MIT researchers reviewed annual reports, AI policies, and other public documents published by early 2026 and estimated the share at 62% for the 1,000 largest.
Researchers at MIT Sloan School of Management and MIT FutureTech found that 32% of the world’s 100 largest companies had not publicly acknowledged a single AI risk. In a working paper, they estimated the share at 62% for the 1,000 largest companies.
The companies that did disclose AI risks mostly named risks to their own operations, such as discrimination and fraud. They rarely named the risks experts consider most severe.
The researchers said investors and regulators can’t tell which companies manage AI risk well, so they proposed standard AI risk reporting for every large company. The proposal has no legal force.
Key Takeaways
- On average, each of the 100 largest companies named fewer than 3 of the 24 AI risk categories in MIT’s public risk database.
- Discrimination by AI was the risk named most, by 41% of the 100.
- None of the 100 named two of the most severe risks: power concentrating in whoever controls AI, and competition pushing AI developers to cut corners on safety.
- 71 of the 100 described steps to reduce AI risk, but most didn’t say which risk a step addressed.
Discrimination and cyberattacks topped the risks companies named
The researchers checked each company’s documents against MIT’s public database of 24 AI risk categories. Five risks came up most often among the 100 largest companies:
- 41% reported discrimination by AI against people based on race, gender, or other traits.
- AI used for cyberattacks or weapons: 35%
- AI used for fraud and scams: 29%
- AI leaking or exposing personal data: 26%
- AI reducing the value of human creative work: 25%
None of the 100 named two of the most severe risks
MIT’s database doesn’t rank the 24 risk categories. An earlier survey by the same MIT team asked 272 AI risk experts to rank them by how much harm each could cause by 2030. Apart from cyberattacks, the top five most severe risks rarely came up among the 100 largest companies:
- AI used for cyberattacks or weapons: 35%
- AI spreading false information: 16%
- AI gaining abilities that could cause mass harm, such as hacking or copying itself: 4%
- AI concentrating power in the companies or governments that control it: 0%
- Competition pushing AI developers and governments to cut corners on safety: 0%
The researchers said companies also rarely named two other severe risks:
- AI acting against the goals of the people who build or use it: 2%
- AI agents interacting in ways that cause cascading failures or new security holes: 1%
Peter Slattery, a research scientist at MIT FutureTech and a co-author, said companies “are mostly disclosing the risks that affect their operations, like discrimination and fraud.”
Companies rarely disclosed their industry’s top AI risks
The same experts also rated how exposed each industry is to each risk. For example, they judged finance companies vulnerable to AI-enabled fraud.
The new MIT report then checked the experts’ industry ratings against what companies actually disclosed. Companies disclosed the risks their industry was rated most exposed to only 23% of the time. The MIT researchers recommend asking companies to report on the AI risks their own industry faces most.
General-purpose AI developers rarely named their top responsibility
The experts rated public companies that build general-purpose AI models, such as Alphabet, Meta, and Alibaba, as most responsible for one risk: AI acting against the goals of the people who build or use it.
In the new MIT report, only two of the 13 public companies building general-purpose AI models disclosed this risk. Eleven disclosed discrimination as a risk.
Companies rarely tied safeguards to specific risks
71 of the 100 largest companies described at least one step to reduce AI risk. Most didn’t say which risk a step addressed. The researchers said that without that link, outsiders can’t judge whether a step addresses a risk.
Researchers propose three layers of AI risk reporting
The researchers proposed that regulators and investors ask each large company to report on three sets of AI risks, modeled on climate reporting:
- a common set for every large company, such as AI-enabled cyberattacks
- risks tied to its industry, such as fraud for finance companies
- risks tied to how it uses AI, such as errors that spread from one AI agent to another
Each company would also say which safeguard addresses which risk. Under the proposal, a company could name a risk without describing its defenses in detail.
Methodology: Researchers reviewed 539 documents from 200 companies
The researchers selected the 100 largest companies by market capitalization as of Dec. 15, 2025, plus 100 randomly selected from those ranked 101 to 1,000. They collected 539 public documents, including an annual report from every company. An AI model sorted passages against the 24 risks. The researchers then checked every result by hand. In June, they invited the companies to correct errors or add missing documents.
The researchers excluded private AI developers such as OpenAI and Anthropic. They measured what companies said publicly, not how they manage risk. Companies may have published more since the researchers collected the documents.
