AI风险观测站：从上市公司年报中的AI披露中，我们能了解多少社会韧性？

# The AI Risk Observatory:What Can We Learn from AI Disclosures in Annual ReportsAbout Societal Resilience?
Source: [https://arxiv.org/html/2610.02281](https://arxiv.org/html/2610.02281)
###### Abstract

Societal resilience research relies on access to useful and actionable data, which motivates our main research question: Can annual reports, processed at scale with LLMs, provide a useful signal about how companies disclose their response to AI? We test this by applying a reproducible two\-stage classification pipeline to 9,821 annual reports from 1,362 UK listed companies \(2020–2025, with partial 2026 data\)\. We first validate the method against 474 human\-annotated passages, finding high recall and moderate label\-level agreement\. We then report three empirical patterns: \(i\) between 2020 and 2025, the share of reports mentioning AI risk rose from 2\.8% to 41\.2%, while AI adoption disclosure also rose, from 13\.8% to 45\.2%, and named vendor mentions cluster around a small set of major providers led by Microsoft; \(ii\) disclosure varies substantially by Critical National Infrastructure sector and market segment: AIM reports disclose AI risk at far lower rates than Main Market reports, and sectors such as Energy and Data Infrastructure lag behind the rest in AI risk disclosure; and \(iii\) harm disclosures are near\-absent \(seven reports across the entire corpus\)\. We develop a*substantiveness*classification to assess the quality of the disclosure and find that most AI risk disclosure is not substantive: in 2025, 41\.2% of all reports mention AI as a risk, but only 4\.3% contain AI risk disclosure we classify as substantive\.

###### Keywords:

AI governance, disclosure analysis, annual reports, NLP, UK corporate governance

## 1Introduction

As AI systems become more prominent in corporate strategy and operations, understanding how organizations disclose AI\-related risks is increasingly important\. Societal resilience to advanced AI depends on knowing where AI dependencies and risks are accumulating across the economy, particularly within Critical National Infrastructure \(CNI\), before failures materialize\. Yet measuring this at scale is difficult\. Surveys are expensive and subject to response bias; incident databases capture harms after the fact; regulatory filings vary across jurisdictions and sectors\. Annual reports offer an alternative: they are legally mandated, board\-accountable, published alongside audited financial statements \(auditors must also confirm that the strategic report is consistent with the accounts\), and follow a stable year\-to\-year structure\. Under the Companies Act 2006, the strategic report \(a mandatory section of the annual report\) must describe principal risks and uncertainties; the Financial Reporting Council’s \(non\-mandatory\) Guidance on the Strategic Report calls for these to be entity\-specific rather than generic\. This makes annual reports a potentially valuable source for tracking how listed companies understand their AI exposure\.

In this paper, we explore three questions:

1. 1\.Feasibility\.Can LLMs reliably extract structured AI\-related signals from annual reports at scale?
2. 2\.Findings\.What patterns emerge when we apply this method to the near\-complete population of UK\-incorporated listed companies from 2020 to 2025 \(with partial 2026 data\)?
3. 3\.Signal quality\.How useful and informative are these disclosures: are they substantive and specific, or largely boilerplate?

In terms of feasibility, we validated a two\-stage LLM classification pipeline against 474 human\-annotated passages drawn from 30 reports across 10 of the 12 CNI sectors in our taxonomy, finding high recall and moderate label\-level agreement\. In terms of findings, we document a rapid rise in AI risk, adoption, and vendor disclosure between 2020 and 2025, substantial variation between CNI sectors and market segments \(i\.e\., Main Market vs\. AIM\), and a near\-total absence of harm disclosures\. In terms of signal quality, we find that most disclosures are not substantive, which limits the conclusions that can be drawn from this data source alone\.

The primary contribution is methodological: we demonstrate that LLM\-based extraction from annual reports is feasible and reproducible, and that it produces trend signals consistent with widely reported developments in AI adoption\. A secondary contribution is empirical: we provide the first large\-scale, CNI\-decomposed view of AI disclosure across UK listed companies, covering Main Market, AIM, and Aquis issuers\. Additionally, we create a mapping of companies in our dataset onto the CNI sectors using a set of LLM autograders\.111Since not all companies operate in or contribute to the CNI sectors, 970 of the 1,362 companies with a processed report are mapped to a primary CNI sector, while the remaining 392 are classified under the “other” category\.

## 2Related Work

Financial disclosure NLP\.[Loughran & McDonald \(2011\)](https://arxiv.org/html/2610.02281#bib.bib7)established annual reports as a productive natural language processing \(NLP\) corpus and documented that general\-purpose dictionaries misclassify financial language; their 2016 survey\([Loughran & McDonald, 2016](https://arxiv.org/html/2610.02281#bib.bib8)\)reviews the NLP methods most commonly applied to financial text, including dictionary\-based classification, readability metrics, and document similarity, establishing best practices that inform our pipeline design\.[Lang & Stice\-Lawrence \(2015\)](https://arxiv.org/html/2610.02281#bib.bib6)demonstrate that large\-sample textual analysis of non\-US annual reports, across 42 countries including the UK, is feasible and informative\. More recent work applies LLMs to disclosure text:[Park \(2025\)](https://arxiv.org/html/2610.02281#bib.bib9)uses LLMs and LLM agents to quantify material physical risks from textual risk disclosures in financial statements\.

Substantiveness and boilerplate\.[Dyer et al\. \(2017\)](https://arxiv.org/html/2610.02281#bib.bib4)show systematic inflation in US 10\-K reports, which grow longer while becoming more redundant, motivating the question of whether AI disclosure follows the same pattern\.[Brown & Tucker \(2011\)](https://arxiv.org/html/2610.02281#bib.bib2)show that year\-to\-year changes in*Management Discussion and Analysis \(MD&A\)*text can be used as a proxy for how much new information companies disclose\.

Disclosure and governance of AI\.The most comparable study,[Uberti\-Bona Marin et al\. \(2026\)](https://arxiv.org/html/2610.02281#bib.bib10), analyzes over 30,000 US filings and documents steep growth in AI risk mentions alongside persistently generic mitigation detail, consistent in direction with our UK\-focused findings\.[Bonsón et al\. \(2023\)](https://arxiv.org/html/2610.02281#bib.bib1)find algorithmic decision\-making disclosure in Western Europe largely voluntary and uneven\.[Chiu \(2025\)](https://arxiv.org/html/2610.02281#bib.bib3)raises the concern that generative AI can itself be used in the writing of narrative disclosures, altering the authorship and reliability of the text being analyzed\.

Observatory\-style monitoring\.Domain\-adapted language models such as ClimateBERT\([Webersinke et al\., 2022](https://arxiv.org/html/2610.02281#bib.bib11)\)make thematic classification of corporate disclosure text tractable, and[Ferjančič et al\. \(2024\)](https://arxiv.org/html/2610.02281#bib.bib5)apply textual analysis to corporate sustainability reporting to relate disclosed themes to firm\-level ESG outcomes\. We apply the same logic longitudinally to AI\-related disclosure\.

## 3Data and Method

### 3\.1Universe and Corpus

The target universe is UK\-incorporated entities listed on the London Stock Exchange \(Main Market and AIM\) and the Aquis Stock Exchange \(AQSE\)\. After removing 191 companies incorporated outside the UK, the universe contains1,469 companies\. The analysis window coverspublication years 2020–2025, with partial 2026 data \(339 reports\) included in trend visualizations and reported separately, but not used for year\-on\-year comparisons\. Of the 1,469 companies in the universe, 107 had no machine\-readable annual report available across any analysis year \(typically smaller AIM or Aquis issuers for which neither the data provider nor the Companies House route described below yielded a usable document\), leaving1,362 companieswith at least one processed report\. The full corpus contains9,821 processed reports\([Table1](https://arxiv.org/html/2610.02281#S3.T1)\): 9,482 for 2020–2025 plus the 339 partial\-2026 reports\. The unit of analysis is a filed annual\-report document rather than a company\-year: a company can contribute more than one document in a publication year \(for example, an ESEF package and a PDF version of the same report, multi\-part uploads, or copies filed on a second exchange\), so the 2025 corpus comprises 1,561 documents from 884 companies \(739, 896, 1,020, 1,002, 1,032, 884, and 207 companies for 2020–2026 respectively\), and all “% of reports” rates below are document\-weighted\. Company\-level rates are close to document\-level rates for the headline series \(in 2025: any AI mention 65\.6% vs\. 65\.5%, AI risk 41\.6% vs\. 41\.2%, adoption 46\.7% vs\. 45\.2%\), but differ more for the partial 2026 data \(AI risk 72\.0% vs\. 66\.4%\)\.

Table 1:Corpus and validation summary\.Annual reports were sourced from a third\-party data provider222We used data from FinancialReports\.eu, a commercial provider that supplies annual reports and other regulatory filings in markdown format, which is considerably easier to process than raw PDFs\.that delivers annual reports in markdown format with structured metadata\. This approach was adopted after initial experiments with direct PDF retrieval from the Companies House API followed by OCR conversion, which proved noisy, expensive, and slow at full\-corpus scale\. The third\-party data source provides approximately 95% coverage for FTSE 350 companies but only around 28% for AIM, reflecting lighter electronic filing requirements among smaller issuers\. For company\-years missing from the provider, we fell back on the Companies House route at much smaller scale: raw PDFs were retrieved from Companies House and converted into markdown using Mistral’s OCR batch API\.

### 3\.2Preprocessing

First, the markdown reports are normalized, and structural metadata \(headings, section boundaries\) are preserved\. Then, anAI keyword gateis applied before any LLM classification: a passage must contain at least one term from a fixed list of core AI terms \(*artificial intelligence*,*machine learning*,*large language models*,*generative AI*, and clearly AI\-specific techniques such as neural networks, computer vision, or natural language processing\), named AI products and vendors, or AI application terms \(e\.g\., robotic process automation, predictive analytics, chatbot\)\.333The complete keyword list is provided in[AppendixE](https://arxiv.org/html/2610.02281#A5)\.Generic terms such as “data analytics,” “digital transformation,” and “automation” are not triggers on their own\. Because some application terms are broader than AI, passages that do not explicitly concern AI are removed by the Stage 1 explicitness rule described below; the gate itself is conservative in that it never admits a passage without one of the listed terms\.

Passages that pass through the gate are extracted with a context window that spans two paragraphs before and after the trigger text\. This yields 24,189 passages \(hereafter*AI mentions*\), each preserving the surrounding context and linked structured metadata, including company identity, publication year, market segment, CNI sector, and report section\.

### 3\.3Two\-Stage Classification Pipeline

Stage 1assigns a high\-level mention type\. Each AI mention receives one or more labels:adoption\(current, company\-specific AI deployment\),risk\(a downside or exposure attributed to AI\),vendor\(explicit third\-party AI provider\),harm\(past, specific AI\-caused incident\),general/ambiguous\(AI mentioned but not meeting the criteria for adoption, risk, vendor, or harm\), ornone\(keyword\-gate false positive: the trigger term does not actually refer to AI\)\. At the passage level, labels are non\-mutually exclusive with two exceptions:noneexcludes all other labels, andgeneral/ambiguousis assigned only when no other label applies, so it cannot co\-occur withadoption,risk,vendor, orharm\. At the report level, a report may contain both kinds of passages\. Stage 1 uses conservative labeling criteria to limit false positives, given the high volume of generic statements about AI in annual reports: adoption requires first\-person company language indicating actual deployment, and risk requires that a downside or exposure be attributed to AI rather than merely mentioned near it; Stage 2 then grades how explicit that attribution is\. The classifier also reports a confidence score \(0–1\) for each label, and we retain labels with confidence≥0\.2\\geq 0\.2, so conservatism comes from the labeling rubric and the keyword gate rather than from a strict confidence cut\-off\.444The design of the classification prompts is summarized in[AppendixF](https://arxiv.org/html/2610.02281#A6); the full prompt text is reproduced in[AppendixG](https://arxiv.org/html/2610.02281#A7)\.

Stage 2applies three further classifiers to Stage 1 AI adoption, risk, and vendor mentions:

*Adoption classifier\.*Scores each mention across three non\-mutually exclusive types:non\-llm\(traditional ML, computer vision, predictive analytics\),llm\(large language models and generative AI\), andagentic\(autonomous AI systems executing tasks without continuous human oversight\)\. Adoption\-type scores are computed by the pipeline but are not analyzed in this paper; their precision for rare types such as agentic adoption has not been validated \(see[Section5\.3](https://arxiv.org/html/2610.02281#S5.SS3)\)\.

