If we are honest with ourselves, we recognize that drafting SEC-mandated disclosure for public companies rarely involves sitting down with the proverbial blank sheet of paper and writing out a complete CD&A, for example. Rather, as my old friend Marty Dunn used to say: “Life is a markup of last year.” If we were to draft disclosure from scratch, it might yield a more insightful end product, but doing so is typically cost prohibitive from a company’s perspective, both in terms of time spent by company employees and hours billed by outside counsel. But what if that drafting could be done by a computer, based on careful prompting by an employee or outside counsel, whereby the costs of producing the disclosure moves toward zero? Such is the world that we have now entered with the advent of highly sophisticated agentic artificial intelligence capabilities.
We have now entered the age of agentic AI systems, which utilize machine learning models that mimic human decision-making to solve problems and carry out specific tasks. These models have “agency’ because, once they are created and launched, they can act independently and with a purpose, without the need for human oversight. Based on this description, one can no doubt see how agentic AI models can be particularly helpful when drafting disclosure in a proxy statement on an annual report. Based on the specific instructions provided to the model by a human, the agent could be tasked with drafting some or all of the proxy statement after reviewing proxy statements filed by the company and selected peer companies, analyzing pertinent information regarding the proposals provided by the company, reviewing applicable SEC rules and interpretations, analyzing proxy voting guidelines of institutional investors and proxy advisory firms, and reviewing any other inputs that the agent is directed to consider. In many ways, the process that the AI agent follows is analogous to the process that a human drafter might undertake when tasked with updating or drafting a proxy statement, except that the AI agent has a much more capacity to review and synthesis large amounts of data in much shorter periods of time than could be done by its human counterpart. In the cost-conscious corporate world that we operate in today, one can see how this agentic AI approach represents a viable drafting alternative.
As we all know, AI is not without its flaws. We are all familiar with the “GIGO” principle, with those letters standing for “Garbage In, Garbage Out.” Coined in the early days of computer programming, the principle contemplates that the output from a computer system is entirely dependent on the quality of the inputs, such that flaws in those initial inputs will always lead to flawed outputs. This concept that has been a staple of the programming world equally applies in the realm of AI. While agentic AI models have capabilities for reinforcement learning and self-supervised learning to improve their knowledge and performance, they are generally only able to operate as effectively as their human users permit them to operate through the prompts that direct their actions. Further, a particularly vexing concern with the use of any AI model is the possibility of hallucinations. The term “hallucinations” in the context of AI refers to situations where an AI model produces inaccurate, false and/or misleading information for a variety of reasons. The problem of hallucinations is particularly evident in large language models, where the model will insert factually incorrect information in an effort to predict what should be said (or what the human user wants the model to say), particularly in a situation where the model faces some uncertainty as to the outcome.
If you are planning to jump into the deep end of the pool and ask your AI agent to draft your proxy statement for the 2027 proxy season, here are a few suggestions to consider:
1. The use of AI is often an iterative process. You cannot expect a sophisticated AI model to spit out a fully-formed proxy statement without first spending a lot of time teaching the model about proxy statements and the materials that it should draw on to draft that proxy statement. Veteran users of AI models often note that developing prompts requires a great deal of advanced work, drawing on sophisticated human knowledge and experience.
2. Companies should be careful to avoid the GIGO principle. AI-generated materials will not be useful unless sufficient information is provided to the AI-model, and, even then, the information and instructions provided to the AI model may not be sufficient to avoid hallucinations and other data quality problems with the AI output.
3. One of the often-cited ways for trying to limit the risk of hallucinations is through more effective prompts. By making these prompts less open-ended and more specific, a user can seek to better control the way in which the AI model carries out its task. Another approach would be to instruct the AI model to base its response of specific, verifiable sources, rather than giving the model free reign to go out and find sources from the vast expanse of the Internet. Yet another approach is supplying the relevant information directly to the model, rather than allowing the model to rely on its own data that is has used to train itself. In this instance, because the model’s response is limited to the retrieved data, it reduces the need to fill in missing pieces of the puzzle with false or misleading information. Finally, it may be possible to limit the risk of hallucinations by strictly limiting the format and structure of the information that the model provides based on the user’s prompts, thereby discouraging the model from trying to fill in blanks with made-up content.
