Critical88 companies against 21, a rise of 319%, and 229 open roles name it, so it is being funded and not only disclosed.
88filers, current period
21the period before
27controls it touches
17frameworks
AI Governance in 10-K and 10-Q filings, by month.
The marked line is the first month any public company in our record used the phrase; everything left of it is nobody writing it down.
Companies disclosing it
88
wrote this into a filing with the SEC
What it obligates
27
controls across 17 frameworks whose text speaks to it
Employers hiring for it
6,848
open US roles name it, and the ones below are hiring now
The long view, in annual and quarterly filings
A 10-K or 10-Q is a periodic report, so this counts how often the phrase appears in routine annual and quarterly reporting. It moves far more slowly and the numbers are larger.
Every month since 2008. The last point is the current month and is still
filling, so it always looks lower than it will be.
2008
peak 112 in February 2026
2026
Share this finding
More than four times as many companies as the same quarter last year. The card below carries the whole finding, so it makes
sense to somebody who never clicks through.
Who disclosed it
From SEC full-text search over 8-K filings. Every row links to the filing itself.
| Company | Form | Filed | |
|---|
| ServiceNow, Inc. NOW | 8-K | 2026-07-22 | filing |
| D-Wave Quantum Inc. QBTS | 8-K | 2026-09-21 | filing |
| SharonAI Holdings Inc. | 8-K | 2026-07-23 | filing |
| AXIS CAPITAL HOLDINGS LTD | 8-K | 2026-07-28 | filing |
| BIO KEY INTERNATIONAL INC BKYI | 8-K | 2026-08-14 | filing |
| EQUITY BANCSHARES INC EQBK | 8-K | 2026-07-14 | filing |
| Advantage Solutions Inc. ADV | 8-K | 2026-08-05 | filing |
| MVB FINANCIAL CORP MVBF | 8-K | 2026-07-28 | filing |
| SentinelOne, Inc. S | 8-K | 2026-08-27 | filing |
| INDEPENDENT BANK CORP INDB | 8-K | 2026-09-08 | filing |
| Atlassian Corp TEAM | 8-K | 2026-08-06 | filing |
| OCEANFIRST FINANCIAL CORP OCFC | 8-K | 2026-07-31 | filing |
| N-able, Inc. NABL | 8-K | 2026-08-10 | filing |
| FARADAY FUTURE INTELLIGENT ELECTRIC INC. FFAI | 8-K | 2026-08-13 | filing |
| BROADRIDGE FINANCIAL SOLUTIONS, INC. BR | 10-K | 2026-08-04 | filing |
| COGNIZANT TECHNOLOGY SOLUTIONS CORP CTSH | 8-K | 2026-07-29 | filing |
The full search on EDGAR
Who is hiring for it
A sample of the open roles naming this phrase. An employer paying a salary
against something is the least ambiguous demand signal there is, and every row links to the
posting so the claim can be checked rather than believed. The total above is the whole US
market; these are the ones we hold the posting for.
| Role | Posted |
|---|
| InfoSec Lead Orbital Energy Group, Inc. · New York | 2026-09-21 |
| Senior Manager, IT Internal Audit Block, Inc. · Bay Area, CA, United States of America | 2026-09-18 |
| Staff UI Engineer Ping Identity Holding Corp. · India - Bangalore | 2026-09-18 |
| Principal AI Engineer - Hybrid in Bangalore SMARTSHEET INC · Bangalore, INDIA | 2026-09-18 |
| Director, AI & Technology Governance, Ethics and Compliance ALNYLAM PHARMACEUTICALS, INC. · Cambridge, MA | 2026-09-17 |
| Senior Counsel, Strategic Partnerships Coursera, Inc. · United Kingdom | 2026-09-17 |
| Senior Counsel, Strategic Partnerships Coursera, Inc. · Dublin, Ireland | 2026-09-17 |
| Staff QA Engineer (AI Enabled) Ping Identity Holding Corp. · India - Bangalore | 2026-09-17 |
| Director, Applied AI ZoomInfo Technologies Inc. · Waltham, Massachusetts, United States | 2026-09-17 |
| Staff Security Engineer, Enterprise AI Affirm Holdings, Inc. · Remote US | 2026-09-15 |
| Staff Security Engineer, Enterprise AI Affirm Holdings, Inc. · Remote Canada | 2026-09-15 |
| Associate Director, Nonclinical Writing AI Innovation ALNYLAM PHARMACEUTICALS, INC. · Cambridge, MA | 2026-09-14 |
| Director, Enterprise Architecture ALNYLAM PHARMACEUTICALS, INC. · Cambridge, MA | 2026-09-14 |
| VP, Sales Engineering Ping Identity Holding Corp. · USA - Denver, CO | 2026-09-14 |
Which industries file it
Companies grouped by the industry classification on their own filing. A count, not a
survey.
| Industry | | Companies |
|---|
| Software and IT services | | 49 |
| Chemicals and pharmaceuticals | | 49 |
| Banking | | 26 |
| Industrial machinery | | 12 |
| Services and entertainment | | 12 |
| Insurance | | 12 |
| Electronics and electrical equipment | | 10 |
| Holding and investment offices | | 10 |
| Professional and social services | | 9 |
| Instruments and medical devices | | 9 |
What it obligates
Our corpus holds 27 controls across
17 frameworks whose text speaks to this. Not a judgement:
these controls say so, and each is one lookup from its source document. Ordered by how much each
framework has to say about it, so the one that will cost you the most work is first. Every name
opens that framework in the corpus.
What an auditor will ask you to produce
The artefacts named on those controls, most frequently cited first.