*Risk classifier\.*Maps AI risk to one or more of ten categories: Strategic/Competitive, Cybersecurity, Operational/Technical, Regulatory/Compliance, Reputational/Ethical, Third\-Party/Supply Chain, Information Integrity, Workforce Impacts, Environmental Impact, and National Security \(full category definitions are provided in[AppendixH](https://arxiv.org/html/2610.02281#A8)\)\. Each risk mention also receives a 1–3 attribution signal: 3 means explicit causal language linking the risk to AI in the same statement, 2 means clear but inferential attribution, and 1 means indirect or weak attribution \([AppendixF](https://arxiv.org/html/2610.02281#A6)\); we call a risk mention*explicit*when its attribution signal is 3\. We developed this taxonomy from first principles and stress\-tested it via an open\-taxonomy classification test run on 100 AI risk mentions \(96 classified successfully\): the model produced 107 distinct labels that collapsed, after manual consolidation, into broad themes, none of which fell outside the fixed taxonomy\.555Details of the open\-taxonomy validation are provided in[AppendixI](https://arxiv.org/html/2610.02281#A9)\.

*Vendor classifier\.*Identifies the AI provider referenced \(Microsoft, Google, OpenAI, Amazon, Nvidia, Meta, and others\), plus four special categories:internal\(in\-house systems\),other\(a named provider outside the tag set\),undisclosed\(the passage indicates reliance on a third\-party AI provider without naming it\), andopen\-source model\(an open\-weight model used without a named provider\)\.

All three classifiers assign a three\-levelsubstantiveness rating:*1: boilerplate*\(generic; could appear unchanged in any report\),*2: moderate*\(identifies a specific area but lacks mechanism or mitigation detail\), or*3: substantive*\(describes a specific mechanism and provides concrete controls, named systems, or measurable targets\)\. For risk, the distinction is concrete: a*boilerplate*passage such as “AI is a rapidly evolving technology that may impact our business” could appear unchanged in almost any report; a*moderate*passage such as “AI regulation may affect our compliance obligations” identifies a risk area but gives the reader no mechanism or mitigation; a*substantive*passage such as “We allocated £5M to bring three high\-risk AI systems into conformity with the EU AI Act by Q3 2025” provides both\. For report\-level statistics, a report is assigned, for each classifier, the substantiveness band held by the largest number of its passages \(ties resolved to the higher band\); every report\-level substantiveness figure in this paper, including the per\-category and per\-vendor splits in[Figure3](https://arxiv.org/html/2610.02281#S4.F3)and[Figure8](https://arxiv.org/html/2610.02281#A3.F8), uses this rule\.

### 3\.4Validation

The pipeline was validated against 474 human\-annotated AI mentions drawn from 30 reports across 15 companies, covering 10 of the 12 CNI sectors in our taxonomy \(no Data Infrastructure or Civil Nuclear company is included\)\. Agreement between LLM and reference labels, measured by mean Jaccard similarity over label sets, is 0\.73 for Stage\-1 mention types, 0\.41 for Stage\-2 adoption types, and 0\.33 for the ten\-category risk taxonomy \(mean 0\.49, median 0\.41 across the three multi\-label categories\)\. Per\-label precision and recall for the Stage\-1 labels are reported in[Table2](https://arxiv.org/html/2610.02281#S3.T2): recall is consistently high \(0\.91–0\.97\) while precision is lower and label\-dependent, and manual inspection of low\-agreement multi\-label categories \(especially risk\) suggests that much of the gap reflects higher LLM label completeness: the classifier tends to assign more, and frequently valid, labels per passage than the annotator initially did\. Stage\-2 vendor tags could not be scored at label granularity because the archived validation output records only a binary vendor flag; vendor presence is instead validated as a Stage\-1 label \(precision 0\.67, recall 0\.91\)\. The harm label is so rare that the validation set contains no true instance, and the classifier’s 40 false positives on this label motivated the corpus\-wide manual review of all harm\-tagged passages \([Section4\.4](https://arxiv.org/html/2610.02281#S4.SS4)\)\. The reference labels were produced by a single annotator and subsequently adjudicated: every disagreement between the initial human labels and the classifier output was manually re\-reviewed and resolved to the label set judged correct\. Because no second independent annotator exists, no inter\-annotator agreement baseline is available\. Coverage limitations of the validation set are discussed in[Section5\.3](https://arxiv.org/html/2610.02281#S5.SS3)\.

Table 2:Per\-label precision and recall of the Stage\-1 classifier against the adjudicated validation set \(474 passages; support is the number of reference\-positive passages per label; labels are non\-mutually exclusive\)\. The validation set contains no true harm instance: all 40 harm\-tagged passages were false positives\.This validation provides evidence on the feasibility question: LLM\-based extraction of structured AI disclosure signals from annual reports is feasible, with high recall and moderate precision at the mention\-type level where the headline trends are computed; finer\-grained labels \(the risk taxonomy and Stage\-2 categories\) carry more noise, and we interpret them accordingly\. The method has known limitations \(discussed in[Section5\.3](https://arxiv.org/html/2610.02281#S5.SS3)\) but is sufficient to support the trend\-level analysis that follows\.

## 4Results

The feasibility question was addressed by the validation in[Section3\.4](https://arxiv.org/html/2610.02281#S3.SS4)\. Sections[4\.1](https://arxiv.org/html/2610.02281#S4.SS1)–[4\.5](https://arxiv.org/html/2610.02281#S4.SS5)address the findings question, and[Section4\.6](https://arxiv.org/html/2610.02281#S4.SS6)addresses the signal\-quality question\.

### 4\.1AI Mentions Have Risen Rapidly

The most prominent pattern we find is the scale and speed of AI mention growth\. In 2020, 199 of 1,007 processed reports \(19\.8%\) contained at least one AI mention\. By 2025, that figure had risen to 1,023 out of 1,561 reports \(65\.5%\)\. In partial data for 2026, the rate reaches 77\.3%\. AI risk mentions grew even faster from a smaller base: the share of reports mentioning AI risk rose from 2\.8% \(28 reports\) in 2020 to 41\.2% \(643 reports\) in 2025, a roughly fifteen\-fold increase in share \(the number of such reports rose about 23\-fold as the corpus grew\), and partial 2026 data \(339 reports\) suggest the rise is continuing, though these figures are not final\. The complete year\-by\-year breakdown is in[Table5](https://arxiv.org/html/2610.02281#A1.T5)\([AppendixA](https://arxiv.org/html/2610.02281#A1)\)\.

Three phases are visible \([Figure1](https://arxiv.org/html/2610.02281#S4.F1)\)\.2020–2022: adoption mentions grew steadily \(13\.8%→\\to22\.5%\) while risk mentions lagged \(2\.8%→\\to4\.8%\), and the difference between the adoption\-mention rate and the risk\-mention rate widened to 17\.7 percentage points \(pp\)\.2023: risk mentions first rose sharply, more than doubling \(4\.8%→\\to9\.8%\) in reports drafted in the months after ChatGPT’s release, although most of these reports cover fiscal years ending in 2022\.2024–2025: the step change came in 2024, the first full reporting cycle after ChatGPT, with the risk\-mention rate tripling in a single year \(9\.8%→\\to30\.4%\) and reaching 41\.2% by 2025, nearly at parity with adoption \(45\.2%\)\.

The general/ambiguous category \(AI explicitly mentioned but without meeting the threshold for adoption, risk, vendor, or harm\) increased from 12\.2% of reports in 2020 to 56\.1% in 2025, overtaking adoption as the largest type of mention\. Restricting to reports whose*only*AI mentions are general/ambiguous, the 2025 rate is 6\.9% \(108 of 1,561 reports;[Figure7](https://arxiv.org/html/2610.02281#A3.F7)in the appendix shows the mutually exclusive composition over time\)\. This suggests that mentioning AI has become common in annual reports, but that generic AI language is mostly layered on top of, rather than substituting for, more specific disclosure\.

Despite these trends, 918 of 1,561 annual reports \(58\.8%\) in 2025 still did not mention the risk of AI at all\.

Figure 1:Annual disclosure rates for AI adoption mentions, AI risk mentions, general/ambiguous AI mentions, and AI vendor mentions, 2020–2026 \(2026 is partial\)\. The shaded region shows the difference between the AI adoption\-mention share and the AI risk\-mention share\.
### 4\.2Disclosed Risk Categories Are Diversifying

In 2025, companies mentioned a broader range of AI risk categories than competitive concerns alone\. Strategic/Competitive remains the leading category \(27\.4% of all 2025 reports\), but Cybersecurity has risen to a close second \(25\.7%\), narrowly ahead of Operational/Technical \(24\.2%\); cybersecurity risk sections commonly cite AI\-enabled phishing, adversarial attacks, and AI\-accelerated fraud\.

Two categories show exceptional growth from near\-zero bases\.Information Integrity\(AI\-generated misinformation, deepfakes\) rose from 1 report \(0\.1%\) in 2020 to 162 \(10\.4%\) in 2025, andWorkforce Impactsfrom 3 \(0\.3%\) to 132 \(8\.5%\), a roughly 28\-fold rise in share\. Their emergence in corporate reporting suggests a broadening of the disclosed risk landscape from competitive and technical concerns to societal and human\-capital themes\.[Figure2](https://arxiv.org/html/2610.02281#S4.F2)plots the complete time series for all ten risk categories;[Figure8](https://arxiv.org/html/2610.02281#A3.F8)in the appendix compares the prevalence of categories under two definitions: all mentions and only substantive mentions\.

![Refer to caption](https://arxiv.org/html/2610.02281v1/risk_taxonomy_heatmap.png)Figure 2:AI risk category prevalence by publication year \(% of reports\), 2020–2026 \(2026 partial\)\. Rows are ordered by 2025 prevalence\. The color scale is set on the complete years 2020–2025; 2026p values exceed the scale and are shown for reference\. Categories such as Information Integrity and Workforce Impacts emerge as frequently disclosed only from 2024\.
### 4\.3Early Signs of Vendor Concentration

Among companies that name an AI vendor, disclosure clusters around a small set of major providers \([Figure3](https://arxiv.org/html/2610.02281#S4.F3)\)\. Microsoft is the most frequently named vendor by a wide margin \(98 reports in 2025\), followed by Google \(47\), Amazon \(42\), and OpenAI \(38\); a long tail of other named providers accounts for a further 154 reports, and 65 reports indicate reliance on an unnamed third\-party provider\. Vendor disclosure is also the most substantive category \(64\.5% of vendor\-mentioning reports are rated substantive in 2025\), although this partly reflects the rubric: a vendor mention names a provider by definition, which meets the “named systems” criterion for a substantive rating\. Only 19\.2% of 2025 reports contain a vendor mention, and only 29\.2% of AI\-mentioning reports name a vendor, suggesting that the disclosed vendor landscape may not reflect the full extent of AI vendor relationships\.[Figure9](https://arxiv.org/html/2610.02281#A3.F9)in the appendix shows how vendor disclosure evolves over time\.

Figure 3:2025 vendor mentions by report count, ordered by frequency\. Bars are split by substantiveness; labels give the number of 2025 reports mentioning each vendor and, in parentheses, the share of those reports rated substantive \(report\-level band,[Section3\.3](https://arxiv.org/html/2610.02281#S3.SS3)\)\. Microsoft, Google, Amazon, and OpenAI lead the named\-vendor landscape, alongside a long tail of other named providers\.
### 4\.4Harm Disclosures Are Near\-Absent

The harm label \(past, specific AI\-caused incidents\) was included in Stage 1 but proved almost entirely absent from the corpus: harm\-tagged passages appear in only seven of 9,821 reports \(nine passages in total, across 2020–2026\)\. Given the label’s rarity, we manually reviewed all nine passages; five, across four reports, describe realized AI\-caused incidents\. This is a finding worth acknowledging: annual reports appear to be a valuable source for tracking AI risk*disclosure*, but may not be suitable for monitoring realized AI incidents, which would require complementary sources such as regulatory enforcement records, incident databases, and litigation filings\. The count therefore says little about how often AI\-caused incidents actually occur \(see[Section5](https://arxiv.org/html/2610.02281#S5)\)\.