4. The human touch remains essential (at least for now), especially when making sure that the output from the AI-model is “ready for prime time.” Any AI-drafted proxy statement or other shareholder communication requires very close review and verification by humans, so as to avoid embarrassing missteps or non-compliant materials. Human reviewers should always be focused on the tone of the document, the continuity and accuracy of the information presented, and the possibility of hallucinations.
5. When writing disclosure for analysis by AI models, the company should take steps to communicate all important information in a machine-readable format, while emphasizing consistency and clarity throughout the document. Terminology should also be standardized and the disclosure should be scrubbed for contradictory and duplicative statements. Companies should consider retaining their stylized proxy statement formats for those investors who are not utilizing AI to analyze the proxy statement, particularly in situations where a company has a large retail shareholder base.
Whether or not you use AI to assist with drafting your proxy statement, annual report or other SEC-required documents, an important question to ask now more than ever is: “Who is actually reading these documents?” The answer to that question may be surprising, and it could influence the approach that a company takes when presenting the required and additional information included in the document.
In more recent years, technology has played an increasingly important part of the shareholders’ playbook when it comes to conducting the analysis necessary to make informed voting decisions. For some time now, we have observed that proxy advisory firms have effectively leveraged technology to conduct an analysis of a company’s compensation and governance practices relative to proxy voting guidelines, and institutional investors have been increasingly doing the same. With the rapid development of AI models, we are now observing significant changes in the approach that asset managers take to their stewardship efforts.
Earlier this year, JPMorgan Chase announced that JPMorgan Asset Management will no longer rely on outside proxy advisory firms when evaluating proxy statements and determining how to vote on proposals at portfolio company annual meetings, and instead, the asset manager will use an internally developed artificial intelligence platform, called Proxy IQ, to assist with making voting decisions. Soon after JPMorgan’s announcement, Wells Fargo’s Wealth & Investment Management announced that it had launched its own internal proxy voting service and would no longer utilize ISS for its voting recommendations. These announcements likely represent the start of a significant new trend, as it becomes increasingly possible for asset managers to deploy highly sophisticated AI-powered analytical technologies on a more cost-effective basis than utilizing the services of a proxy advisory firm.
An important consideration in all of this is that computers do not read in the same manner as humans. Humans are often prone to considering things visually, thus encouraging the presentation of information in charts and graphs. Computers, on the other hand, are focused on synthesizing all of the proxy statement text into a series of ones and zeros that the computer can readily process. As the analytical technology utilized by proxy advisory firms and investors has increasingly migrated to AI-based models, now more than ever it is important that the proxy statement and other documents be presented in a machine-understandable format, so that no important information is lost in translation. For this purpose, it is not necessary to completely abandon the stylized proxy statement format that is de rigueur today, but it is important to now include any of the data and other information that is presented in those charts, graphs or images that are not machine readable. Further, it may now be a good time to consider the overall structure and presentation of the proxy statement, to ensure that information is presented clearly and in a logical manner that would facilitate analysis and interpretation by an AI model. It is also helpful to identify and correct any internal inconsistencies in the proxy statement that could require the AI model to determine which information is accurate.
This DFIN blog from earlier this year offers several tips ensuring that your disclosures are ready for AI synthesis:
– Standardize terminology across filings, including narrative sections and investor communications.
– Improve document hierarchy and headings.
– Confirm that your Inline XBRL tagging is accurate.
– Align language and messaging on investor relations websites with SEC filings.
– Clearly structure risk factors.
– Ensure executive biographies are consistent across filings and investor communications.
– Create ESG metrics that are measurable and comparable.
– Reduce duplicative statements to avoid overcounting.
– Revise contradictory statements for greater clarity and accuracy.
While it might be a little creepy to think that we have entered an era where machines write disclosure that is then analyzed by other machines, that is where we are, whether you like it or not. Because these considerations can make a difference for outcomes in the upcoming proxy season, now is the time to focus on your disclosure approach. For more AI coverage, be sure to check out our “Artificial Intelligence” Practice Area.
