AI Risk Disclosure: What UK Annual Reports Reveal and How to Present the Findings

AI risk disclosure is growing rapidly, but a company mentioning AI does not necessarily explain how it manages the associated risks. A recent analysis of UK listed-company annual reports makes that gap measurable. This guide explains the findings, clarifies the denominators behind the numbers, and develops four presentation applications for boards, analysts, procurement teams, and resilience researchers. Each includes a slide example and an AI prompt you can reuse with the paper in Tosea AI.

What the AI Risk Observatory studied

In The AI Risk Observatory: What Can We Learn from AI Disclosures in Annual Reports About Societal Resilience?, Bart Jaworski and Andrew Sutton examine 9,821 annual reports from 1,362 UK-incorporated listed companies. The version reviewed here is v2, with an October 13, 2026 arXiv revision stamp and an October 14 manuscript date. Treat it as a preprint whose methods and classifications remain open to scrutiny.

The main comparison period is 2020–2025. Another 339 reports from partial 2026 coverage appear separately and should not be used for year-on-year comparisons. The unit is an annual-report document, not necessarily a unique company-year. Multiple documents can represent one company in a publication year, so document-weighted percentages must not be relabeled as shares of companies.

The pipeline extracts AI-related passages and applies two classification stages. It identifies adoption, risk, vendor, harm, or general mentions, then evaluates selected mentions in more detail. Validation used 474 human-annotated passages from 30 reports. High recall and moderate label-level agreement support the method as a monitoring approach, while also making human review important for individual-company judgments. The project repository provides methodological context and implementation materials.

The key finding: more mentions, limited specificity

Between 2020 and 2025, the share of reports mentioning AI risk increased from 2.8% to 41.2%. Adoption disclosure increased from 13.8% to 45.2%. These are disclosure trends, not direct measures of how many businesses actually deployed AI or experienced failures.

In 2025, only 4.3% of all reports contained risk disclosure classified as substantive. The corresponding counts were 67 substantive reports among 643 risk-mentioning reports, or 10.4% of that smaller group. Both percentages are useful, but they answer different questions. A presentation should show the denominator next to each figure.

The paper's Table 4 shows how the gap opened year by year. Each value is a share of all reports published that year.

Under the study rubric, substantive risk disclosure combines an identifiable AI risk mechanism with a tangible company response. Generic concern about AI competition is insufficient by itself. A specific action, commitment, allocated resource, timeline, or measurable target makes the response more concrete. This is a research classification, not a legal compliance determination or proof that a control works. Most 2025 risk disclosure (78.5%) sits in the middle band: it names a risk area without describing a mechanism or mitigation.

The study also finds only seven harm-disclosing reports across the corpus, containing nine passages; after manual review, five passages across four reports described realized AI-caused incidents. That scarcity describes reporting, not the true incidence of harm. Companies may omit incidents, describe them without linking them to AI, or report them elsewhere. Likewise, named vendors reveal disclosed relationships without establishing total exposure or spend.

Which AI risks companies now name

The risk landscape in annual reports is broadening. In 2025, strategic and competitive risk remained the most common category (27.4% of all reports), but cybersecurity was a close second (25.7%), followed by operational and technical risk (24.2%) and regulatory and compliance risk (20.5%). Cybersecurity passages commonly cite AI-enabled phishing, adversarial attacks, and AI-accelerated fraud.

Two categories barely existed in 2020. Information integrity, covering AI-generated misinformation and deepfakes, rose from 1 report (0.1%) to 162 reports (10.4%) in 2025. Workforce impacts rose from 3 reports (0.3%) to 132 (8.5%). For a board or investor audience, that shift from competitive concerns toward societal and human-capital themes is often more interesting than the headline growth rate.

Vendor disclosure is concentrated. Microsoft was named in 98 reports in 2025, followed by Google (47), Amazon (42), and OpenAI (38), with a long tail of other providers in 154 reports and 65 reports citing an unnamed third-party provider. Yet only 19.2% of 2025 reports mention any vendor, and only 29.2% of AI-mentioning reports name one. The disclosed vendor landscape is therefore a partial view of actual dependencies.