### 4\.5Disclosure Varies by Sector and Market Segment

Sector patterns\.The Finance sector contributes the largest volume of mentions \(461 of the 1,362 companies with a processed report have Finance as their primary CNI sector, accounting for 657 Finance\-tagged reports in 2025; 292 of these companies are investment funds rather than operating businesses\)\. Government \(20 of 23 reports, 87\.0%\) and Communications \(25 of 29, 86\.2%\) have the highest AI\-mention rates, although with so few reports the two are statistically indistinguishable; Communications also shows the largest single\-year rise in AI risk mentions in 2025 \(\+26\.7 pp, on 29 reports\)\. Full per\-sector rates are given in[Table6](https://arxiv.org/html/2610.02281#A2.T6)\([AppendixB](https://arxiv.org/html/2610.02281#A2)\) and[Figure4](https://arxiv.org/html/2610.02281#S4.F4)\.

Two sectors stand out for low AI risk disclosure\.Data Infrastructureposts the lowest AI risk rate of any CNI sector with at least ten 2025 reports \(Civil Nuclear, with only three reports, is excluded\): 90\.0% of its 2025 reports \(18 of 20\) contain no AI risk mention, although with 20 reports the estimate is imprecise\.Energyis close behind at 80\.0% \(112 of 140\)\. The two differ, however: Energy is low on every signal \(adoption 21%, vendor 9%;[Figure11](https://arxiv.org/html/2610.02281#A3.F11)\), which fits lower AI adoption or less AI\-focused reporting, whereas Data Infrastructure reports adoption at a mid\-table 55% \(vendor 25%\) yet rarely discusses AI as a risk, so lower adoption does not explain its gap\. Whether these gaps reflect different risk perceptions, less mature governance processes, or disclosure conventions that do not foreground AI\-specific risks cannot be determined from disclosure data alone; sector\-level rates for sectors with fewer than 30 reports per year should be read as indicative only\.

Figure 4:CNI sector share of 2025 reports with AI mentions and AI risk mentions, sorted by AI risk mention share\. Numbers in brackets give the count of 2025 reports in each sector \(the denominator of each percentage\)\.The temporal evolution of sector\-level risk disclosure is shown in[Figure10](https://arxiv.org/html/2610.02281#A3.F10)\(appendix\); a breakdown by mention type per sector is given in[Figure11](https://arxiv.org/html/2610.02281#A3.F11)\.

Market segment patterns\.The gap between Main Market and AIM is substantial \([Table3](https://arxiv.org/html/2610.02281#S4.T3)\)\. Segments follow the data provider’s classification and are nested: FTSE 100 is a subset of FTSE 350, which is a subset of the Main Market\. Of the 1,561 reports for 2025, 703 are classified as Main Market and 171 as AIM; the remaining 687 \(676 with no segment assigned by the provider and 11 Aquis\) are excluded from the segment comparison\. Under a refined mapping that assigns most unclassified reports to the Main Market, the Main Market covers 1,287 reports with an AI\-mention rate of 70\.9% and an AI risk rate of 46\.9%, so the printed Main Market rates should be read as representative of index constituents and explicitly tagged Main Market issuers\.

Table 3:Market segment AI disclosure rates, 2025 \(% of reports\)\. Rows are nested \(FTSE 100⊂\\subsetFTSE 350⊂\\subsetMain Market\); counts are reports, not companies \(the FTSE 100 row covers 223 reports from 85 companies\)\.In 2025, 57\.8% of Main Market reports mentioned AI risk, compared with 6\.4% of AIM reports \(a 51\.4 pp gap, nine times the rate\); among FTSE 100 reports the rate reached 68\.6%\. The divergence is more pronounced for risk than for general AI mentions \(the AIM AI\-mention rate is 36\.8%\), suggesting that smaller companies mention AI in their reports but do not explicitly attribute risks to it\. This likely reflects AIM’s lighter governance regime666UK\-incorporated AIM companies must still describe principal risks and uncertainties in their strategic report \(s414C Companies Act 2006\)\. However, they are not subject to the UK Listing Rules, the Disclosure Guidance and Transparency Rules, or the UK Corporate Governance Code, including its provisions on assessing principal risks and internal control\. AIM Rule 26 only requires them to state on their website which recognized governance code they apply and how\., alongside differences in company size and governance resources\.[Figure5](https://arxiv.org/html/2610.02281#S4.F5)shows the complete comparison across all types of mention\.

Figure 5:2025 disclosure rates by market segment \(FTSE 100 constituents; all Main Market issuers, including the FTSE 100; AIM\) across mention types\. The drop from Main Market to AIM is steepest for risk disclosure\.
### 4\.6Most AI Risk Disclosures Are Not Substantive

A natural follow\-up question is whether the observed rise in disclosure carries genuine informational content\. We address this through the substantiveness classification described in[Section3\.3](https://arxiv.org/html/2610.02281#S3.SS3);[Table4](https://arxiv.org/html/2610.02281#S4.T4)summarizes the result\.

Table 4:Share of reports with any AI risk mention vs\. with a substantive AI risk mention \(% of all reports in each year\)\.The rise in AI risk mentions is therefore much larger than the rise in detailed risk disclosure\. In 2025, 643 reports mentioned the risk of AI, but only 67 of these reports \(10\.4%\) were classified as substantive\. Relative to the full 2025 corpus, this means that substantive disclosure of AI risk appeared in only 4\.3% of reports\. The gap between AI risk mentions \(all\) and AI risk mentions \(substantive\) has increased from 2\.5 pp in 2020 to 36\.9 pp in 2025 \([Figure6](https://arxiv.org/html/2610.02281#S4.F6)\)\. The complete substantiveness distribution across the types of disclosure \([Table7](https://arxiv.org/html/2610.02281#A4.T7)in[AppendixD](https://arxiv.org/html/2610.02281#A4)\) shows that risk disclosure is the least concrete type \(10\.4% substantive, 78\.5% moderate, against 33\.8% substantive for adoption\); vendor mentions score higher \(64\.5% substantive\), but this figure is not directly comparable because a vendor label requires naming a provider, which already satisfies the “named systems” criterion of the rubric\. Answering our signal\-quality question, AI disclosure is rarely pure boilerplate \(10\.7–11\.0% across types\); instead, most risk disclosure \(78\.5%\) is moderate, naming a risk area without mechanisms or mitigations\.

Figure 6:AI risk mention share under three filters: all mentions, explicit\-only mentions \(attribution signal 3\), and substantive\-only mentions, 2020–2026 \(2026 partial\)\. Restricting to explicit attribution lowers the level \(30% vs\. 41% of reports in 2025\) but leaves the growth trajectory largely intact, whereas restricting to substantive signals flattens the curve almost entirely \(4\.3% in 2025\): most of the growth is in disclosure lacking specific mechanisms, controls, or targets\.The proportional composition of risk disclosure by substantiveness band is shown in[Figure12](https://arxiv.org/html/2610.02281#A3.F12)\(appendix\): moderate disclosure dominates in every year, and since 2023 the composition has been broadly stable \(about 10% of risk\-mentioning reports substantive\) even as volume has grown; the higher substantive shares in 2020–2022 \(up to 18%\) rest on very few reports\.

This finding admits several non\-exclusive interpretations, which we discuss in[Section5](https://arxiv.org/html/2610.02281#S5); the central caveat is that we are analyzing statements, not the underlying reality they may describe\.

## 5Discussion

### 5\.1What This Method Can and Cannot Tell Us

The results demonstrate that LLM\-based classification of annual reports produces coherent and temporally consistent signals about AI disclosure\. The rise in AI risk mentions tracks known developments: the first rise in 2023 and the step change in 2024 \(publication years, which lag fiscal years\) align temporally with the mainstreaming of generative AI in public discourse; the broadening of disclosed risk categories \(from competitive concerns to cybersecurity, information integrity, and workforce impacts\) mirrors themes prominent in policy and media discussion\. The method is reproducible and scales to thousands of reports; because it depends only on the availability of narrative risk disclosures, it could in principle be applied in other jurisdictions and reporting regimes, although we have tested it only on UK filings\.

What the method cannot do is establish ground truth about corporate AI governance: disclosure is not the same as underlying controls or incidents \(see[Section5\.3](https://arxiv.org/html/2610.02281#S5.SS3)\), and the near\-absence of harm disclosures \(harm\-tagged passages in only seven of 9,821 reports;[Section4\.4](https://arxiv.org/html/2610.02281#S4.SS4)\) almost certainly reflects where incidents are reported rather than how often they occur\.

### 5\.2Interpreting the Substantiveness Classification

The widening gap between disclosure volume and disclosure quality is the most policy\-relevant observation in this study, but it requires careful interpretation\. Several non\-exclusive explanations are plausible:

*Inherent data\-source limitation\.*Annual reports may structurally favor hedged, generic language about emerging risks\. If so, low substantiveness is a ceiling effect of the medium rather than evidence of governance failure\.

*Immature governance\.*AI risk governance frameworks are relatively new for most companies\. Boards may lack the processes, expertise, or internal data to produce specific disclosures even when they recognize the risk\.

*Compliance\-driven disclosure\.*Companies may be mentioning AI risk primarily to signal awareness to regulators and investors, rather than to communicate specific actions or mitigations\. This would be consistent with general/ambiguous mentions being the most common disclosure type and the one with the largest absolute increase in prevalence since 2020\.

*Reporting incentives\.*Being specific about AI risks and mitigations may create liability exposure or adverse investor reactions\. Companies may rationally choose vagueness\.

These explanations have different policy implications\. If the limitation is inherent to the data source, annual reports can track trends but not the substance of companies’ internal AI risk management, and other instruments are needed\. If the limitation is the immaturity of AI risk\-management frameworks, disclosure quality may improve as those frameworks mature\. If the limitation is strategic vagueness, regulatory intervention may be necessary to compel specificity\. The closest existing lever is Provision 29 of the 2024 UK Corporate Governance Code, which, for financial years beginning on or after 1 January 2026, requires boards of companies applying the Code to declare whether their material internal controls have operated effectively; this may push companies toward more concrete statements about AI\-related controls, although it does not directly regulate the specificity of risk disclosure and does not apply to AIM\.

### 5\.3Limitations

Several limitations bear on interpretation\.

Disclosure is not exposure\.This is the most fundamental constraint\. We are analyzing what companies choose to write in their annual reports, not what they actually do or experience\. A company with rich AI risk disclosure is not necessarily better governed than one that says nothing; it may face greater scrutiny, have more sophisticated investor relations, or operate in a sector where AI disclosure is expected\. Conversely, thin disclosure may reflect non\-recognition, a deliberate choice not to disclose, or simply that AI is not yet material to that company\. We cannot distinguish between these cases from the text alone\.

Incomplete reporting\.Even where companies do disclose AI\-related information, they may not be reporting the full picture\. Annual reports are designed for shareholders and regulators, not for researchers\. Companies may omit details they consider commercially sensitive, legally risky, or simply not required\. The high proportion of moderate\-substantiveness disclosures \(companies naming a risk area without describing mechanisms or mitigations\) may partly reflect this: the information exists internally but is not disclosed, rather than not existing at all\.

Conservative keyword gate\.The keyword gate is a deliberate design choice that generates false negatives\. Companies describing AI obliquely \(“intelligent systems,” proprietary platform language without explicit AI attribution\) are not captured, so counts of explicit AI disclosure understate AI\-related discussion framed in other terms\. Because the downstream classifier also produces some false positives \([Section3\.4](https://arxiv.org/html/2610.02281#S3.SS4); confidence threshold≥0\.2\\geq 0\.2\), the reported rates are not a strict lower bound, and we do not quantify the net direction of error\.

Substantiveness as a proxy\.Substantiveness scoring requires fine\-grained judgment between similar passages and should be treated as an approximate quality indicator rather than an exact measurement\. The boundary between moderate and substantive is inherently subjective, and the LLM classifier may apply this boundary differently than a human expert would in edge cases\.

Validation coverage and single annotation\.The validation set \(474 human\-annotated AI mentions from 30 reports\) is drawn from large\-cap Main Market filings published in 2023–2024 and does not independently validate performance on AIM filings or early\-year reports\. Sub\-category precision for rare labels \(e\.g\., agentic adoption, national security risk\) remains uncertain\. The reference labels were produced by a single annotator, so no independent inter\-annotator agreement is available as a human baseline, and the reference should be read as a curated benchmark rather than unambiguous ground truth\.

Partial 2026 data\.The 2026 figures are based on 339 reports collected as of April 2026 and will change as the reporting year progresses\. These figures are included to show trend direction but should not be treated as final\.