For our latest Timely Takes podcast, Meredith was joined by Julie Marlowe, Assistant Director of the Office of Data Standards and Innovation in the Division of Economic and Risk Analysis at the SEC. In this 20-minute podcast that is available to all, they discussed:
1. Introduction to the Office of Data Standards and Innovation: What it does and how it’s staffed
2. The many use cases for machine-understandable data within the SEC
3. How the Office of Data Standards and Innovation engages with investors
4. How investors and analysts access and use machine-understandable data and the popularity of the SEC’s public datasets
5. Other disclosures and data points investors would like to see made machine-understandable
6. How the use of machine-understandable data is evolving with the adoption of SI
7. Improving quality and accuracy: Common tagging errors and inappropriate tagging practices
8. Best practices for validating XBRL tags
9. How the SEC Staff engages with companies on tagging issues
If you’re interested in sharing your insights on a topic that you think would likely be of interest to members of TheCorporateCounsel.net or our other sites, we’d love to hear from you. You know where to find us!
Yesterday, the Office of Chief Counsel in the SEC’s Division of Corporation Finance issued a no-action letter to Sumisho Air Lease Corporation, revisiting the Lamar Advertising no-action letter from 30 years ago by addressing the Form S-3 eligibility of a company that was subject to reporting requirements of Exchange Act Section 15(d), but had its Section 15(d) obligation suspended for a brief period of three months, thereby making the issuer not “subject to” the reporting requirements of Exchange Act Section 13(a) or 15(d) for a portion of the 12-month period specified in General Instruction I.A.3 of Form S-3. In its response, the Staff notes:
Based on the facts and representations in your letter, the Division will not object if Sumisho Air Lease Corporation (the “Company”) determines that its Exchange Act reporting complies with General Instruction I.A.3 of Form S-3, notwithstanding that it may not have been “subject to” the reporting requirements of Exchange Act Section 13(a) or 15(d) for a portion of the 12-month period specified in the instruction. In reaching this position, we note in particular your representation that, during the Voluntary Reporting Period (as defined in your letter), the Company will file all Exchange Act reports that otherwise would be required to be filed pursuant to Exchange Act Section 15(d).
In Lamar Advertising, the Staff had previously addressed Form S-3 eligibility where an issuer maintained a continuous Exchange Act reporting record, but was not subject to mandatory reporting for a portion of the preceding twelve months, in the circumstances where: (i) the Section 15(d) suspension arose automatically by operation of Section 15(d), not through any affirmative act by the issuer; (ii) no Form 15 was filed; (iii) the issuer was contractually obligated throughout the voluntary reporting period to file all Exchange Act reports that would otherwise have been required under Section 15(d), and in fact filed those reports; and (iv) upon the effectiveness of its IPO registration statement and its concurrent Section 12(g) registration, the issuer once again became subject to the requirements of Section 13(a) or 15(d) and timely filed all required reports. In its no-action request, Sumisho Air Lease Corporation argued that it’s circumstances were substantially similar to the facts and circumstances identified in Lamar Advertising.
Earlier this month, the California Office of Administrative Law approved CARB’s initial regulations implementing the greenhouse gas emissions reporting and climate-related financial risk disclosure laws. As Zach recently noted on the PracticalESG blog, companies will now have until November 10, 2026 to submit reports covering their Scope 1 and 2 emissions. The blog includes this passage from a Morgan Lewis memo:
The California Office of Administrative Law approved the California Air Resources Board’s initial regulations implementing the state’s corporate greenhouse gas emissions reporting and climate-related financial risk disclosure laws on October 12, making the regulations immediately effective. The approval completes the administrative review process and formally establishes November 10, 2026 as the first-year reporting deadline under Senate Bill 253. Covered companies are subject to the initial Scope 1 and Scope 2 emissions reporting requirements by that date, consistent with CARB’s first-year reporting guidance.
Zach also notes:
California regulators have indicated that first-year reporting will be lightly scrutinized. The California Air Resources Board (CARB) is looking for companies to make good-faith efforts to comply. Alternatively, 2027 may be a different story. CARB has indicated that new reporting rules are coming. 2027’s rules are expected to introduce more stringent requirements, which will bolster reporting quality and increase compliance complexity.
SB 253’s companion law, SB 261, will require climate-related financial disclosures in addition to GHG metrics. SB 261 is currently enjoined by the Ninth Circuit Court of Appeals. The Court’s Opinion is still pending after oral arguments were heard over ten months ago. SB 261 reporting was originally slated to begin alongside SB 253, meaning that 2027 could see SB 261’s requirements reintroduced depending on litigation timelines and outcomes.
