SEC Disclosure Inconsistency Risk for Public Technology Companies

The question the SEC asks a public technology company is not "are you overstating your AI?" but "does what you say in one place match what you say everywhere else? That shift sounds small, but it isn't. The SEC's current enforcement posture treats the distance between what a company says about its technology on an earnings call or in an investor deck, and what it can back up in its filings, as the violation itself. Not the technology claim. The gap.

In practice, a company can have a genuinely good AI product, built by genuinely good engineers, and still land in trouble. If the words used to describe that product on an earnings call suggest more autonomy, more scale, or more commercial maturity than the 10-Q supports, the company has a problem regardless of what the product can actually do. The standard is whether every word a company uses can be backed up, in every channel, every time, not truth versus lies.

The SEC has leaned on companies, mostly through comment letters and staff review, to check whether what gets said about AI in board meetings, earnings calls, and investor presentations rises to the level of materiality. If that gap rises to materiality, the matching disclosure needs to show up in the filings too. That turns cross-channel consistency into something companies now have to actively manage and account for, not something they can leave to chance or to whichever department happened to write the slide.

Two patterns draw the most attention right now. The first is a company claiming AI capabilities on a call or in a deck that never make it into the 10-Q. The second is flat-out inconsistency between what gets said in public and what the filings show. Both point to the same root issue: language that was never checked against itself.

How AI amplifies a company's existing narrative

AI doesn't create a narrative gap out of nothing. It takes whatever gap already exists and makes copies of it, fast. Companies feel real pressure to show up as AI-credible right now, and some respond to that pressure by stretching what their AI actually does or is likely to do soon. That stretching has a name now: AI-washing.

When a company uses AI tools to draft earnings summaries, investor FAQs, sales decks, or press releases, those tools pull from whatever source language already exists inside the company, which creates a mechanical problem. If that source language is vague, aspirational, or quietly contradicts itself across departments, the AI-generated output carries all of that forward. It doesn't catch the contradiction. It repeats it, politely, at scale, in a dozen formats by lunchtime.

That creates a strange and uncomfortable fact: the statements that reach the largest number of investors, fastest, are often produced from the part of the company's language system that gets the least oversight. Marketing decks and investor FAQs rarely go through the same scrutiny as a 10-K footnote, yet AI tools can now generate dozens of them a week, each one inheriting whatever imprecision was already sitting in the company's internal documents.

The Delphia case shows how this actually happens inside a company, without anyone intending fraud. The people writing the marketing copy didn't fully understand what the engineering team had actually built. That's a communication failure between departments, not a conspiracy. But the mismatch between what got claimed and what existed became the violation anyway. The SEC doesn't ask who meant what. It asks whether the words matched the facts.

The enforcement record and the precedent it establishes

The cases on the books now share one structure: a gap between what investor-facing language claimed and what the company could prove operationally. Line them up and a pattern appears, not a coincidence.

Albert Saniger and the shopping app Nate illustrate the pattern. In April 2025, the SEC and the U.S. Attorney's Office for the Southern District of New York filed parallel actions against him, alleging he raised tens of millions of dollars by claiming the app processed transactions through AI, machine learning, and neural networks. The allegations claim the automation was mostly done by human workers behind the scenes. What makes this case matter beyond its own facts is the parallel criminal action running alongside the civil one. Narrative-gap violations now carry exposure that reaches past SEC enforcement and into criminal court.

Then there's Mozaic Payments. Marcus Cobb, former CEO of Mozaic Payment System, Inc., faced criminal indictment in November 2025. The specifics differ from the Nate case, but the underlying shape doesn't: a technology narrative sat at the center of the alleged fraud, doing the work that actual substantiated capability was supposed to do.

Side by side, these cases make the enforcement theory clear. What triggers action is a company's public statements contradicting its internal records, or public capability claims the company can't back up in its own filings. The technology itself, good or bad, sophisticated or basic, isn't what regulators are weighing. The words used to describe it are.

Where the exposure surface extends beyond the 10-K

The 10-K is not the edge of the risk. The SEC reviews both filed and non-filed material when it checks for accuracy, and that means a single loose sentence on a webpage can open exposure across more than one regulatory front at once.

The SolarWinds case makes this concrete. The part of that case that came closest to trial wasn't the 8-K. It was a marketing page, a public "Security Statement" sitting on the company's website. Most disclosure committees review a 10-K line by line and never look twice at a trust-center page, treating it as marketing rather than as a representation the SEC can hold a company to.

The same pattern appears in the Nate case. Most of the alleged misrepresentations there weren't buried in formal SEC filings. They were in presentations, marketing materials, and emails sent to venture capital firms. For any company that's public, or raising money under Regulation D, that kind of go-to-market language carries direct securities exposure, filing or no filing.

