about other global conflicts that might affect their businesses. The SEC advised that, where material, companies should provide detailed disclosures regarding risks related to actual or potential disruptions in supply chains and the heightened risk of cyberattacks by state actors. 
5 The SEC argued that the company’s SEC filings “contained general, high-level risk disclosures” that the SEC alleged “failed to address known risks” and that the company’s filings described a specific vulnerability as something that “could potentially” allow an attacker to compromise information, when in fact the vulnerability had already been utilized to do so on at least three occasions. The company also stated that it was both “still investigating” and had hired third-party cybersecurity experts to assist in an investigation of “whether a vulnerability in the Orion monitoring products was exploited” when it already knew that the vulnerability had been exploited on at least three prior occasions. Complaint, SEC v. SolarWinds Corp. and Brown, No. 1:23-cv-9518 (S.D.N.Y. Oct. 30, 2023). Also, see our alert, “Time to Revisit Risk Factors in Periodic Reports.”  A federal judge ultimately dismissed all of the SEC’s allegations related to SolarWinds’ risk factor disclosures (among other disclosures). See SEC v. SolarWinds Corp., No. 1:23-cv-9518 (S.D.N.Y. July 18, 2024), at 72. The judge noted that the company did sufficiently disclose the “types and nature of the cybersecurity risks SolarWinds faced and the grave potential consequences” to it and that while some of the disclosure was formulaic, “viewed in totality” the disclosure provided acceptable “breadth, specificity and clarity.”
6 For more information, see our alert, Key Considerations for the 2025 Annual Reporting and Proxy Season: Your Upcoming Form 10-K.
7 See page 13 at Commission Statement and Guidance on Public Company Cybersecurity Disclosures. The 2018 guidance as it pertains to risk factors remains a useful point of consideration. Companies may also want to consider the December 2019 guidance from the SEC focused on risks related to the potential theft or compromise of their technology, data, or intellectual property in connection with their international operations.
8 For example, noting that a Form 8-K discloses what appears to be a material impact related to a cyber incident, but that the same incident is not disclosed in the company’s subsequent Form 10-Q.  See comment letter to Asbury Automotive Group Inc. (October 7, 2024).
9 See our alert, “California climate disclosure laws: Ninth Circuit temporarily halts SB 261 and CARB provides new guidance” (December 3, 2025). 
10 See, for example, “DOJ and HHS Relaunch False Claims Act Working Group, Sharpen Healthcare Enforcement Priorities” (July 18, 2025).
11 Remarks at the Financial Markets Quality Conference 2025 hosted by the Psaros Center for Financial Markets and Policy at Georgetown University’s McDonough School of Business (September 25, 2025). Video of the conference is available here.
12 See., e.g., Yahoo, Inc., where the SEC found that Yahoo's risk factor disclosures in its annual and quarterly reports were materially misleading in that they claimed the company only faced the "risk of potential future data breaches" that might expose the company to loss and liability "without disclosing that a massive data breach had in fact already occurred."
13 See, for example, the joint dissent of SEC Commissioners Peirce and Uyeda in the SolarWinds case, which raised concerns that assessing cybersecurity disclosure liability with hindsight may over-expand materiality theories and lead companies to over-disclose immaterial events to avoid scrutiny. The dissent cautioned against what it described as the SEC’s “Monday morning quarterback[ing]” and warned that “if the Commission does not exercise restraint, it could find a violation in every company’s risk disclosure because risk factors cover a wide range of topics and are inherently a disclosure of hypothetical events.”}  

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2026 White & Case LLP}