AI Chatbot Legal Risk for Public Companies
AI chatbot legal risk for public companies is a disclosure risk that depends on who spoke, who controlled the content, and what a correction adds. ChatGPT, Google AI Overviews, Google AI Mode, Microsoft Copilot, the SEC, and SEC EDGAR play different roles. An independent AI error is not automatically a company statement, an SEC disclosure violation, or a Regulation FD event.
This guide helps General Counsel, disclosure committees, and investor relations teams classify risk and preserve evidence. It does not give legal or investment advice. Counsel should review questions about materiality, attribution, selective disclosure, and securities law.
The separate Regulation FD and AI chatbot answers guide covers the correction process.
Can wrong AI answers create legal risk for a public company?
Wrong AI answers can raise questions for a public company. The answer alone does not establish company liability. The first issue is whether the company created, controlled, approved, endorsed, or repeated the statement.
No AI-specific SEC rule or enforcement source cited here says an independent AI error creates issuer liability by itself. Existing securities rules may apply to later company conduct. Their application depends on the facts.
How should a disclosure committee classify the risk?
A disclosure committee can begin with 4 questions:
- Attribution: Who created or controlled the statement?
- Materiality: Does the correction raise a materiality question?
- Public status: Has the company already disclosed the correct fact?
- Correction content: Would the proposed response add new information?
These questions separate an outside error from a company disclosure. They can also reveal risk in the proposed response.
A disclosure committee should avoid treating the AI answer and the company correction as one event. Each has a different speaker, source, and record.
What securities rule may apply to a company statement?
SEC Rule 10b-5 addresses fraud, material misstatements, and material omissions connected with securities transactions. The rule does not say every wrong third-party summary is an issuer statement. Last checked: 2026-11-01.
Whether Rule 10b-5 applies is a legal question. Counsel must assess the full facts and the required legal elements.
This guide does not conclude that an AI answer creates Rule 10b-5 liability. No cited SEC source supports that broad conclusion.
What can the evidence prove?
A dated record can show what one interface returned during one session. It can also show which sources appeared with the answer.
The record does not prove what every investor saw. It also does not prove reliance, loss, a stock move, a lawsuit, or a Regulation FD breach.
A careful record should separate facts from conclusions. It can identify the answer, capture time, shown sources, and conflicting filing text.
For this legal risk review, the MS House methodology shows how captured AI answers are matched to specific SEC filings and official company disclosures.
Is a third-party AI answer a company statement?
A third-party AI answer is not automatically a company statement. The analysis may change when a company creates, controls, approves, endorses, or repeats the answer.
Regulation FD applies to an issuer or a person acting on its behalf. The rule does not say an independent search or chatbot service acts for every company it describes. Last checked: 2026-11-01.
What company conduct can affect attribution?
Company involvement can change the attribution analysis. Relevant facts may include whether the company drafted, approved, paid for, or presented the answer as official.
The SEC’s guidance on company websites discusses company involvement with third-party information. The SEC published the guidance on August 7, 2008.
That guidance predates current AI answer services. It does not create an AI-specific test for ChatGPT, Google AI Overviews, Google AI Mode, or Microsoft Copilot.
Counsel should review any planned approval, endorsement, or republication of outside content.
Does linking to an answer make it a company statement?
A link does not produce the same result in every case. The SEC website guidance discusses links, labels, context, and third-party information.
A neutral link may present different facts from an official statement that calls an outside answer correct. Copying generated text into an earnings release would also present different facts.
The SEC guidance does not decide how every generated answer should be treated. Attribution requires a review of the actual company conduct.
Is a company-run chatbot different?
A company-run chatbot raises a closer control question. The company may control the channel, source material, labels, and approval process.
That control does not mean every answer creates liability. It does mean the company should classify the output separately from an answer produced by an independent service.
The evidence record should identify who operates the tool. It should also list the approved sources and the process used to update them.
When can a company correction create disclosure concerns?
A correction can raise disclosure concerns if it adds material information that is not public. A private correction can also raise concerns if it reaches a covered recipient.
The safest factual base is the existing public record. IR can identify the controlling disclosure and keep the correction within that source.
How can a team review a proposed correction?
A team can compare every factual sentence with an approved public source. The source may be an SEC filing, filed exhibit, earnings release, or official company disclosure.
Use SEC EDGAR to confirm the form, filing date, accession number, and exhibit. Last checked: 2026-11-01.