Now add AI-generated volume to that picture. When sales and investor materials get produced at scale from language nobody has reviewed, the surface area of potential exposure grows faster than any legal team can keep up with. A compliance review cycle that takes two weeks can't catch output that a few AI tools can generate in an afternoon.

Category-creation language as the highest-risk disclosure surface for emerging-tech companies

Category-creation language is, by design, forward-looking and confident about a future that hasn't arrived yet. That's precisely the register the SEC's comment letters have flagged as the source of disclosure trouble.

The SEC has asked registrants directly to clarify where their conversational AI technology actually stands today, spell out the scope of what it can currently do, and draw a clean line between current capability and future, aspirational capability, including the concrete steps still needed to get the platform fully built out.

Category language works against that line on purpose. A company that has defined a new category wants its current product to look like it's already living in that category's future. That's the whole point of category creation as a marketing move. But it's also exactly the gap the SEC is trained to find.

This tends to happen gradually, not deliberately. A founder builds category language, blurring present and future capability, into every board deck, pitch, and press release, long before the company goes public. Nobody flags it because nobody's looking yet. Then the company files its first MD&A and that same language, unchanged, carries straight into a document that demands precision it was never built for. Fraud has nothing to do with it. Organizational habit does, along with the simple absence of one governed version of the truth.

The SEC's 2025 comment letters back this up directly, asking for more detail on development stage, validation, third-party dependencies, and the actual operational role AI or machine learning plays inside the product. The staff is asking companies to break the category claim down into pieces that can each be checked against the record, not to stop using category language. The fix is language that's been governed before it ever reaches an investor's ear, not more cautious language.

What treating disclosure language as governed infrastructure requires

The operational lesson from the enforcement record is straightforward: if an executive says something on an earnings call that implies more than the 10-Q can support, that gap is the violation. The only way to close it permanently is to build a system where one controlled version of the language moves from R&D into investor communications, filings, and sales materials alike, instead of five departments each writing their own version.

Language governance, deciding who controls the official word on what a product does and doesn't do, is now something the SEC expects companies to describe. The staff has asked companies to spell out their governance policies around AI use and to update business and risk-factor disclosures so they actually reflect where AI adoption stands inside the company.

The Delphia case shows what this looks like when it's missing. The people writing the marketing copy didn't know what engineering had actually built. The fix is building one canonical document, a single authoritative record of what the product does, owned by a function with the standing to enforce it everywhere that language travels, not hiring better copywriters.

Building that system takes four pieces working together: a controlled vocabulary for capability claims, signed off by both R&D and legal; a mechanism that makes that vocabulary the one that actually shows up across every investor-facing channel; a version history that updates as the product itself changes; and a rule that any departure from the approved language, anywhere, triggers a review.

This is the same discipline engineering teams already apply to technical debt. Fragmented language compounds the same way sloppy code does. Every quarter a company lets its public language drift further from what it can actually substantiate, the cost of fixing it later goes up. Storied's Narrative OS and Storied AI are built to sit at exactly this layer, as the canonical source from which investor-facing, sales-facing, and filing-facing language all derive, treated as infrastructure rather than as messaging to be tweaked channel by channel. For a company growing faster than its own story can keep up, or working with technology the market doesn't have settled words for yet, this is usually the piece of risk management nobody built.

The practical audit a public technology company should run on its current language system

Running a cross-channel language audit means checking every investor-facing capability claim against what the most recent filing actually supports, and finding the gaps before a comment letter does it for the company. The places to look include the 10-K and 10-Q business and risk-factor sections, earnings call transcripts and prepared remarks, investor day presentations and the decks behind them, every press release issued since the last 10-K, product marketing pages and trust-center pages, and anything used in a capital raise. For each one, the question is simple: does this language claim or imply a capability, a level of autonomy, a degree of commercial maturity, or a metric that lines up exactly with what the most recent filing says? Any mismatch counts as a gap, and any gap is a place the SEC could look.

A second question matters just as much as the audit itself: who actually owns the official description of what each product does? If that answer is scattered across marketing, product, investor relations, and legal, with no single version everyone works from, the governance structure doesn't exist yet, no matter how clean the current filings look. Gaps that get cleaned up once will simply grow back, because nothing is stopping new ones from forming the same way the old ones did.

Some companies face higher odds of finding something when they look. Companies that went public through a merger with a shell company, companies running recent category-creation campaigns, and companies that added AI-capability language sometime in the past two years are the most likely to find real problems once they check. That language was often written before the current enforcement environment existed, and it has never been checked against the standard regulators apply today. The audit is the first real look at whether anyone in the company can say, with confidence, who owns the words the company uses to describe itself, not a legal formality to clear off a checklist.