Skip to main content
Compliance Risk After SEC Warning Against ‘AI Washing’
By any measure, 2023 was a breakout year for generative artificial intelligence, with businesses of every kind racing to adopt AI tools.
As a result, regulators are keeping pace, and firms’ use of AI – including the way public companies disclose the way they use AI use to the public – is likely to become an enforcement priority in 2024 and beyond. Companies and their compliance programs must take steps now to avoid costly regulatory sanctions and shareholder lawsuits.
Although the growth of generative AI has been at least a decade in the making, it has only become part of the public vernacular in the past year. Indeed, it can be difficult to believe that one of the most well-known tools, ChatGPT, launched barely more than a year ago, in November of 2022.
Not surprisingly, last year’s growth has found its way to the boardroom: A review of annual and quarterly reports filed with the US Securities and Exchange Commission in 2023 shows a 42% year-over-year increase in the occurrence of the term “artificial intelligence.”
Likewise, a recent survey by McKinsey, which polled a range of business organizations, shows that a third of all respondents are already using AI regularly in at least one function, while 40% expect increased AI investment going forward. Only a quarter of the nearly 1,700 respondents, however, said their company was working to mitigate risks related to AI regulatory compliance.[1]
AI Is the New Green
Regulators are taking notice of this apparent lack of self-regulation. For example, recent comments by SEC Chair Gary Gensler suggest the regulator is primed to begin turning its enforcement efforts against “AI washing,” presenting a new area of risk for some companies that are embracing AI technology.
Speaking at the Messenger AI Summit in Washington, DC, on December 5, Gensler cautioned reporting companies not to “AI wash,” comparing it to the practice of “greenwashing,” where a company’s environmental or sustainability related statements are inflated, misleading or false. Greenwashing has been a recent focus of SEC enforcement actions, and the commission’s Climate and ESG Task Force has brought several actions arising out of alleged ESG and climate-related misconduct.[2]
Shareholder lawsuits have also alleged greenwashing, such as in Perri v. Croskrey, a derivative suit filed in the US District Court for the District of Delaware in 2021 by the shareholders of Danimer Scientific Inc. who claimed that the company had overstated sustainability claims.[3] Numerous other consumer class action complaints have been filed related to greenwashing, including against Keurig Green Mountain, Inc., 7-Eleven, and H&M, among others.
AI washing can also be compared to the recent trend of “cloud washing,” where, during the rapid rise of cloud-based products and services, companies promoted products as “cloud-based” when they were merely delivered over the internet and did not truly fit the characteristics of cloud computing.
Emphasizing that securities laws require “full, fair and truthful” disclosures, Gensler warned “don't do it,” reiterating that “One shouldn't greenwash, and one shouldn't AI wash. I don't know how else to say it,” he said.
Many “AI” Products Are Mischaracterized
AI washing may occur when a company misleads investors regarding its true AI capabilities. According to Gensler, misleading investors as to artificial intelligence is governed by the same “set of basic laws, but also the same basic concept” as misleading the public on other topics.[4] Indeed, “AI” as a term embraces many iterations of the technology, and a business may promote itself as leveraging AI, even when only a small amount of AI – or almost no AI at all.
A recent TechTarget article recently noted that “AI-washing is rampant,” and that “AI vendors are able to get away with these exaggerations because artificial intelligence is such a large umbrella term.”[5]
As one example, The Wall Street Journal reported in 2019 that employees of engineer.ai – a startup that said it used AI to automate the development of mobile applications – came forward with allegations that the company had exaggerated its AI capabilities to attract investors and customers. According to those employees, instead of AI the company relied upon human engineers to do most of the work.[6]
Given generative AI’s nascent stage, and potential ambiguity in the term “artificial intelligence,” it is not difficult to see how companies could find themselves in regulatory crosshairs for overstating, or misstating, their AI capabilities.
In this regard, technology generally qualifies as AI only if it exhibits some level of learning, adapting, and autonomy. Technologies providing advanced automation and statistics analysis are not necessarily considered AI.
For example, while chatbots have become ubiquitous on consumer-facing websites, such technology generally is not AI but consists of automated preprogrammed answers in response to common questions. Similarly, targeted online advertising is not AI, but merely utilizes an algorithm to analyze online search queries to generate matching ads.
Gensler pointed to this very issue during his December 5 remarks, stressing the gap between what companies promise regarding their AI capabilities versus what they are capable of implementing in their products and services.
Enforcement Risk Beyond AI Washing
Public disclosures and AI washing aside, the SEC is also targeting investment advisers, and is in the process of conducting so-called sweep examinations requesting, among other things, a description of AI models used by the advisers, copies of written supervisory policies and procedures related to AI, and any AI-related security measures.
And, of course, the SEC is not alone. While Congress is not likely to pass any national AI regulation soon – unlike the European Union, which recently announced agreement on its comprehensive AI Act that implements transparency obligations and other protections – AI enforcement in the US is likely to be accomplished with existing regulatory regimes, much in the same way enforcement agencies are currently regulating the cryptocurrency industry.
To be sure, in October, President Biden issued an executive order on AI, directing federal agencies to promulgate standards and guidelines, warning the “[u]se of new technologies, such as AI, does not excuse organizations from their legal obligations, and hard-won consumer protections are more important than ever in moments of technological change.”[7]
Regulatory agencies have already begun this work. For example, in June the Commodity Futures Trading Commission announced a Cybersecurity and Emerging Technologies Task Force, intended to address the role that AI and machine learning may play in violations of the Commodity Exchange Act and CFTC regulations. Similarly, in November the Federal Trade Commission authorized the use of compulsory process in nonpublic investigations involving products or services that use – or claim to use – AI.
Needless to say, as the use of AI continues to expand, so too will agencies’ enforcement efforts. To avoid potential enforcement actions, as well as shareholder actions that often follow, companies should take precautions to ensure compliance with existing AI regulatory frameworks, and should confirm their public statements, including formal disclosures, regarding their AI capabilities are accurate and not misleading.
As with all reporting, the best defense against future litigation and investigation related to AI disclosures is a robust compliance program with controls for reporting and verification to ensure that all public statements are accurate and not misleading.
[1] The state of AI in 2023: Generative AI’s breakout year. (2023, August 1). McKinsey & Company. https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-in-2023-generative-ais-breakout-year#/.
[2] SEC.gov | Enforcement Task Force Focused on Climate and ESG Issues. (2022, April 8). https://www.sec.gov/securities-topics/enforcement-task-force-focused-climate-esg-issues.
[3] Perri v. Croskrey, et al., D. Del., Case No. 1:21-cv-01423.
[4] “SEC Chair Warns Businesses Against AI Washing: ‘Don’t Do It,’” https://www.law360.com/articles/1773759.
[5]“FTC wants vendors to stop lying about ‘AI-powered’ products,” https://www.techtarget.com/searchenterpriseai/news/365531869/FTC-wants-vendors-to-stop-lying-about-AI-powered-products.
[6] Purnell, N., & Olson, P. (2019, August 14). AI startup boom raises questions of exaggerated tech savvy. WSJ. https://www.wsj.com/articles/ai-startup-boom-raises-questions-of-exaggerated-tech-savvy-11565775004.
[7] See E.O. 14110 of Oct. 30, 2023.