The SEC’s Investor.gov EDGAR overview explains how investors can find public company filings. Last checked: 2026-11-01.
A sentence without clear public support should return to the company’s normal review process. IR should not fill the gap with an unapproved update.
What if the correct information has changed?
A changed fact should follow the company’s normal disclosure process. An AI correction request should not become a separate channel for new company information.
For example, an outside answer may repeat guidance that the company is reviewing. IR should not use a correction request to announce changed guidance.
After an approved public disclosure, IR can point to the new source. The correction should not go beyond the approved text.
Can a correction summarize filed information?
A correction can point readers to information that is already public. The company should still compare the summary with the cited source.
A short summary may change meaning if it removes a condition, period, or limit. The evidence record should include the exact passage, not only a link.
This review helps the committee see whether the correction repeats public information or adds something new.
How does Regulation FD affect the correction process?
Regulation FD matters when an issuer or its representative shares material nonpublic information with a covered recipient. A third-party AI error is not a Regulation FD event by itself.
For an AI answer correction, the primary SEC source is the Regulation FD adopting release. It describes the rule’s purpose and scope. The SEC published it on August 15, 2000.
No AI-specific Regulation FD interpretation or enforcement source is cited here. Teams should not describe an untested view as settled SEC guidance.
Can a private correction raise Regulation FD concerns?
A private correction may raise concerns if a company representative adds material nonpublic information. The concern would arise from the company’s communication, not just the original AI answer.
An analyst might ask whether an old answer remains accurate. IR can point to existing public material without giving an unannounced update.
If the public record does not answer the question, IR should return the matter to the company’s disclosure process.
What SEC sources discuss public disclosure methods?
For teams choosing how to publish an AI answer correction, the SEC’s Regulation FD compliance interpretations explain how the rule applies in stated settings. Last checked: 2026-11-01.
The SEC website guidance discusses when a company website may support broad public disclosure. It does not say every website update meets Regulation FD.
The correct method depends on the facts. Counsel should review questions about timing, distribution, and broad public access.
The Regulation FD and AI chatbot answers guide covers correction steps in more detail.
What evidence should the disclosure committee keep?
The disclosure committee should keep a dated record that connects the AI answer with the controlling public source. The record should show what appeared, what the filing says, and what the company decided.
A useful evidence record can include:
- Capture date and time.
- Engine and interface.
- Prompt or search text.
- Full answer and shown citations.
- Screenshot or stored response.
- SEC form and filing date.
- EDGAR accession number and exhibit.
- Exact filing passage.
- Risk category and reviewer role.
- Decision, owner, and completion date.
The quarterly AI answer audit record explains how to organize this evidence.
Why should the record include the full answer?
The full answer preserves context. A short excerpt may omit a date, condition, source, or conflicting sentence.
The record should also identify the exact interface. Google AI Overviews and Google AI Mode are separate services. Their output and shown sources may differ.
A dated capture shows what the recorded session returned. It does not show what every user received.
What filing details make the record traceable?
A traceable record should include the form, filing date, accession number, exhibit, page, and quoted passage. Another reviewer can then repeat the comparison.
An official IR page may also support the review. The record should preserve the text used because a web page can change.
The record should separate observation from judgment. “The answer conflicts with this filing passage” is narrower than “the answer harmed investors.”
How long should the company retain the record?
No AI-specific SEC retention period is cited here. The company should follow its record policy, legal hold duties, and advice from counsel.
The record should be complete enough to explain the source, review, and decision. Any retention choice should fit the company’s existing legal and record process.
What can IR do without adding new material information?
IR can point people to information the company has already made public. Each action should stay within approved disclosure and cite the controlling source.
Possible actions include:
- Repair links to filed earnings materials.
- Add clear filing dates and period labels.
- Separate current materials from archived materials.
- Use approved executive names and company descriptions.
- Link factual corrections to the controlling filing.
- Give an outside service the current public source.
- Preserve a copy of each correction request.
These actions do not guarantee that an AI engine will change its answer.
Can IR contact an AI or search service?
IR can use an available feedback or correction channel. The message should quote approved public information and link to the source.
IR should keep the submitted text, date, recipient, and response. This record shows what the company shared.
IR should not send material nonpublic information to explain a planned change. The company should complete its approved public disclosure first.
Can IR update the company website?
IR can correct or clarify public website content through the company’s normal review process. The update should match the controlling disclosure.
A website update remains a company communication. The company should apply its usual approval and record procedures.