- Pipeline + emerging risk readiness
- International framework alignment
- Sectoral exercises + supervisory engagement
- SPM compliance + sectoral engagement
- IFC positioning + competitive analysis
- Strategic initiatives readiness
- IEEE 7000-2021 applicability assessment + system scope + ethical concern relevance per project
- Value-Based Engineering process adoption + organisational charter + integration with system engineering
How it usually fails
Recorded when each control was verified against its source. This is where programmes
that think they are covered turn out not to be.
- International alignment weak
- Pipeline not tracked
- Sectoral engagement gaps
- Compliance gaps
- IFC positioning weak
- Strategic initiatives lag
ISO/IEC 42001:2023 AI Management System Evidence & Implementation Kit
79 controls sit behind ISO/IEC 42001:2023, and this is the documentation set for them: an adopt-ready artifact per control, and the evidence an auditor asks for against each.
See what is in it, $249
The same set every buyer of this kit receives. Nothing here is produced on request.
79If you already run ISO/IEC 42001:2023, that is the 79 controls behind this disclosure, already evidenced.
229And ISO 27001:2022 is not a separate programme. 229 of its controls are the same controls. If it is on next year's plan, that part of it is already done.
160And ISO 27002:2022 is not a separate programme. 160 of its controls are the same controls. If it is on next year's plan, that part of it is already done.
144And ISO/IEC 38500:2024 is not a separate programme. 144 of its controls are the same controls. If it is on next year's plan, that part of it is already done.
Run as two programmes
308 controls
ISO/IEC 42001:2023 and ISO 27001:2022 scoped separately, each with its own
evidence, its own owner and its own budget line. This is how almost everybody does it.
Run once, counted twice
229 already done
229 of ISO 27001:2022's controls are controls you evidenced for
ISO/IEC 42001:2023. Same artefacts, same owner, no second effort. The mapping is the
only reason anybody knows.
AI Governance in 10-K and 10-Q filings, by month.
The marked line is the first month any public company in our record used the phrase; everything left of it is nobody writing it down.
What this actually means
- Why now
- 88 public companies wrote this into an 8-K in the last seven days, 319% more than the seven before. That is not sentiment or a survey. It is a count of companies choosing to put a phrase into a document they are legally accountable for.
- Who already cares
- 6,848 open US roles name this work today, which suggests increased attention to it beyond what any filing says. A job advertisement clears a budget holder and a filing clears legal, so the two answer to different people. We have not measured which moves first, only that both are moving.
- What comes into scope
- Once the phrase is on the record it maps to obligations within ISO/IEC 42001:2023, NIST AI Risk Management Framework (AI RMF 1.0), EU AI Act. 235 controls behind those, and the difference between asserting them and evidencing them is the whole of the work.
- Who is quietly ahead
- Anyone already running ISO/IEC 42001:2023 has done 229 of the controls that carry ISO 27001:2022 too. Same evidence, second standard. Most organisations run those as two programmes with two budgets because nobody told them the mapping existed.
- Who is exposed
- 29 companies disclosed this for the first time in the last ninety days, out of 301 in total. A first mention is a company deciding it can no longer not say it. Whoever has not yet is either genuinely unaffected or has not looked, and nothing here distinguishes the two.
What this obligates
The instruments in our corpus that govern this disclosure, and how many controls sit
behind each. This is not a filing count. It is what applies once a company has written the
phrase down.
5 frameworks, 235 controls between them.
ISO/IEC 42001:2023 holds 79 controls. They appear again inside
129 other frameworks in our corpus; the 10 strongest are shown. Thickness and
size both carry the number of controls shared, so work done once counts in every framework on
this diagram.
What closing it also moves
The same controls appear in other frameworks through mappings held in our corpus. Work
done here is already progress there. This is the part that is not in EDGAR and not in any public
dataset: it comes from mappings built and verified by hand, control by control.
ISO 27001:2022229
ISO 27002:2022160
ISO/IEC 38500:2024144
ISO 22301:201945
ISO 27701:201933
ISO 22000:201831
ISO 37301:202131
ISO 14001:201530
Counted as controls reached through cross-framework mappings. It measures
overlap of work, not compliance with the named framework.
Run as two programmes
308 controls
ISO/IEC 42001:2023 and ISO 27001:2022 scoped separately, each with its own
evidence, its own owner and its own budget line. This is how almost everybody does it.
Run once, counted twice
229 already done
229 of ISO 27001:2022's controls are controls you evidenced for
ISO/IEC 42001:2023. Same artefacts, same owner, no second effort. The mapping is the
only reason anybody knows.
79If you already run ISO/IEC 42001:2023, that is the 79 controls behind this disclosure, already evidenced.
229And ISO 27001:2022 is not a separate programme. 229 of its controls are the same controls. If it is on next year's plan, that part of it is already done.
160And ISO 27002:2022 is not a separate programme. 160 of its controls are the same controls. If it is on next year's plan, that part of it is already done.
144And ISO/IEC 38500:2024 is not a separate programme. 144 of its controls are the same controls. If it is on next year's plan, that part of it is already done.
Tell me when AI Governance files something new
One email when a public company newly discloses this, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.
Where this comes from
The left half is public record: SEC full-text search over 8-K filings, counted across a
14 day window against the equivalent window before it. You can check
every row.
The right half is ours: 723 frameworks and
20,473 controls, 531 of those frameworks verified against
their source documents, with the auditor evidence and common failure modes recorded control by
control. Controls appear here because their own text names this term.
Cite this
The Art of Service Signals. AI Governance corporate disclosure activity: 88 filers against 21 in the prior period, in 10-K and 10-Q filings, this quarter against the same quarter last year. Accessed 23 September 2026. https://signals.theartofservice.com/t/ai-governance/
Free to use with attribution, no permission needed. The chart downloads as an SVG
with the source printed on it. If you cite it we would like to know, but you do not need to
ask.
Today's edition ·
How programmes fail ·
The obligation index