More than seven of every 10 public companies on the S&P 500 now flag their use of artificial intelligence as a material risk in their public disclosures, according to a report released Friday by The Conference Board.
That figure represents a sharp increase from just 12% in 2023, reflecting the rapid implementation of AI use among major enterprises.
“This is a powerful reflection of how quickly AI has developed from a niche topic to widely adopted and embedded in the organization,” Andrew Jones, a principal researcher at the Conference Board Governance & Sustainability Center, told Cybersecurity Dive via email.
AI has moved beyond the experimentation phase at major enterprises and is embedded across core business systems, including product design, logistics, credit modeling and customer interfaces, Jones said.
The report shows that corporate boards and C-suite leaders are addressing a range of risk factors in connection with AI deployment.
Reputational risk is the most widely disclosed issue, at 38%, according to the report. This reflects the potential impact of losing trust in a brand in the case of a service breakdown, mishandling of consumer privacy or a customer-facing tool that fails to deliver.
Cybersecurity risk is cited by 20% of firms. AI increases the attack surface, and companies are also at risk from third-party applications.
Legal and regulatory risks are also a major issue, as state and federal governments have rapidly attempted to set up security guardrails to protect the public, while providing enough support for companies to continue innovation.
While AI deployment is rapidly evolving in the enterprise, corporate leaders are still struggling to fully develop the governance structures to manage its use.
The PwC “2025 Annual Corporate Director’s Survey” shows only 35% of corporate boards have formally integrated AI into their oversight responsibilities, an indication that companies are still working to develop stricter guardrails.
“Directors recognize that AI brings both strategic opportunity and fiduciary risk, and many are starting to consider how to strengthen governance through regular education, clear oversight structures, and responsible-use frameworks," Ray Garcia, leader of PwC’s Governance Insights Center told Cybersecurity Dive.