If the update adds new information, the matter is no longer a simple source correction. It should return to the disclosure committee and counsel.
When should outside counsel review a correction?
A company should consider outside counsel when a correction raises materiality, attribution, selective disclosure, or major event questions. The company’s existing controls should set the review threshold.
Possible escalation topics include:
- Guidance or a possible guidance change.
- A restatement or suspected accounting error.
- A pending acquisition or sale.
- A leadership change that is not public.
- An activist campaign or proxy contest.
- A cybersecurity incident.
- Pending litigation or a regulatory inquiry.
- A correction that conflicts with a filed statement.
This list is a triage aid, not legal advice. The facts may call for review in other situations.
The AI search after an acquisition announcement guide explains how to preserve evidence after a public deal announcement.
What should counsel review in a company-run chatbot?
Counsel may review the chatbot’s approved sources, labels, limits, and escalation rules. Counsel may also review how the company handles stale material and keeps records.
The review should focus on company control and public presentation. It should not assume every generated error creates liability.
The disclosure committee should decide who can change the source material. That decision should fit the company’s existing disclosure process.
How should teams classify third-party output and company communications?
Teams should classify each item by control, public status, and content. The category points to the evidence and review path.
How should teams classify outside output and filed evidence?
Teams should separate third-party AI output from the public filing used to check it. An outside answer is not automatically a company statement. A filing or filed exhibit is an official public disclosure.
| Category | Who controls it? | Main disclosure question | Evidence to keep |
|---|---|---|---|
| Third-party AI output | Outside service | Did the company create, adopt, endorse, or repeat it? | Dated capture, prompt, answer, and shown sources |
| Public filing or filed exhibit | Company | Which passage addresses the disputed fact? | Form, filing date, accession number, exhibit, and quote |
This classification connects an observed answer with its controlling public source. It does not decide attribution, liability, or materiality.
How should teams classify company communications?
Teams should separate public company corrections from private communications. Both involve company conduct, but the recipients and disclosure questions differ.
| Category | Who controls it? | Main disclosure question | Evidence to keep |
|---|---|---|---|
| Company-published correction | Company | Does it add material information that is not public? | Approved text, source, publication method, and time |
| Private company communication | Company or its representative | Does it share material nonpublic information with a covered recipient? | Recipients, approved text, notes, and time |
This classification supports triage. Counsel should assess disputed attribution, unusual company control, or possible selective disclosure.
Frequently asked questions
These answers state the limited conclusions supported by the cited SEC sources. They do not replace legal advice.
Does the SEC have a rule about AI chatbot answers?
No AI-specific SEC rule is cited here. Existing securities rules may apply to company statements and selective disclosures. Their application depends on the facts.
The absence of an AI-specific rule does not settle how another rule applies. Teams should identify the rule, company conduct, and supporting evidence.
Can a company be liable for what ChatGPT says about it?
A third-party answer does not automatically become a company statement. The analysis may change if the company creates, controls, endorses, or repeats the answer.
This question cannot be answered for every company or answer. Counsel should review the specific facts and applicable law.
Is correcting an AI answer a Regulation FD event?
Not by itself. Regulation FD concerns selective disclosure of material nonpublic information by an issuer or a person acting on its behalf.
A private correction may raise concerns if a company representative adds material nonpublic information.
Does a company have to correct every wrong AI answer?
No SEC source cited here creates such a duty. A company can set review priorities based on its facts, policies, and advice from counsel.
A clear conflict with a filed passage may offer a useful starting point. That is a review choice, not a stated SEC requirement.
How long should a company keep AI answer records?
No AI-specific SEC retention period is cited here. The company should follow its record policy, legal hold duties, and advice from counsel.
The record should support later review of the source, decision, and any company correction.
Where should a disclosure committee start?
A disclosure committee should start by preserving the answer and finding the controlling public source. It should then classify the item before approving any response.
The committee can use this order:
- Capture the full answer, interface, prompt, time, and shown sources.
- Find the controlling SEC filing or official company disclosure.
- Quote the exact passage that supports or conflicts with the answer.
- Classify the item as third-party output, a company communication, a filing, or a private exchange.
- Review whether the proposed response adds information.
- Record the decision, reviewer, and owner.
- Send materiality or selective disclosure questions to counsel.
A correction should not imply more than the evidence proves. It should not claim investor harm, market impact, litigation, or a Regulation FD breach without a supporting public source.
See the fictional Acme Inc. sample audit for an example of an answer, filing evidence, source, and fix owner.