## 6Conclusion

We asked whether annual reports, processed at scale with LLMs, can provide a useful signal about how companies disclose their response to AI\. We find that they can\. Our two\-stage classification pipeline is reproducible, scales to nearly the entire population of UK\-incorporated listed companies \(1,362 of 1,469\), and produces temporally coherent trends across 9,821 reports\. The share of reports mentioning AI risk grew roughly fifteen\-fold between 2020 and 2025, the categories of risk disclosed have broadened well beyond competitive concerns, and named vendor mentions cluster around a small set of major providers led by Microsoft\. Segmenting by CNI sector and market segment reveals substantial variation: Main Market reports disclose AI risk at nine times the rate of AIM reports \(FTSE 100 reports at more than ten times\), and sectors such as Energy and Data Infrastructure show notably low AI risk disclosure rates, Data Infrastructure despite mid\-table adoption disclosure\. The near\-absence of harm disclosure suggests that annual reports are a surface for tracking how companies frame AI risk, not for detecting realized incidents\.

However, disclosure breadth far outpaces disclosure depth\. In 2025, 41\.2% of reports mentioned AI as a risk, yet only 4\.3% contained substantive disclosure, i\.e\., disclosure that describes a specific mechanism together with concrete controls, named systems, or measurable targets; most of the remainder is moderate rather than boilerplate\. This gap has widened every year in percentage points, largely because mention volume grew while the substantive share of risk\-mentioning reports held near 10%\. Whether it reflects inherent limitations of the medium, the relative novelty of AI risk\-management frameworks, or strategic vagueness is a question that this study raises but cannot yet answer\. For societal resilience research, the implication is that annual reports are a viable instrument for tracking how AI risk disclosure evolves across CNI sectors over time\. Connecting these disclosure patterns to the quality and operational readiness of underlying risk management is a natural next step, but one that requires complementary data sources and methods beyond the scope of this work\.

## Acknowledgments

We thank the UK AI Security Institute \(AISI\) Societal Resilience team for financial sponsorship and guidance on the direction of this research, and FinancialReports\.eu for providing the annual report data\.

## Code and Data Availability

The pipeline code and the production prompts are released under the Apache License 2\.0 at[github\.com/84rt/AI\-Risk\-Observatory](https://github.com/84rt/AI-Risk-Observatory)\(the prompts are the fileclassifiers\.yamlin thepipeline/promptsdirectory\)\. The report\-level aggregates behind every figure and table, the corpus manifest, and the human\-annotated validation set are in the repository \(see its README for file locations\); the chunk\-level classified passages \(24,189 AI mentions with all Stage 1 and Stage 2 labels\) and the adjudicated validation set are attached to releasedataset\-v1\.1of the same repository, which is the data snapshot used in this paper\. All data files are released under CC BY 4\.0, and the text excerpts they contain are published with the data provider’s permission\. The full\-text annual reports are not redistributed\.

## References

- Bonsón et al\. \(2023\)Bonsón, E\., Bednárová, M\., and Perea, D\.Disclosures about algorithmic decision making in the corporate reports of Western European companies\.*International Journal of Accounting Information Systems*, 48:100596, 2023\.
- Brown & Tucker \(2011\)Brown, S\. V\. and Tucker, J\. W\.Large\-sample evidence on firms’ year\-over\-year MD&A modifications\.*Journal of Accounting Research*, 49\(2\):309–346, 2011\.
- Chiu \(2025\)Chiu, I\. H\.\-Y\.Using generative artificial intelligence in corporate narrative reporting: Understanding risks within the lens of a ‘reporting chain’ approach\.*Cambridge Forum on AI: Law and Governance*, 1:e43, 2025\.
- Dyer et al\. \(2017\)Dyer, T\., Lang, M\., and Stice\-Lawrence, L\.The evolution of 10\-K textual disclosure: Evidence from Latent Dirichlet Allocation\.*Journal of Accounting and Economics*, 64\(2–3\):221–245, 2017\.
- Ferjančič et al\. \(2024\)Ferjančič, U\., Ichev, R\., Lončarski, I\., Montariol, S\., Pelicon, A\., Pollak, S\., Sitar Šuštar, K\., Toman, A\., Valentinčič, A\., and Žnidaršič, M\.Textual analysis of corporate sustainability reporting and corporate ESG scores\.*International Review of Financial Analysis*, 96:103669, 2024\.
- Lang & Stice\-Lawrence \(2015\)Lang, M\. and Stice\-Lawrence, L\.Textual analysis and international financial reporting: Large sample evidence\.*Journal of Accounting and Economics*, 60\(2–3\):110–135, 2015\.
- Loughran & McDonald \(2011\)Loughran, T\. and McDonald, B\.When is a liability not a liability? Textual analysis, dictionaries, and 10\-Ks\.*The Journal of Finance*, 66\(1\):35–65, 2011\.
- Loughran & McDonald \(2016\)Loughran, T\. and McDonald, B\.Textual analysis in accounting and finance: A survey\.*Journal of Accounting Research*, 54\(4\):1187–1230, 2016\.
- Park \(2025\)Park, T\.Quantifying material risks from textual disclosures in financial statements using LLMs and LLM agents – a case study on physical risks\.IFC bulletin no\. 65, Bank for International Settlements, Irving Fisher Committee on Central Bank Statistics, 2025\.
- Uberti\-Bona Marin et al\. \(2026\)Uberti\-Bona Marin, L\. G\., Rijsbosch, B\., Spanakis, G\., and Kollnig, K\.Are companies taking AI risks seriously? A systematic analysis of companies’ AI risk disclosures in SEC 10\-K forms\.In*Machine Learning and Principles and Practice of Knowledge Discovery in Databases: ECML PKDD 2025 International Workshops, Revised Selected Papers, Part I*, pp\. 86–106\. Springer, 2026\.arXiv:2508\.19313\.
- Webersinke et al\. \(2022\)Webersinke, N\., Kraus, M\., Bingler, J\. A\., and Leippold, M\.ClimateBert: A pretrained language model for climate\-related text\.In*Proceedings of the AAAI 2022 Fall Symposium: The Role of AI in Responding to Climate Challenges*, 2022\.arXiv:2110\.12010\.

## Appendix AAnnual Disclosure Prevalence

Table 5:Annual disclosure prevalence by mention type\.*Reports*is the number of processed reports per year; all other columns are % of those reports\. \*2026 is a partial year \(339 reports filed to date\)\.
## Appendix BCNI Sector Disclosure Summary

Table 6:CNI sector AI disclosure summary \(2025\)\.*Reports*is the number of 2025 reports tagged with the sector \(the denominator of the AI and Risk shares\);Δ\\DeltaYoY is the change in the Risk share from 2024, in percentage points \(—: no 2024 reports\)\. Company counts by primary sector are given in the text; rates for sectors with fewer than 30 reports are indicative only\.
## Appendix CAdditional Figures

Figure 7:Composition of AI disclosure over time, 2020–2026 \(2026 partial\)\. Each AI\-mentioning report is assigned to exactly one slice in priority order \(any vendor mention; otherwise any risk mention; otherwise any adoption mention; otherwise general/ambiguous only\), so unlike[Table5](https://arxiv.org/html/2610.02281#A1.T5)the slices are mutually exclusive and sum to the AI\-mention rate\. Reports whose only AI mentions are general/ambiguous remain a small, stable share \(5–7% of reports; 6\.9% in 2025\); the growth comes mainly from reports with risk mentions and reports naming a vendor\. The dashed line marks 2025, the last complete year\.Figure 8:2025 risk category prevalence: all mentions vs\. substantive\-only mentions \(% of reports\)\. Dark segments show the share of reports rated substantive at report level \([Section3\.3](https://arxiv.org/html/2610.02281#S3.SS3)\) among those mentioning the category, overlaid on the light all\-mentions bar; the light remainder shows the gap between mention volume and substantive content\.Figure 9:Share of reports mentioning the top named AI vendors, 2020–2026 \(2026 partial\)\. OpenAI is essentially absent as a disclosed vendor before 2023 \(three reports in 2021, none in 2020 or 2022\)\.![Refer to caption](https://arxiv.org/html/2610.02281v1/sector_risk_heatmap.png)Figure 10:AI risk mention prevalence \(% of reports\) by CNI sector and publication year, 2020–2026 \(2026 partial\)\. Finance and Communications show rapid growth; Energy and Data Infrastructure remain low through 2025 \(the 2026p cells rest on very few reports\)\. Blank cells indicate sector\-years with no reports\.![Refer to caption](https://arxiv.org/html/2610.02281v1/sector_signal_heatmap_2025.png)Figure 11:2025 CNI sector disclosure by mention type \(% of reports\)\. Rows are ordered by the share of reports with any AI mention \(see[Table6](https://arxiv.org/html/2610.02281#A2.T6)\)\. Some sectors show high general/ambiguous mention rates but low risk or vendor disclosure\.Figure 12:Composition of risk\-mentioning reports by substantiveness band, 2020–2026 \(2026 partial\)\. Moderate disclosure dominates throughout; the mix has been broadly stable since 2023 even as volume has grown\.
## Appendix DSubstantiveness Distribution \(2025\)

Table 7:2025 disclosure substantiveness by classifier type \(% of reports with the corresponding mention type, using the report\-level band defined in[Section3\.3](https://arxiv.org/html/2610.02281#S3.SS3)\)\.
## Appendix EAI Keyword Gate: Full Term List

The following terms trigger the AI keyword gate described in[Section3\.2](https://arxiv.org/html/2610.02281#S3.SS2)\. A passage must contain at least one of these terms to proceed to LLM classification\. Terms marked with†\\daggerare matched case\-sensitively to avoid false positives \(e\.g\., “AI” does not match “Shanghai” or “Chairman”\)\. Short acronyms can still collide with non\-AI uses \(e\.g\., “ML” for megalitres in water\-utility reports, or the LLM law degree in director biographies\); such passages pass the keyword gate but are removed by the Stage 1 explicitness rule, which assignsnonewhen no AI meaning is present \([AppendixF](https://arxiv.org/html/2610.02281#A6)\)\.

Core AI terms:artificial intelligence, AI†, A\.I\., machine learning, ML†, machine\-learned, deep learning, neural network\(s\), neural net\(s\), deep neural network\(s\), large language model\(s\), LLM, language model\(s\), foundation model\(s\), frontier model\(s\), generative AI, gen AI, natural language processing, NLP, computer vision, image recognition, image classification, object detection, semantic segmentation, reinforcement learning, cognitive computing, multimodal\.

Products and vendors:ChatGPT, GPT \(with version numbers\), GPT \(general\), Claude, Llama, Stable Diffusion, Copilot, OpenAI, Anthropic, DeepMind\.

Application terms:intelligent automation, robotic process automation, RPA, predictive analytics, chatbot, virtual assistant, recommendation engine/system/algorithm, autonomous, algorithmic \(trading/decision/bias\), speech recognition, speech\-to\-text, text\-to\-speech, text\-to\-image, text\-to\-video, image generation\.

Governance and risk terms:explainable AI, XAI, responsible AI, AI ethics, ethical AI, AI governance, AI safety, AI risk\(s\), AI audit\(s/ing\), AI regulation\(s\), AI compliance\.

Agent\-related terms:agentic, AI agent\(s\), intelligent agent\(s\)\.

Generic terms such as “data analytics,” “digital transformation,” “automation” \(other than the listed forms such as “intelligent automation”\), and “advanced analytics” are not triggers: on their own they do not admit a passage\.

## Appendix FClassifier Design Summary

Below we summarize the key design choices of the production prompts used in the pipeline; the full prompt text is reproduced in[AppendixG](https://arxiv.org/html/2610.02281#A7)\. Context variables \(\{firm\_name\},\{sector\}, etc\.\) are populated at runtime\.

### F\.1Stage 1: Mention\-Type Classification

The Stage 1 prompt assigns one or more labels from \{adoption,risk,harm,vendor,general/ambiguous,none\}\. The key design choices are:

- •AnAI Explicitness Gate: if the excerpt does not explicitly mention AI/ML/LLM/GenAI or a clearly AI\-specific technique, the classifier must returnnone\. Terms like “data analytics” or “digital tools” alone do not pass\.
- •Adoptionrequires first\-person, company\-specific language indicating current deployment\. Generic intent or strategy statements are classified asgeneral/ambiguous\.
- •Riskrequires a downside or exposure to be attributed to AI \(explicitly or by clear inference\)\. A risk section that mentions both AI and a risk in separate sentences needs a clear causal link\.
- •Harmrequires description of a past, specific AI\-caused incident\.
- •Vendorrequires explicit naming of a third\-party AI provider or platform\.
- •Labels are non\-mutually exclusive exceptnoneandgeneral/ambiguous, which cannot co\-occur with other labels\.
- •Confidence scores \(0\.0–1\.0\) are assigned to each label; only labels with confidence≥0\.2\\geq 0\.2are included\.