At the federal level, the SEC has not yet taken any action on its proposed rescission of the agency’s climate disclosure rules. Earlier this month, certain members of the House Financial Services Committee submitted a letter to the Commission expressing strong opposition to the SEC’s proposal.
With eight “blockbuster” rulemaking proposals issued since May that will modernize and overhaul public company compliance obligations, a number of non-proposal requests for comment that preview potential proposals to come, new or revised CFIs too numerous to count that tackle much more than cleanup, novel no-action letters and the lack thereof, the SEC is certainly keeping us on our toes. I think it’s safe to say that we’ll see some of these major proposals advanced to final rules and some new proposals, including executive compensation disclosure reform (still on OIRA’s dashboard), approved in 2027, if not in the last few months of 2026. Public companies are also navigating new risks and opportunities from extended trading hours, tokenization, prediction markets, increasingly divergent investor views, the use of AI/SI by investors and public companies themselves and a macroeconomic environment that presents new challenges every quarter.
If we’re a part of how you keep up with the breakneck pace of regulatory and market developments, thank you! We consider it our responsibility to inform you of developments and share wisdom from the top practitioners in our field to help you think through the practical implications of all these developments on you and your clients. (And we try to have some fun while doing it!) We hope our blogs are part of your daily routine and that our handbooks, checklists, podcasts, webcasts and Q&A forums are so useful that they’re also a regular part of your workday.
If you’re a member of TheCorporateCounsel.net and your membership runs on the calendar year, you may need to take action soon to keep the insights coming. You or someone else at your company or firm should have recently received a renewal notice by email. If that’s not you, you may still want to make sure your knowledge management team (or whoever else is responsible for renewing) knows what resources you can’t live without.
If you need help renewing, reach out to us at 1-800-737-1271 or Info@CCRcorp.com. We appreciate your business! Thank You!
In the month since I last wrote about prediction markets, the CFTC has proposed to further define the term “swap” to include event contracts, including those based on sports, politics, cultural, and weather-related events. The CFTC’s announcement of the proposal notes that “these contracts are financial instruments that are commonly known to the trade as swaps and proposes to resolve any ambiguity regarding these contracts.” At the same time, the CFTC issued an interim final rule codifying the agency’s longstanding position that gambling products (e.g., bingo games, lotteries and sportsbook and casino gambling), are excluded from the definition of “swap.” As the Mayer Brown Free writings + Perspectives blog notes:
Taken together, the Interim Final Rule and the [Notice of Proposed Rulemaking] represent a coordinated effort to distinguish state-regulated gambling from federally regulated event contracts and to remove the argument that treating event contracts as swaps would federalize every sportsbook wager. The releases are the latest in a series of CFTC actions affecting the prediction markets, including the June 2026 proposed rulemaking discussed in our prior post.
The CFTC itself is under scrutiny for its workforce reductions, with NPR recently reporting that the agency’s staffing is down 21% by the end of 2025. The article notes that the Government Accountability Office is currently investigating the staffing reduction at the CFTC, after Senator Elizabeth Warren called for an investigation into the agency’s staffing and reduction in enforcement actions back in July.
If you found yourself in a pumpkin patch during this past weekend, I hope that you spent a few minutes reflecting on the fact that Cybersecurity Awareness Month is quickly slipping away. For all who celebrate, Cybersecurity Awareness Month is “a global initiative every October that raises awareness about online safety and empowers individuals and businesses to protect themselves from cybercrime.” According to the National Cybersecurity Alliance (NCA) and Cybersecurity and Infrastructure Security Agency (CISA), this year’s theme for Cybersecurity Awareness Month is “Don’t Make it Easy for Them.” The NCA notes:
Staying safe online isn’t about making one perfect decision. It’s about building habits and repeating them consistently in the small moments that happen every day. In doing this, we can all make life difficult for cybercriminals.