Five mistakes when presenting AI disclosure data

Counting documents as companies. The unit is an annual-report document. "41.2% of reports" should never become "41.2% of UK companies" on a slide.

Mixing the two denominators. 4.3% is a share of all 2025 reports; 10.4% is a share of risk-mentioning reports. Put the denominator beside each number.

Comparing partial 2026 data with full years. The 339 partial-2026 reports have different coverage and should be shown separately, if at all.

Treating mention counts as market share. Ninety-eight Microsoft mentions say nothing about spending, contract value, or reliability.

Reading low disclosure as low risk. Disclosure reflects reporting incentives, governance regimes, and classification choices. It is a prompt for questions, not an exposure measure.

Four presentation applications

The applications below adapt the research for practical communication. They were not tested as interventions in the paper. All images are original illustrative slide designs, not Tosea AI product screenshots. Figures reproduce values from the v2 paper, while proposed actions are labeled separately from findings.

1. Board briefing: distinguish awareness from an actionable response

A board slide should make the disclosure-quality gap visible without calling it a control-effectiveness score. Pair 41.2% mentioning risk with 4.3% containing substantive risk disclosure. Add a short definition and a proposed management question: which AI risks have named owners and documented responses? Our board deck structure guide covers where a slide like this fits in a full board pack.

Reusable AI prompt

Read the uploaded AI Risk Observatory v2 paper. Create one 16:9 board briefing slide in navy, teal, and white. Compare 41.2% of all 2025 reports mentioning AI risk with 4.3% containing substantive AI risk disclosure. Show a 36.9 percentage-point gap, not a percent change. Add the denominator: 1,561 reports. Explain that 67 of 643 risk-mentioning reports were substantive, equal to 10.4%. Define substantive as a specific risk mechanism plus a tangible company response. Cite Table 4 and Section 4.6. Label the management follow-up as a proposed action, not a paper finding.

2. Analyst briefing: compare market segments carefully

Analysts may want to compare Main Market and AIM disclosure. The printed 2025 comparison reports risk mentions in 57.8% of Main Market reports and 6.4% of AIM reports, against 68.6% for FTSE 100 reports. The respective document counts are 703 and 171 for the two segments. Show these counts beside the bars and explain that the segment comparison excludes many reports without a provider-assigned segment.

Reusable AI prompt

Create a two-bar comparison slide from Table 3 of the uploaded v2 paper. Plot 2025 AI risk disclosure: Main Market 57.8%, n=703 reports; AIM 6.4%, n=171 reports. Use a zero baseline and a shared percent scale. Add a visible caveat that 687 reports were excluded from this printed segment comparison, including 676 without a provider-assigned segment and 11 Aquis reports. Mention that refined segment mapping changes the Main Market rate. Do not treat nested FTSE groups as independent categories or infer that lower disclosure means lower risk.

3. Procurement review: turn vendor mentions into questions

The paper finds that disclosed vendor relationships cluster around a small set of major providers, led by Microsoft. This creates a useful starting point for a dependency discussion, but annual reports cannot supply a complete operational inventory. A procurement slide should map the information needed to verify concentration, rather than manufacture market shares from mention counts.

Reusable AI prompt

Build a procurement workshop slide inspired by the uploaded paper. Use four linked cards: provider and model, business workflow, dependency, and fallback. Under each card, list two questions that procurement should verify internally. Label the whole diagram as a proposed diligence framework. Include the research observation that Microsoft leads named vendor mentions, without converting mentions into market share, spending share, or service reliability. Leave internal vendor names and exposure values unfilled unless verified source data is supplied. Cite Section 4.3.

4. Resilience workshop: improve the specificity of risk communication

Resilience researchers and reporting teams can use the substantiveness rubric to distinguish a generic risk statement from a concrete response. A workshop slide can show a ladder from broad concern to mechanism to documented response. Label invented examples clearly so readers do not confuse them with extracts from real company reports.