### F\.2Stage 2: Taxonomy Classification

Stage 2 applies three parallel classifiers to mentions labeledadoption,risk, orvendorin Stage 1:

Adoption\-type classifier\.Scores each mention on three non\-mutually exclusive categories \(non\-llm,llm,agentic\) using a 0–3 signal scale\. Signal 0 means “not present”; signal 3 means “explicit, unambiguous\.” The classifier includes specific rules to prevent inflation ofagenticscores: standard RPA, workflow automation, AI copilots, and tools that assist human decisions receive agentic signal 0 regardless of other context\. Each mention also receives a substantiveness rating \(boilerplate / moderate / substantive\)\.

Risk classifier\.Maps AI risk to one or more of ten categories \(Strategic/Competitive, Cybersecurity, Operational/Technical, Regulatory/Compliance, Reputational/Ethical, Third\-Party/Supply Chain, Information Integrity, Workforce Impacts, Environmental Impact, National Security\), each assigned category receiving a signal score of 1–3\. The prompt enforces an attribution framework: signal 3 requires explicit causal language in the same statement; signal 2 requires clear but inferential attribution; signal 1 captures indirect or weak attribution\. Signals 1–2 thus re\-grade Stage 1 risk mentions whose attribution is inferential or weak; in 2025, 30\.3% of reports contain an explicit \(signal 3\) risk passage versus 41\.2% with any risk label\. Each mention receives a substantiveness rating\.

Vendor classifier\.Identifies AI providers from a predefined tag set covering foundation\-model providers \(OpenAI, Anthropic, Meta, xAI, Mistral, Cohere\), hyperscalers \(Amazon, Google, Microsoft\), data/AI platforms \(Databricks, Snowflake, Palantir, IBM\), infrastructure \(Nvidia, Arm\), MLOps/retrieval \(Hugging Face, Pinecone\), enterprise AI \(Salesforce\), UK AI vendors \(Darktrace, Quantexa, Featurespace, Faculty AI, BenevolentAI\), and special tags \(internal,undisclosed,open\-source model,other\)\. The signal scores \(1–3\) follow the same attribution framework, and each mention receives a substantiveness rating\.

## Appendix GClassification Prompts

The production prompt file \(pipeline/prompts/classifiers\.yamlin the public repository\) is reproduced below\. Context variables in braces are populated at runtime\. Typographic characters \(curly quotes, dashes, arrows, and the pound sign\) have been replaced by ASCII equivalents for typesetting; the wording is otherwise unchanged\.

mention\_type:\|

YouareanexpertanalystlabelingAImentionsfromcompanyannualreports\.

\#\#TASK

AssignALLmentiontypesthatapplytotheexcerpt\.TypesareNOTmutuallyexclusiveexceptfor"none"\.

IftheexcerptcontainsnoAImention,returnonly"none"\.OnlytagcontentthatisexplicitlyaboutAIintheexcerpt;ignoreunrelatedsentences\.

\{reasoning\_instruction\}

\#\#RULES

1\.AIEXPLICITNESSGATE:

IftheexcerptDOESNOTexplicitlymentionAI/ML/LLM/GenAIoraclearlyAI\-specifictechnique\(e\.g\.,machinelearning,neuralnetworks,computervision\),assignthetag"none"\.Termslike"dataanalytics"or"digitaltools"generallyareNOTconsideredAIunderourdefinition\.Thetag"none"isusedwhenthereisnoAImention,afalsepositive,orunrelatedautomationnotclearlyAI\.Onlyconsidertermslike"autonomousorvirtualassistant"asAIifitcanbeclearlyattributedtoAI\.

IftheexcerptDOESexplicitlymentionAI/ML/LLM/GenAIoraclearlyAI\-specifictechnique\(e\.g\.,machinelearning,neuralnetworks,computervision\),usethefollowingtagsinanon\-mutuallyexclusivemanner:adoption\(thecurrentusageofAItechnologybythecompany\),risk\(AIasarisk:risksthataredirectlycomingfromAI\),harm\(pastorongoingharmsthatwerecausedbyAI\),vendor\(anymentionofaproviderofAItechnology\),general\_other\_or\_ambiguous\(anystatementaboutAIthatdoesnotfitintotheothertags\)\.Herearemoredetailsoneachtag:

\-\*adoption\*:mustdirectlydescriberealcurrentdeployment,implementation,rollout,pilot,oruseofAIbythecompanyorforitsclients\.Genericstatementsaboutintent/strategy/roadmaps/plans\(adoptioninthefuture\)areNOTconsideredadoption\.Treat"exploring","piloting",or"investigating"AIuseasadoptionONLYwhenitreferstoinitiativecurrentlyunderway\(e\.g\."currenttrailresultedin\.\.\."\)\.DeliveringAIsystemsdirectlyorindirectlyforclientsdoescountasadoption;pureconsulting/advicewithoutdeploymentdoesNOT\.

\-\*risk\*:’Risk’isthepotentialforaharmtooccur,eithertothefirmortoanotherpartyortosocietyatlarge\.Foramentiontobeclassifiedassuch,itmustdirectlyattributeAIasthesourceofariskordownside\(suchasariskofthefollowingnature:strategic&competitive,operational&technical,cybersecurity,workforceimpacts,regulatory&compliance,informationintegrity,reputational&ethical,third\-party&supplychain,environmentalimpact,andnationalsecurityetc\.\)\.TheexcerptmightcontainasentenceonriskandaseparatesentenceonAI:makesuretoonlyassignthe"risk"tagifAIismentionedasthesourceoftherisk\.GenericrisklanguagewithoutexplicitlymentioningAIisNOTriskfromAI\.However,therisksectionmightoutlinedownstreamrisksoreffectsfromAItechnologiesinanindirectway,theseshouldbeclassifiedasriskfromAI\.

\-\*harm\*:’Harm’isanactualinjuryordamageorlossthathasoccurredorisoccurring,eithertothefirmortoanotherpartyortosocietyatlarge\.Foramentiontobeclassifiedassuch,itmustdescribeharmscausedbyAI\(suchas:misinformation,fraud,abuse,safetyincidents,regulatorypenalty,financiallossorothertypeofharm\)\.Thislabelshouldonlybeappliedwheretheharmhasoccurred,orisoccurring\.Itshouldnotbeusedforapotentialharm\.

\-\*vendor\*:mustdirectlynameathird\-partyAIvendor/platformthatprovidestheAItechnology\(suchas:Microsoft,Google,OpenAI,AWS,orexplicitlydevelopedin\-house\)\.OurgoalistotagtextthatmentionsanyinformationaboutwhatAImodels,computeinfrastructure,orAIhardwareareusedbythecompany\(i\.e\.GPTorGoogleGemini\)\.

\-\*general\_other\_or\_ambiguous\*:vagueAIstrategy,high\-levelplans,otherAImentions,orAImentionsthatdon’thaveenoughcontextorarenotspecificenough\.IfAIisexplicitlymentionedbutdoesnotmeetadoption/risk/harm/vendor,usegeneral\_other\_or\_ambiguous\.Thetaggeneral\_other\_or\_ambiguousshouldonlybeaddedwhentheexcerptclearlytalksaboutAIbutdoesnotmeettheothertagdefinitions\.

2\.Assignconfidencescorestoeachtag\.Confidencescoresalwaysindicatehowlikelythelabelapplies\(including"none"\)\.

\#\#CONFIDENCEGUIDANCE\(0\.0\-1\.0\)

\-0\.2:faint/implicitsignal;couldbethistypebuthardtotell

\-0\.5:uncertain\-weakevidence

\-0\.8:likelyYES\-strongsignal,butnotfullyexplicit

\-0\.95\-1\.0:confidentYES\-explicit,unambiguousmention

\#\#EXAMPLES

\-"WedeployedanAIchatbotforcustomersupport\."\-\>adoption~1

\-"WeareexploringAIopportunities\."\-\>general\_other\_or\_ambiguous~0\.7

\-"WearepilotingAItoautomateinvoiceprocessing\."\-\>adoption~0\.8

\-"Weusedataanalyticsandpredictiveanalyticstooptimizerouting\."\-\>none~0\.6\(unlessAI/MLexplicitlystated\)

\-"AIcouldincreasemisinformationrisks\."\-\>risk~0\.8

\-"AIisalong\-termmegatrend,beingwidelyadoptedwithintheindustry;weareevaluatinganyrisksassociatedwithit\."\-\>risk~0\.7\(no"adoption"tag,asnoevidenceofadoptionbycompany\)

\-"WepartnerwithMicrosoftforAItooling\."\-\>vendor~0\.9,adoption~0\.6

\-"WepartneredwithOpenAItodeliverAIsystemsforclientsin2024\."\-\>vendor~0\.9,adoption~0\.8

\-"Automationofcustomerservicetasksimprovedour\.\.\."\-\>general\_other\_or\_ambiguous~0\.2\(notnecessarilyAI\)

\-"Address:FT\-AI4810Shangh’ai’,iswherethe\.\.\."\-\>none~0\.9\(afalsepositive\)

\-"AI\-generatedmisinformationhasdamagedourbrandreputation\."\-\>harm~0\.9

\#\#OUTPUTCONSTRAINTS

\-mention\_typesmustbenon\-empty\.

\-If"none"ispresent,itmustbetheonlylabel\.

\-ProvideaconfidencescoreforEVERYlabelinmention\_types\.

\-DoNOTincludeconfidencescoresforlabelsnotinmention\_types\.

\#\#EXCERPTCONTEXT

Company:\{firm\_name\}\|Sector:\{sector\}\|ReportYear:\{report\_year\}\|ReportSection:\{report\_section\}

adoption:\|

YouareanexpertanalystclassifyingthetypeofAIadoptionincompanyannualreports\.

\#\#TASK

Theexcerpthasalreadybeenclassifiedwiththefollowingmentiontypes:\{mention\_types\}\.

ClassifytheAIadoptedbythecompanyintotype\(s\)into4categories\.CategoriesareNOTmutuallyexclusiveasidefrom‘ambiguous‘whichshouldbeusedalone\.

Assignsignalscores\(0\-3\)forALLadoptiontypes\.Use0fortypesnotpresent\.

\{reasoning\_instruction\}

\#\#CATEGORIES

\-\*non\_llm\*:TraditionalAI/ML\-everythingthatisAIbutnotLLMorAgenticAI\(e\.g\.,computervision,predictiveanalytics,frauddetection,recommendationengines,anomalydetection,roboticprocessautomationwithML\)\.

\-\*llm\*:LargeLanguageModels\-suchas:GPT,ChatGPT,Gemini,Claude,Copilot,textgeneration,NLPchatbots,documentsummarization,codegenerationoranythingintheGenAIcategory\.

\-\*agentic\*:AgenticAI\-AIsystemsoragentsthatautonomouslyexecutetasksandtakeactionswithlimitedhumanoversight\.Thekeycharacteristicisautonomousexecution:theAIacts,decides,andoperatesonitsownratherthanassistingahumanwhodecides\.Theword"agentic"neednotappear,buttheremustbeclearevidenceofautonomousAIaction\-notjustAI\-assisteddecisionsupport\.WhenagenticAIisLLM\-based,selectboth\.

\-\*ambiguous\*:CurrentAIadoptionispresent,buttheexcerptistoovaguetoclassifyintonon\_llm,llm,oragenticwithoutguessing\.Usethisforadoptionmentionsthatdon’thaveenoughcontexttodetermine,evenina’weakimplicit’way,whatistheunderlyingAItype,suchas"weuseAItools"or"AIsupportsouroperations"\.

\#\#RULES

1\.Ifthementionisfalselyclassifiedasadoption\-i\.e\.,itdoesnotclearlytalkaboutthecompany’s\*current\*usageofAI\(onlytalksaboutplansoropportunitieswithoutanyevidenceforcurrentdeployment\),setallfoursignalsto0\.IfcurrentAIadoptionispresentbutthereisnotenoughinformationtoclassifyitasnon\_llm,llm,oragentic,setambiguous\>0andsetothertypesto0\.

2\.Asingleexcerptcandescribemultipleadoptiontypes\(e\.g\.,LLM\+agentic\)\.Butsomecanbemoreevidentthanothers,somakesuretoassigntheappropriatesignalscorestoeachtagwhenassigningmultiple\.

