AI Risk Disclosures in Annual Reports: What to Include and What Evidence Supports It
An annual report should describe AI-related risks, governance oversight, and risk management practices only to the extent they are material to the business and only in language the organization can substantiate. In practice, that means identifying risk categories (operational, security, legal and regulatory, third-party, and governance oversight), assessing materiality with counsel, and tying every statement to internal records and control evidence such as AI inventories, access controls, policy enforcement logs, and audit trails.
Treat AI disclosure as an evidence problem first
Treat AI disclosure as an evidence-and-controls problem: map each risk category to the records that support the statement. Before drafting, decide which AI risks, governance practices, and controls are material, then confirm that each one can be backed by records the organization can produce.
Disclosure categories and the evidence that supports them
Identify the risk categories that apply to your AI use, and confirm that each can be tied to internal records and control evidence. The categories to consider are:
- Operational
- Security
- Legal and regulatory
- Third-party
- Governance oversight
Aligning language with controls that actually operate
Match draft language to controls that actually operate, and retain the records for each claim.
Evidence to retain for AI-related statements
- A current inventory of AI systems, models, agents, and the tools and data each can access
- Documented ownership and approval records for deployments and material changes
- Access and permission records showing who or what can act, and with what scope
- Policy definitions and logs showing how policies are enforced at runtime
- Audit trails of agent actions, tool calls, and approvals that can be retrieved by date and system
- Governance records such as committee materials, escalation decisions, and incident reviews
Assessing materiality for AI risks
Materiality should be assessed with counsel, with legal and finance input. Evaluate which AI risks and governance practices are significant enough to the business to belong in the annual report, and revisit that judgment as AI use changes.
Where runtime visibility supports disclosure
Several of the records listed above depend on visibility into how AI systems behave in operation: policy enforcement logs, access and permission records, and audit trails of agent actions, tool calls, and approvals. Runtime policy enforcement and audit logging can support the control evidence behind AI governance statements, and make it retrievable by date and system.
From disclosure statement to supporting evidence
The process runs in five stages, and the last one repeats each reporting cycle.
| Stage | What to do |
|---|---|
| 1. Identify | Inventory AI systems and agents and the risks each one creates. |
| 2. Assess | Evaluate materiality with legal and finance input. |
| 3. Align | Match draft language to controls that actually operate. |
| 4. Evidence | Retain logs, approvals, and review records for each claim. |
| 5. Review | Re-test statements each reporting cycle as AI use changes. |
Build disclosure on evidence you can produce
Talk with Trussed AI about how runtime policy enforcement and audit logging can support the control evidence behind your AI governance statements.
Talk to an Expert