Small actions make a big difference. We recommend starting with four easy steps anyone can take to boost their online safety:
• Use strong passwords and a password manager
• Turn on multifactor authentication
• Recognize and report scams
• Update your software
According CrowdStrike’s 2026 Global Threat Report, cybersecurity awareness is more important than ever as we enter the “the age of the AI adversary.” CrowdStrike notes:
The world is operating in the agentic era. Artificial intelligence is embedded across the modern enterprise. Agents write code, analyze data, orchestrate workflows, and make decisions at machine speed. Every layer of the enterprise is becoming faster and more automated. The adversary is operating in the agentic era as well.
In 2025, AI-enabled adversaries increased attacks by 89% year-over-year. AI accelerated phishing and automated reconnaissance, shortening the time from initial access to impact. It elevated less sophisticated threat actors and amplified the most advanced ones. It compressed the time between intent and execution.
AI has also introduced a new dimension of risk: adversaries targeting the very AI systems underpinning the modern enterprise. As AI is embedded into development pipelines, SaaS platforms, and operational workflows, AI systems themselves become part of the attack surface. Adversaries exploited legitimate AI tools by injecting malicious prompts that generated unauthorized commands. As innovation accelerates, exploitation follows. Security must parallel the slope of innovation. In the agentic era, cybersecurity is the foundational infrastructure required to protect AI itself.
Come to think of it, after reading CrowdStrike’s 2026 Global Threat Report, I might just head back to the pumpkin patch and hide out there for a while!
Despite the thoughtful guidance from NCA and CISA for Cybersecurity Awareness Month, all of the password changes and multifactor authentications in the world are not going to help when the agentic AI hackers are attacking the backbone of the internet. Last week, the creators of PHP – which is a programming language used by up to 70% of the internet – released security patches for what this WSJ article describes as “one of the most severe online bugs ever.”
Companies, governments and other organizations have been in a race to patch their websites since the vulnerabilities have been announced, given the threat that AI agents can move with lighting speed and precision in targeting known (and unknown) vulnerabilities. As the WSJ article notes, some website operators (including national governments) simply shut down their websites last week, rather than run the risk of being hacked.
In the “you can’t make this stuff up” category, this Techzine article notes that the PHP Foundation which provides critical infrastructure for approximately 70% of all websites is run entirely on donations and has only one full-time employee! The organization’s struggle to raise funds and lack of staffing underscores how fragile our electronic underpinnings can be, making it a target-rich environment for AI and human hackers.
Hunkering down in that pumpkin patch is not looking so bad now!
Yesterday, ISS announced that the comment period on proposed changes to its benchmark voting policies is now open and will run through 5 p.m. ET on November 4, 2026. ISS is seeking input from investors, companies, and other market participants on its proposed voting policy changes for the 2027 proxy season.
Here is a summary of the changes applicable to the U.S. market and all markets globally from the summary section of the request for comments:
Bylaw Amendments – Management Proposals to Ratify Existing Charter or Bylaw Provisions: Clarifies the policy for situations where a management proposal seeking ratification of an existing governance practice or provision addresses the same topic as a shareholder proposal and is used to exclude a shareholder proposal from the meeting ballot.
Executive Compensation – Option Valuation Model: Removes references to ISS’ binomial option pricing model, replacing it with Black-Scholes as the methodology to be used for ISS’ valuation of options to calculate Shareholder Value Transfer (SVT) from 2027.
Climate Board Accountability: A global update to the Climate Board Accountability policy for ISS benchmark policies worldwide, codifying a fully case-by-case approach to this topic for all markets.
Risk Oversight – Cybersecurity and AI: All ISS benchmark policies on director elections globally contain a provision where, under extraordinary circumstances, material failures of risk oversight may be addressed as governance failures or egregious actions through recommendations on director elections. This global change adds cybersecurity and artificial intelligence-related risks to the named examples of possible factors in assessing material failures of risk oversight.
The request for comments then includes marked copies of the policies showing the exact changes proposed plus a more detailed rationale for each change.
The changes applicable to the U.S. market seem pretty light compared to some prior years, and notably, quite a few topics addressed in ISS’s recent survey are not reflected in the proposed policy changes. That’s not particularly surprising for some survey questions that asked a “what if,” assuming pending SEC proposals are finalized as proposed.
ISS expects to release its 2027 benchmark voting policies, which will be effective for shareholder meetings occurring on or after February 1, 2027, in late November or early December.