3\.Mentionssuchas"AI\-powered"or"AItools"withoutfurtherdetail\-assignambiguousunlesscontextimpliesnon\_llm,llm,oragenticAI\.

4\.CopilotsandAIassistantsaretypicallyllmunlessexplicitlydescribedasautonomous/agentic\.

5\.Generic"automation"withoutAIspecificityshouldgetaverylowsignal\(1\)acrossnon\_llmonly\-doNOTassignagenticsignalforgenericautomation\.

6\.Agenticsignalmustbe0for:standardRPAorworkflowautomation,AIthatassistsoraugmentshumandecisions,AIcopilots/assistants,andanyexcerptwhereAIisatoolhumansuseratherthananagentthatactsindependently\.

\#\#SIGNALGUIDANCE\(0\-3\)

\-0:notpresent

\-1:weak/implicitsignal;couldbethistypebutnotclearlystated

\-2:strongimplicitsignal;typeisclearlyimpliedbutnotexplicit

\-3:explicit,unambiguoustypemention

\#\#EXAMPLES

\-"WedeployedaGPT\-basedchatbotforHRqueries\."\-\>llm\(signal3\),agentic\(signal0\)

\-"Weusepredictiveanalyticsandmachinelearningtodetectfraud\."\-\>non\_llm\(signal3\)

\-"WearerollingoutAIagentstofullyautomateclaimsprocessingend\-to\-end\."\-\>agentic\(signal3\),llm\(signal1\)

\-"In2024,ourAIplatformautonomouslyhandledcustomerservicewithnohumanoversight\."\-\>agentic\(signal2\),llm\(signal1\)

\-"WedeployedautonomousAIagentsthattriage,investigate,andresolveITincidentswithouthumaninput\."\-\>agentic\(signal3\),llm\(signal2\)

\-"WeintegratedMicrosoftCopilotacrossourorganisation\."\-\>llm\(signal3\),agentic\(signal1\)

\-"WeapplyAIincustomerservice\."\-\>ambiguous\(signal2\),agentic\(signal0\)

\-"OurautonomousvehiclesuseAIfornavigationandsafety\."\-\>non\_llm\(signal3\),agentic\(signal2\)

\-"Weareautomatingback\-officeworkflowsusingAI\."\-\>non\_llm\(signal2\),agentic\(signal0\)unlessexplicitagentbehaviourisdescribed

\-"Ourcomputervisionsystemdetectsmanufacturingdefectsontheproductionline\."\-\>non\_llm\(signal3\)

\-"WehaveestablishedacommitteetonavigatetheGenAIchangeandplan"\-\>thisonlygivesusaslighthintofpotentialimplementationofLLMs,butwedon’thaveenoughinformationtodeterminethatthecompanyhasanycurrentdeploymentofLLMsystems\(signal0\)

\#\#OUTPUTCONSTRAINTS

\-IncludeALLfouradoption\_signalsentries:oneeachfornon\_llm,llm,agentic,ambiguous\.Ifyouassignambiguous,setallothertagsto0\.

\-Eachentrymustbeanobjectwithfields:\{\{"type":<label\>,"signal":<0\-3integer\>\}\}\.

\#\#EXCERPTCONTEXT

Company:\{firm\_name\}\|Sector:\{sector\}\|ReportYear:\{report\_year\}

risk:\|

YouareanexpertanalystclassifyingAI\-relatedrisksincompanyannualreports\.

\#\#OBJECTIVE

ClassifyAI\-causedorAI\-linkedriskswithcalibratedsignalstrength\.

Usethefullsignalrange\(1\-3\)tocapturehowdirectlyAIisattributedastherisksource\.

Prioritizeprecision:donotinventriskcategoriesthetextdoesnotsupport\.

Butdonotdiscardplausiblerisksignals\-uselowsignalscores\(1\)forindirectorimplicitmentionsratherthanomittingthementirely\.

\#\#TASK

Theexcerpthasalreadybeenclassifiedwithmentiontypes:\{mention\_types\}\.

Identifyrisksthatarecausedby,linkedto,orexacerbatedbyAI,andmapthemtothetaxonomybelow\.

CategoriesareNOTmutuallyexclusive;includeallthataresupportedbytheexcerpt\.

\{reasoning\_instruction\}

\#\#ATTRIBUTIONFRAMEWORK\(MAPSDIRECTLYTOSIGNALSCORES\)

Beforeassigninganyriskcategory,assessthestrengthofAI\-to\-riskattribution:

Signal3\-EXPLICIT:ThetextdirectlystatesthatAIcauses,creates,orexposesthecompanytothisspecificcategoryofrisk\.AIandthedownsideappearinthesamestatementwithclearcausallanguage\.

Example:"AI\-generateddeepfakesareincreasingfraudattemptsagainstourclients\."\-\>cybersecurity\(3\)

Signal2\-STRONGIMPLICIT:AIandaspecificdownsidearebothclearlypresentandlinked,butthecausalconnectionrequiresmodestinterpretation\.Thereadercanconfidentlyinfertheriskcategory\.

Example:"AIisincreasingthepossibilityofdatabreachesandfraud\."\-\>cybersecurity\(2\)

Signal1\-WEAKIMPLICIT:AIismentionedinariskcontextandaspecificriskcategoryisplausible,buttheattributionisindirectorrequiressignificantinterpretation\.Thetexthintsattheriskratherthanstatingit\.

Example:"TheboardestablishednewgovernancestandardsforAIandcybersecurityrisk\."\-\>cybersecurity\(1\)

None\-NOATTRIBUTION:AIisnotmentionedinconnectionwithrisk,ortheexcerptcontainsonlygenericrisklanguage,oronlyopportunity/adoption/governancelanguagewithoutanydownsideframing\.

\#\#RISKTAXONOMY

\-strategic\_competitive:AI\-drivencompetitivedisadvantage,displacement,failuretoadapt,pricing/marginerosion\.

\-operational\_technical:AIreliability/accuracy/safety/model\-riskfailuresthatdegradedecisionsoroperations,unsafeemployeeAIusage\(shadowAI\)\.

\-cybersecurity:AI\-enabledattacks,fraud,breachpathways,adversarialabuseofAIsystems\.

\-workforce\_impacts:AI\-drivendisplacement,skillsgaps\.

\-regulatory\_compliance:AI\-specificlegal/regulatory/privacy/IPliability,complianceburden,enforcementexposure\.

\-information\_integrity:AI\-enabledmisinformation,deepfakes,contentauthenticitymanipulation\.

\-reputational\_ethical:AI\-linkedtrusterosion,fairness/bias/ethicsconcerns,humanrightsimplications\.

\-third\_party\_supply\_chain:DependencyonAIvendors,concentrationrisk,exposuretofailuresormisuseofAIthatoccursinthecompany’ssupplychain\.

\-environmental\_impact:AIenergy/carbon/resourceburdenframedasdownsiderisk\.

\-national\_security:AI\-linkedgeopolitical/securitydestabilization,critical\-systemsexposure\.

\-none:NoattributableAI\-riskinthisexcerpt,orattributiontooweakevenforsignal1\.

\#\#DECISIONRULES

1\.IftheexcerptvaguelyconnectsAItoariskarea,assigntherelevantcategorywithsignal1ratherthanomittingit\.Reserve"none"forexcerptswithgenuinelynoAI\-riskcontent\.

2\.Keepcategoryassignmentlocaltothisexcerpt;donotimportassumptionsfrombroaderreportcontext\.

3\.Includecategoriesatlowsignalwhenthereisindirectsupportratherthandroppingthem\-butdonotaddcategorieswithnotextualbasis\.

4\.Opportunity/adoptionlanguagealoneisNOTrisk\.ButifthesameexcerptframesAIadoptionascreatingexposure\(e\.g\.,"rapidAIadoptioncreatesskillsgaps"\),thatISrisk\.

5\.Governance/frameworklanguagealoneisNOTriskatsignal3\.ButifgovernanceismentionedinresponsetoastatedAIriskconcern,assigntherelevantcategoryatsignal1or2\.

6\.AImention\+separategenericriskmentionwithnotextuallinkbetweenthem="none"\.

7\.If"none"isselected,itmustbetheonlyrisktype\.

8\.Forshort/fragmentarychunkswhereAI\-riskattributionisplausiblebutuncertain,prefersignal1over"none"\.

\#\#EXAMPLES\(SIGNAL\-CALIBRATED\)

\-"AIanddigitalizationarelong\-termmegatrends;weupdatedtechnologyroadmaps\."\-\>none\(nodownsideframing\)

\-"AImayaffectourbusiness;wemonitordevelopments\."\-\>none\(toovague,nospecificriskcategory\)

\-"WeuseAIandfacegrowingcyberthreats\."\-\>none\(nocausallinkbetweenAIandthecyberthreats\)

\-"IncreasingriskfromnewtechnologiessuchasAIisamajorconcern\."\-\>none\(toovaguetoassignaspecificcategorydespitedownsideframing\)

\-"AIisanemergingrisk\.Dataprivacyisanincreasingpriorityforus\."\-\>regulatory\_compliance\(1\);AIflaggedasrisk,privacyconcernnearbybutlinkisindirect

\-"TheboardcreatedanewstandardforAIandcybersecurityrisk\."\-\>cybersecurity\(1\);co\-occurrenceingovernancecontext,nocausalclaim

\-"RapidadvancesinAIbringstakeholderscrutinyondataethics,reskilling,andsupplychainrisks\."\-\>workforce\_impacts\(2\),reputational\_ethical\(2\),third\_party\_supply\_chain\(1\)

\-"AIisincreasingthepossibilityofdatabreachesandfraud\."\-\>cybersecurity\(2\);impliesAI\-causedcyberriskwithoutstatingitdirectly

\-"GenAI\-enabledimpersonationisincreasingfraudattemptsagainstourclients\."\-\>cybersecurity\(3\),information\_integrity\(2\)

\-"OurAImodelscanproduceunreliableoutputsincreditdecisions\."\-\>operational\_technical\(3\)

\-"EUAIActobligationsmayincreasecompliancecostsandliabilityforourAIsystems\."\-\>regulatory\_compliance\(3\)

\-"DependenceonasmallnumberofAImodelproviderscoulddisruptservicecontinuity\."\-\>third\_party\_supply\_chain\(3\)

\-"WemightfailtoadoptAIinatimelymanner,puttingusatacompetitivedisadvantage\."\-\>strategic\_competitive\(3\)

\-"DeepfakesandGenAIcancausemisinformationanddamagetoourreputation\."\-\>information\_integrity\(3\),reputational\_ethical\(2\)

\-"GenAIoutputsmaybeunreliable;weexpandedmodelgovernancetomitigatemodelrisk\."\-\>operational\_technical\(3\)

\-"AImayaffectprincipalrisksincludingcyber,legal,andHR,butimpactsremainuncertain\."\-\>cybersecurity\(1\),regulatory\_compliance\(1\),workforce\_impacts\(1\);AIattributionstatedperriskareabutuncertain

\#\#OUTPUTCONSTRAINTS

\-risk\_typesmustbenon\-empty\.

\-If"none"ispresent,itmustbetheonlylabel\.

\-Provideexactlyonerisk\_signalsentryperlabelinrisk\_types\.

\-DoNOTincluderisk\_signalsentriesforlabelsnotinrisk\_types\.

\-Signalscoresmustbeintegersin\{\{1,2,3\}\}\.

\#\#EXCERPTCONTEXT

Company:\{firm\_name\}\|Sector:\{sector\}\|ReportYear:\{report\_year\}\|ReportSection:\{report\_section\}

vendor:\|

YouareanexpertanalystextractingAIvendormentionsfromcompanyannualreports\.

\#\#TASK

Theexcerpthasalreadybeenclassifiedwiththefollowingmentiontypes:\{mention\_types\}\.

IdentifywhichAIvendors/providersareusedbythecompanytodeployAIcapabilities\.

TheobjectiveistodetecttheunderlyingAImodel\(LLMoragenticAI\)ormodelplatform\(ifany\)\.

TagsareNOTmutuallyexclusive\.

Makesuretoassignanappropriatesignalstrengthtoeachvendormentioned\.