Reusable AI prompt

Create a 16:9 reporting workshop slide explaining the paper's risk substantiveness rubric. Use three levels: boilerplate, moderate, substantive. For substantive disclosure, require both an AI risk mechanism and a tangible company response. Use paraphrased hypothetical examples, clearly labeled illustrative, and do not attribute them to any company. Add a proposed checklist: affected workflow, accountable owner, response, evidence, and review date. Explain that this is a communication aid, not a compliance certification or a validated measure of actual resilience. Cite Section 3.3 and Appendix G.

Use Tosea AI to organize the evidence

Upload the v2 PDF to Tosea AI and specify the intended audience. A board needs a decision and a follow-up request; an analyst needs denominators and comparability limits; a procurement team needs a dependency framework. Asking for one generic summary deck would blur these different needs.

Start with an outline that separates methods, findings, interpretation, and recommended action. Use Tosea AI one-click layout tools to choose the layout or diagram while working on the outline. Select paired bars for a measured comparison, a table for denominator notes, or linked cards for a proposed diligence process. After rendering, continue changing the layout or diagram if the information hierarchy needs work.

When the wording is approved, use Layout Only for visual revisions and compare the result with the source. Retain percent units, publication years, document counts, and the partial-2026 warning. Test the exported deck in the application used for the meeting, especially small source notes and long chart labels. If the source data arrives as a spreadsheet rather than a paper, our AI Think-Cell alternative guide explains how to turn it into editable charts.

Q&A: AI risk disclosure and slide production

Does low AI risk disclosure mean that a company has low AI risk?

No. Disclosure is an incomplete signal affected by reporting incentives, coverage, and classification. Use the findings to identify where further investigation is needed. Validate operational exposure with internal inventories, incident information, contracts, and control evidence.

Can Tosea AI redesign my existing PowerPoint without changing the content?

Yes. Export the PowerPoint as a PDF, upload it to Tosea AI, and request preservation of the original wording. Use Layout Only for a structural refresh. Review every label, footnote, citation, and slide element to confirm completeness.

How do I upload a PowerPoint and ask Tosea AI to redesign each slide?

Export the deck as a PDF first. Upload that PDF and explain that each slide should be redesigned while preserving its content and sequence. Choose a template or visual direction, generate the deck, and inspect each slide before export.

Can I upload my own PowerPoint template to Tosea AI?

Tosea AI supports custom templates on eligible paid plans. Follow the product workflow to upload or configure the template. Confirm the required layouts, fonts, colors, logo placement, and master-slide rules before using the generated presentation externally.

Can Tosea AI use custom brand colors, fonts, and a logo?

Yes. Specify the colors and fonts and upload the logo, or use a supported custom template. Custom logo and custom template availability depends on plan eligibility. After export, verify font availability, color values, contrast, and logo clear space.

Can Tosea AI match the style of my old company presentations?

Use a representative company deck as design guidance and an approved custom template for consistency. This does not imply permanent model training. Compare the output with the brand guidelines before distributing it.

Does Tosea AI preserve PowerPoint formatting after export?

Editable PPTX export is designed to stay close to the preview while supporting further edits. Fonts, complex graphics, and different presentation applications can change rendering. Test the file in the exact environment used for final delivery.

Can I tell AI to edit the layout only and keep the exact wording?

Yes. Layout Only changes the visual arrangement without intentional rewriting. Compare the edited slide against the approved source, including labels, citations, footnotes, and line breaks. Keep the original file available for review.

Turn disclosure research into a decision-led deck

Continue with Tosea AI guides on presenting AI and population ageing research and building a BCG-style storyline. They offer related approaches to research communication and executive narrative. For recovering editability from an existing slide design, see the Reslide conversion guide.

Bring the paper PDF and one of these prompts into Tosea AI to build a focused AI risk disclosure presentation. Select layouts during outlining, refine diagrams after rendering, and keep every denominator visible. The result should help an audience ask better questions about AI exposure and company responses while preserving the limits of what annual reports can reveal.

Sources

• The AI Risk Observatory: What Can We Learn from AI Disclosures in Annual Reports About Societal Resilience? (v2) — Jaworski and Sutton, arXiv preprint, revised October 13, 2026
• Full paper PDF, including Tables 1–7 and Appendix G prompts — arXiv
• AI Risk Observatory project repository — GitHub