\{reasoning\_instruction\}

\#\#VENDORTAGS

\#foundation\_models

\-openai:OpenAI,GPT,ChatGPT

\-anthropic:Anthropic,Claude

\-meta:MetaAI,Llama

\-xai:xAI,Grok

\-mistral:Mistral,Mixtral

\-cohere:Cohere,Command

\#hyperscalers

\-amazon:Amazon,AWS,Bedrock,SageMaker,AmazonQ,CodeWhisperer,Titan

\-google:Google,VertexAI,Gemini,DeepMind,GoogleCloudAI

\-microsoft:MicrosoftAzureAI,Copilot,AzureOpenAIService,GitHubCopilot,AzureAIStudio

\(note:"MicrosoftTeams"or"MicrosoftOffice"aloneisNOTanAIvendormention\)

\#data\_ai\_platforms

\-databricks:Databricks

\-snowflake:Snowflake

\-palantir:Palantir

\-ibm:IBM,Watson,WatsonX

\#infrastructure

\-nvidia:NVIDIA

\-arm:Arm

\#ml\_ops\_retrieval

\-huggingface:HuggingFace

\-pinecone:Pinecone

\#enterprise\_ai\_apps

\-salesforce:Salesforce,EinsteinAI

\#uk\_ai\_vendors

\-uk\_ai:Darktrace,Quantexa,Featurespace,FacultyAI,BenevolentAI

\#special\_tags

\-internal:Explicitlystatedin\-house/proprietaryAIdevelopment\.OnlyusethistagifthecompanyexplicitlyimpliesinternaldevelopmentordeploymentofAImodels\.

\-undisclosed:Third\-partyAIvendorclearlymentionedbutthenameisdeliberatelynotmentioned\.

\-open\_source\_model:open\-sourceLLM,opensourcemodel,open\-sourceAImodel

\-other:NamedAIvendornotintheabovelist\(specifyinother\_vendorfield\)\.

\#\#RULES

1\.TagonlyvendorsthatprovideAImodelsorAImodelplatformstothecompany\.

\-Ignorename\-dropsinbios,industrycommentary,orevents\.

\-Ignoregeneralcloud,productivity,orpartnershipmentionswithoutAImodelusage\.

2\.Model\-namementionscountasvendorsignalsevenifthecompanynameisabsent:

\-GPT/ChatGPT:openai

\-Claude:anthropic

\-Gemini/Vertex:google

\-Llama:meta

\-Grok:xai

\-Mixtral:mistral

\-Command:cohere

\-Bedrock/Titan/CodeWhisperer:amazon

\-Watson/WatsonX:ibm

\-EinsteinAI:salesforce

3\.Ifaproductclearlyinvolvestwovendors\(e\.g\.,AzureOpenAIService\),tagbothmicrosoftandopenai\.

4\.IfAIisusedbutthevendorisunnamed,tag"undisclosed"\.

5\.IfthecompanystatesitbuildsAIinternally,tag"internal"\.OnlyusethistagifthecompanyexplicitlyimpliesinternaldevelopmentofAIbasemodels\.

6\.Use"open\_source\_model"whentheexcerptreferstoopen\-sourceLLMswithoutnamingaspecificvendor\.

7\.Use"uk\_ai"foranyofthelistedUKAIvendors\(Darktrace,Quantexa,Featurespace,FacultyAI,BenevolentAI\)\.

\#\#SIGNALGUIDANCE\(integer:1,2,or3\)

Assignasignalstrengthforeachvendorinvendor\_tags:

\-1\(weakimplicit\):Requiresinterpretation

Example:"OurAImodelsarefromacompanythatinventedtheAItransformertechnology"

\-2\(strongimplicit\):Clearlyaboutthisvendorbutnotdirectlystated

Example:"WeareenhancingoperationswithCopilottools"

\-3\(explicit\):Directlyandfactuallyevident

Example:"WedeployedOpenAI’sGPT\-4fordocumentreview"

\#\#EXAMPLES

\-"WedeployedOpenAI’sGPT\-4fordocumentreview\."\-\>vendors:\[\{\{"vendor":"openai","signal":3\}\}\]

\-"WeuseAzureOpenAIServiceforinternalcopilots\."\-\>vendors:\[\{\{"vendor":"microsoft","signal":3\}\},\{\{"vendor":"openai","signal":3\}\}\]

\-"OurteambuiltaproprietaryMLplatformin\-house\."\-\>vendors:\[\{\{"vendor":"internal","signal":3\}\}\]

\-"Weuseathird\-partyAIsolutionforfrauddetection\."\-\>vendors:\[\{\{"vendor":"undisclosed","signal":2\}\}\]

\-"WeuseMicrosoft365forproductivity\."\-\>vendors:\[\]\(notanAIvendormention\)

\-"WeintegratedLlama3intooursearchpipeline\."\-\>vendors:\[\{\{"vendor":"meta","signal":3\}\}\]

\-"Werunanopen\-sourcelargelanguagemodelonourowninfrastructure\."\-\>vendors:\[\{\{"vendor":"open\_source\_model","signal":3\}\}\]

\-"WeuseDarktraceforcyberthreatdetection\."\-\>vendors:\[\{\{"vendor":"uk\_ai","signal":3\}\}\]

\-"WeuseWatsonXtoautomatecomplianceworkflows\."\-\>vendors:\[\{\{"vendor":"ibm","signal":3\}\}\]

\#\#OUTPUTCONSTRAINTS

\-IfnoAIvendor/modelproviderisdetected,vendorsmustbeanemptylist\.Makesuretodothisinthecaseoffalsepositives,wheretheexcerpthasfalselybeenclassifiedashavingAI/AIvendormentions\.

\-Eachentryinvendorsmusthaveavendortagandasignalscore\(1,2,or3\)\.

\-Noduplicatevendortagsinthevendorslist\.

\-Setother\_vendoronlyif"other"isincludedasavendortaginthevendorslist\.

\#\#EXCERPTCONTEXT

Company:\{firm\_name\}\|Sector:\{sector\}\|ReportYear:\{report\_year\}

adoption\_substantiveness:\|

YouareanexpertanalystevaluatingtheinformationdensityofAIadoptiondisclosuresincompanyannualreports\.

\#\#OBJECTIVE

Determinehowmuchactionable,company\-specificinformationanexcerptconveysaboutAIadoption\.

Focusexclusivelyontheadoptioncontent:whatAIisbeingused,how,atwhatscale,andtowhateffect\.

\#\#TASK

Readtheexcerptandassignexactlyonesubstantivenesslevel:boilerplate,moderate,orsubstantive\.

Provideaconfidencescore\(0\.0\-1\.0\)andbriefreasoning\.

\#\#LEVELDEFINITIONS

\#\#\#BOILERPLATE

Genericadoptionlanguagewithnoinformationcontent\.Couldappearinanycompany’sannualreportunchanged\.

Nonamedsystems,nospecificusecases,nooutcomes,noscale\.

Ausefulheuristic:ifyoucouldplacethisstatementinanycompany\(thatmentionsAIadoption\)andthewouldremainequallyfitting,itisboilerplate\.

Examples:

\-"WeleverageAItodriveinnovationandimproveoperationalefficiency\."

\-"WecontinuetoinvestinAItechnologiestoenhanceourcapabilities\."

\-"AIandmachinelearningareincreasinglyusedacrossouroperations\."

\-"WeuseAItoolstosupportouremployees\."

\-"WearecommittedtointegratingAIresponsiblyintoourbusiness\."

\#\#\#MODERATE

Identifiesaspecificusecase,businessfunction,ordomain,butlacksconcretedetail\.

Thereaderlearns\*where\*or\*whattype\*ofAIisbeingused,butnot\*whichsystem\*,\*whatoutcome\*,or\*atwhatscale\*\.

Heuristic:namesadomainorapplication\(underwriting,frauddetection,customerservice,codegeneration\)

butprovidesnosystemnames,nometrics,novendor,andnodeploymentcontext\.

Examples:

\-"WeuseAIinourunderwritingprocesstoimproveriskselection\."

\-"WedeployedAI\-basedfrauddetectionacrossourretailbankingdivision\."

\-"Weuselargelanguagemodelstosummarisedocumentsforouranalysts\."

\-"WearepilotingagenerativeAItoolforcodegeneration\."

\-"AIisusedinoursupplychainplanningtooptimiseinventorylevels\."

\#\#\#SUBSTANTIVE

NamesaspecificAIsystemorvendorANDprovidesdeploymentcontext,concreteusecase,measurableoutcome,

ortechnicaldetailsufficienttodistinguishthiscompany’sAIactivityfromanyother\.

Avendornamealoneisnotsufficient\-thenamedsystemmustbelinkedtoaspecificapplicationoroutcome\.

Heuristic:aknowledgeablereadercoulddescribe\*whatthiscompanyspecificallydoeswithAI\*and\*towhatend\*,

notjustthatitusesAI\.

Examples:

\-"WedeployedGPT\-4viaAzureOpenAIServiceforautomateddocumentreview,reducingprocessingtimeby40%\."

\-"OurproprietaryMLmodelprocesses2\.3Mclaimspermonthwith96%accuracy\."

\-"WeintegratedMicrosoftCopilotacross15,000desktopsinFY2024,with68%weeklyactiveusage\."

\-"Webuiltacomputervisionsystemthatdetectsmanufacturingdefectson12productionlines,reducingscrapratesby18%\."

\-"WeuseaGemini\-basedmodeltogenerateinvestmentresearchsummaries,covering800equitiesweekly\."

\#\#DECISIONRULES

1\.Judgetheadoptioncontentspecifically\.IgnoreriskorgeneralAImentionsthatdonotdescribewhatthecompanydoeswithAI\.

2\.Anamedvendoralone\(e\.g\.,"WeuseMicrosoftCopilot"\)ismoderate\-itneedsaconcreteusecaseoroutcometobesubstantive\.

3\.Aquantifiedoutcomewithoutanamedsystemorclearsystemtypeismoderateatbest\.

4\.NamingasystemANDdescribingwhatitdoesorwhatitachievedissufficientforsubstantive\.

5\.Forward\-lookingplans\("weplantodeployX"\)areonelevelbelowtheirequivalentcurrent\-statedisclosure\.

6\.Multiplemoderate\-leveldetailsinoneexcerptdonotcollectivelyadduptosubstantive;asinglespecificdetaildoes\.

\#\#CONFIDENCEGUIDANCE\(0\.0\-1\.0\)

\-0\.3:theboundarybetweenlevelsisgenuinelyambiguous

\-0\.5:leanstowardonelevelbutcouldreasonablybeanother

\-0\.7:clearlyfitsonelevelwithminorambiguity

\-0\.9\+:unambiguousclassification

\#\#OUTPUTCONSTRAINTS

\-substantivenessmustbeexactlyoneof:boilerplate,moderate,substantive\.

\-confidencemustbeafloatbetween0\.0and1\.0\.

\-reasoningshouldbe1\-2sentencescitingthekeyevidencefortheclassification\.

\#\#EXCERPTCONTEXT

Company:\{firm\_name\}\|Sector:\{sector\}\|ReportYear:\{report\_year\}\|ReportSection:\{report\_section\}

risk\_substantiveness:\|

YouareanexpertanalystevaluatingtheinformationdensityofAIriskdisclosuresincompanyannualreports\.

\#\#OBJECTIVE

Determinehowmuchactionable,company\-specificinformationanexcerptconveysaboutAI\-relatedrisk\.

Focusontwodimensions:howconcretelytheriskmechanismisdescribed,andhowtangiblythecompany

respondstoit\(mitigations,commitments,resources,timelines\)\.

\#\#TASK

Readtheexcerptandassignexactlyonesubstantivenesslevel:boilerplate,moderate,orsubstantive\.

Provideaconfidencescore\(0\.0\-1\.0\)andbriefreasoning\.

\#\#LEVELDEFINITIONS

\#\#\#BOILERPLATE

Genericrisklanguagewithnoinformationcontent\.Couldappearinanycompany’sannualreportunchanged\.

Nospecificriskcategory,nomechanism,nonamedregulation,nomitigationaction\.

Ausefulheuristic:ifyoucouldplacethisstatementinanycompany\(thatmentionsAIadoption\)andthewouldremainequallyfitting,itisboilerplate\.

Examples:

\-"AIposesriskstoourbusinessthatwecontinuetomonitor\."

\-"TherapiddevelopmentofAImaycreaterisksanduncertaintiesforourindustry\."

\-"WerecogniseAIasanemergingriskandhaveestablishedgovernanceframeworks\."

\-"AIpresentsbothopportunitiesandrisksthatweactivelymanage\."

\-"WefacerisksassociatedwithAIadoptionincludingoperationalandreputationalconcerns\."

\#\#\#MODERATE

NamesaspecificAIriskareaormechanism,butprovidesnoconcretemitigation,commitment,budget,

ortimeline\.Thereaderlearns\*whattypeofrisk\*thecompanyfaces,butnot\*whattheyaredoingaboutit\*\.

Heuristic:identifiesariskcategoryornamesaregulation,butthecompanyresponseisabsent,vague,orgeneric\.

Examples:

\-"AIregulation,includingtheEUAIAct,mayaffectourcomplianceobligations\."

\-"WefaceincreasingcybersecurityrisksfromAI\-enabledattacksonoursystems\."

\-"AIcoulddisplaceworkersinoursector,creatingworkforcetransitionchallenges\."

\-"OurAImodelsmayproduceunreliableoutputsthatcouldaffectcreditdecisions\."

\-"DependenceonasmallnumberofAImodelproviderscreatessupplychainconcentrationrisk\."

\#\#\#SUBSTANTIVE

DescribesaspecificAIriskmechanismANDprovidesatleastonetangiblecompanyresponse:anamed

mitigationaction,concretecommitment,allocatedresource,specifictimeline,ormeasurabletarget\.

Bothdimensionsmustbepresent\-mechanismaloneoractionaloneismoderateatbest\.

Heuristic:aknowledgeablereaderunderstandsboth\*whatthespecificriskis\*and\*whatthiscompany

isconcretelydoingaboutit\*,withenoughdetailtodistinguishtheirresponsefromagenericone\.

Examples:

\-"WeallocatedEUR5Mtoreclassify3high\-riskAIsystemsundertheEUAIActbyQ22025\."

\-"InresponsetoAI\-enabledfraud,wedeployedreal\-timetransactionmonitoringacrossallretail

channels,reducingAI\-assistedfraudlossesby23%inFY2024\."

\-"OurAIgovernanceframeworkrequiresmandatorybiasauditsforallmodelsinproduction,

reviewedquarterlybytheRiskCommitteeandreportedtotheBoard\."

\-"Wemappedall47AIsystemsindeploymentagainsttheEUAIActtaxonomyandestablisheda

remediationprogrammeforthe12classifiedashigh\-risk,withBoard\-leveloversight\."

\-"Toaddressmodelreliabilityriskincreditdecisions,weimplementedahuman\-in\-the\-loop

reviewrequirementforallAI\-generateddecisionsaboveGBP50,000inexposure\."

\#\#DECISIONRULES

1\.BothaspecificriskmechanismANDaconcretecompanyresponsearerequiredforsubstantive\.

Mechanismalone\(howeverspecific\)ismoderate\.Responsealonewithoutanamedmechanismismoderate\.

2\.Namedregulations\(EUAIAct,GDPR\)orriskcategoriesalonedonotliftanexcerptabovemoderate\-

thecompanymustdescribewhattheyaredoinginresponse\.

3\."Wemonitor","wecontinuetoassess","weareawareof"\-\>moderateatbest;thesearenotmitigations\.

4\.Genericgovernancelanguage\("wehaveestablishedAIgovernance"\)isboilerplateunlessitnames

aspecificmechanism\(e\.g\.,mandatoryaudits,committeeoversightwithdefinedscope\)\.

5\.Quantifiedoutcomes\(lossreductions,auditcounts,systemcounts,budgets\)arestrongsignalsforsubstantive\.

6\.Forward\-lookingcommitmentswithspecifictargetsortimelinescountassubstantive;

vaguecommitments\("weplantoaddressthis"\)aremoderateatbest\.

\#\#CONFIDENCEGUIDANCE\(0\.0\-1\.0\)

\-0\.3:theboundarybetweenlevelsisgenuinelyambiguous

\-0\.5:leanstowardonelevelbutcouldreasonablybeanother

\-0\.7:clearlyfitsonelevelwithminorambiguity

\-0\.9\+:unambiguousclassification

\#\#OUTPUTCONSTRAINTS

\-substantivenessmustbeexactlyoneof:boilerplate,moderate,substantive\.

\-confidencemustbeafloatbetween0\.0and1\.0\.

\-reasoningshouldbe1\-2sentencescitingthekeyevidencefortheclassification\.

\#\#EXCERPTCONTEXT

Company:\{firm\_name\}\|Sector:\{sector\}\|ReportYear:\{report\_year\}\|ReportSection:\{report\_section\}

vendor\_substantiveness:\|

YouareanexpertanalystevaluatingtheinformationdensityofAIvendordisclosuresincompanyannualreports\.

\#\#OBJECTIVE

Determinehowmuchactionable,company\-specificinformationanexcerptconveysaboutwhichAIvendors

orplatformsthecompanyusesandhow\.

\#\#TASK

Readtheexcerptandassignexactlyonesubstantivenesslevel:boilerplate,moderate,orsubstantive\.

Provideaconfidencescore\(0\.0\-1\.0\)andbriefreasoning\.

\#\#LEVELDEFINITIONS

\#\#\#BOILERPLATE

Nospecificvendororplatformnamed,oronlyagenericreferenceto"AItools","AIproviders",

or"technologypartners"withnofurtherdetail\.Nodeploymentcontext,nousecase,nomodelidentity\.

Ausefulheuristic:ifyoucouldplacethisstatementinanycompany\(thatmentionsAIadoption\)andthewouldremainequallyfitting,itisboilerplate\.

Examples:

\-"WeworkwithleadingAItechnologyproviders\."

\-"WeuseAItoolsprovidedbyourtechnologypartners\."

\-"Weleveragethird\-partyAIcapabilitiesacrossourbusiness\."

\-"WesourceAIcapabilitiesfromexternalvendorstosupportouroperations\."

\#\#\#MODERATE

Namesaspecificvendor,model,orplatform,butprovidesnodetailaboutwhattheAIisusedfor,

atwhatscale,ortowhateffect\.Thereaderlearns\*whichvendor\*butnot\*whatisdonewithit\*\.

Heuristic:vendoridentityisclear,butthedeploymentisopaque\.

Examples:

\-"WeuseMicrosoftCopilot\."

\-"OurteamhasaccesstoChatGPTforday\-to\-daytasks\."

\-"WepartnerwithGoogleforAIcapabilities\."

\-"WeuseAWSAIservicesacrossourcloudoperations\."

\-"WehaveintegratedAnthropic’sClaudeintoourworkflows\."

\#\#\#SUBSTANTIVE

NamesaspecificvendorormodelANDdescribestheconcreteusecase,deploymentcontext,scale,oroutcome\.

Thereaderlearnsboth\*whichAI\*and\*whatitdoes\*forthiscompanyspecifically\.

Heuristic:aknowledgeablereaderunderstandswhatthisvendor’sAIdoesinthiscompany’sspecificcontext\.

Examples:

\-"WedeployedOpenAI’sGPT\-4forautomatedcontractreview,reducingreviewtimeby60%\."

\-"WeuseAzureOpenAIServicetopoweraninternalCopilotusedby8,000employeesfordocumentsummarisation\."

\-"WeintegratedGoogleVertexAIintoourclaimstriageworkflow,processing50,000claimsmonthly\."

\-"OurproprietaryLLM,builtonMeta’sLlamaarchitecture,powersourclient\-facingchatbothandling200,000queriesperday\."

\-"WeuseAWSBedrocktoserveourin\-houseunderwritingmodels,with99\.9%uptimeSLA\."

\#\#DECISIONRULES

1\.Judgethevendordisclosurespecifically\.Genericadoptionlanguagearounditdoesnotraisethelevel\.

2\.Avendorormodelnamealone,withoutusecaseordeploymentdetail,ismoderate\.

3\.Aconcreteusecasewithoutanamedvendorisboilerplate\-vendoridentityiswhatthisclassifiermeasures\.

4\.Namingamodel\(e\.g\.,GPT\-4,Gemini,Claude\)countsasidentifyingbothvendorandsystem;stillneedsausecaseforsubstantive\.

5\.Anundisclosedthird\-partyvendorwithaconcreteusecaseismoderate,notsubstantive\-vendoridentitymatters\.

6\.Multiplevendormentionscanlifttheleveliftheycollectivelyestablishbothidentityanddeploymentcontext\.

\#\#CONFIDENCEGUIDANCE\(0\.0\-1\.0\)

\-0\.3:theboundarybetweenlevelsisgenuinelyambiguous

\-0\.5:leanstowardonelevelbutcouldreasonablybeanother

\-0\.7:clearlyfitsonelevelwithminorambiguity

\-0\.9\+:unambiguousclassification

\#\#OUTPUTCONSTRAINTS

\-substantivenessmustbeexactlyoneof:boilerplate,moderate,substantive\.

\-confidencemustbeafloatbetween0\.0and1\.0\.

\-reasoningshouldbe1\-2sentencescitingthekeyevidencefortheclassification\.

\#\#EXCERPTCONTEXT

Company:\{firm\_name\}\|Sector:\{sector\}\|ReportYear:\{report\_year\}\|ReportSection:\{report\_section\}

## Appendix HRisk Category Definitions

The Stage 2 risk classifier maps each AI risk mention to one or more of the following ten categories\. Categories are non\-mutually exclusive: a single passage can be tagged under multiple categories where appropriate\.

- •Strategic/Competitive\.AI as a source of competitive disruption, market displacement, or strategic obsolescence \(e\.g\., new entrants leveraging AI, business\-model erosion, loss of differentiation\)\.
- •Cybersecurity\.AI\-enabled attacks \(phishing, deepfake\-driven social engineering, AI\-accelerated fraud\) and adversarial attacks against the company’s own AI systems \(prompt injection, model evasion, data poisoning\)\.
- •Operational/Technical\.Failures or limitations of AI systems in production: model errors, hallucinations, accuracy degradation, integration failures, or unreliable outputs affecting business operations\.
- •Regulatory/Compliance\.Exposure to AI\-specific regulation \(e\.g\., the EU AI Act, UK AI regulatory frameworks\) or to existing regimes as applied to AI use, including legal liability arising from AI\-driven decisions\.
- •Reputational/Ethical\.Harms to brand or stakeholder trust arising from biased, unfair, or ethically contested AI use, including discrimination, lack of transparency, and concerns over consent\.
- •Third\-Party/Supply Chain\.Dependency on external AI vendors, foundation\-model providers, or AI\-enabled suppliers; concentration risk, vendor lock\-in, and propagation of upstream failures\.
- •Information Integrity\.AI\-generated misinformation, deepfakes, synthetic media, and threats to the authenticity or provenance of information consumed or produced by the company\.
- •Workforce Impacts\.Job displacement, skills obsolescence, retraining needs, employee adoption challenges, or morale and cultural effects arising from AI deployment\.
- •Environmental Impact\.Energy consumption, carbon footprint, water use, and other environmental externalities of training or operating AI systems\.
- •National Security\.Geopolitical, dual\-use, or state\-actor\-related AI risks, including export controls, foreign adversary access, and AI in critical national infrastructure contexts\.

## Appendix IRisk Taxonomy Validation

To test whether the fixed ten\-category risk taxonomy captures the variety of AI risks appearing in annual reports, we ran an open\-taxonomy classification on 100 AI risk mentions drawn from the risk\-labeled passages of the human\-annotated validation set \([Section3\.4](https://arxiv.org/html/2610.02281#S3.SS4)\)\. The model was instructed to assign free\-form risk labels in snake\_case without reference to any predefined categories, using the same attribution framework and signal scoring as the fixed\-taxonomy classifier\.

Of 100 mentions, 96 were successfully classified \(4 failures due to malformed output\)\. The classifier produced 107 distinct emergent labels\. Many were near\-duplicates or minor wording variants \(e\.g\.,ai\_fraud\_exposurevs\.genai\_fraud\_risk\)\. After manual consolidation, the labels collapsed into eight broad themes: regulatory/compliance, cybersecurity/fraud, strategic competition, data governance, model ethics, reputational harm, workforce effects, and third\-party dependence\. Six of these correspond directly to fixed categories; data governance and model ethics do not map one\-to\-one but sit closest to Regulatory/Compliance and Reputational/Ethical respectively\. Four fixed categories \(Operational/Technical, Information Integrity, Environmental Impact, and National Security\) did not arise as emergent themes in this 96\-passage sample\. No residual group suggested a missing category\.

This result suggests that the fixed ten\-category taxonomy does not omit any major AI risk theme present in the sample, although it does not independently validate the four categories absent from it\. It also shows that an open\-taxonomy approach, while useful as a validation check, produces many near\-duplicate labels \(107 labels for 96 mentions\) that would make longitudinal tracking impractical without further consolidation\.