Cambridge, Mass., Nov. 03, 2026 (GLOBE NEWSWIRE) -- Key MIT Sloan Findings:
- Are companies publicly acknowledging AI risks? New research from MIT Sloan School of Management principal research scientist and MIT FutureTech director Neil Thompson finds that 32% of the world's 100 largest companies and 62% of the 1,000 largest companies have not publicly acknowledged any AI risks.
- What is the impact of this lack of corporate transparency? It leaves the public, investors, and regulators with little basis for determining which companies are managing AI risks or how well they are being managed.
- What should companies do next? The researchers believe regulators and investors should set new expectations for how companies report on AI risk, proposing an approach similar to climate reporting, where companies are required to report against a standard set of AI risks and state which mitigations they are employing based on their sector’s vulnerability and role in the AI ecosystem.
A new working paper, "Unmitigated? How are the world’s largest companies responding to AI risks?" from MIT Sloan School of Management and MIT FutureTech suggests that 32% of the world's 100 largest companies and 62% of the 1,000 largest companies have not publicly acknowledged any AI risks.
The researchers’ data was collected just a few months before autonomous AI agents from OpenAI escaped their internal testing environment in July 2026 and hacked systems belonging to Hugging Face, a company whose platform is used by developers to share AI models and data. Yet, many of the risks implicated in the Hugging Face incident were rarely acknowledged by the companies they researched.
"The Hugging Face incident shows that even the developers of the most advanced AI systems can struggle to contain them, and that companies can face AI risks they did not even create," said Neil Thompson, director of MIT FutureTech, an MIT Sloan principal research scientist, and one of the authors of the paper. “But nearly a third of the world’s 100 largest companies have not publicly acknowledged any AI risks”
Thompson stressed that this lack of corporate transparency leaves the public, investors, and regulators with little basis for determining which companies are managing AI risks or how well they are being managed.
How was the research conducted?
In addition to Thompson, the research, which was funded by the Commonwealth Bank of Australia, was co-authored by Alexander K. Saeri, Jess Graham, Kun Zhao, and Michael Noetel, researchers co-affiliated with MIT FutureTech and the University of Queensland School of Psychology; Peter Slattery, an MIT FutureTech research scientist; Eunice Zhang; and Erin Howard. MIT FutureTech is affiliated with the MIT Sloan School of Management and the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL).
The researchers analyzed over 500 public documents, including annual reports and AI policies, from 100 of the world’s largest companies by market capitalization and 100 randomly selected from those companies ranked 101 to 1,000 by market capitalization. They excluded private AI developers such as OpenAI and Anthropic.
The documents were then coded against the 24 AI risk categories in the MIT AI Risk Repository, a living database maintained by the MIT AI Risk Initiative. This allowed the researchers to identify which categories of risks companies had publicly acknowledged, those they hadn’t, and how this varied by each company’s sector and role in the AI ecosystem.
The researchers next compared companies' acknowledgments with a prior MIT AI Risk Initiative study in which 272 AI risk experts across the globe ranked which risks they deemed most severe, who is most vulnerable to these risks, and who is most responsible for addressing them. Additionally, created an interactive company risk explorer where people can look at the results by sector, developer vs. deployer, and even see individual companies' records.
Which risks did companies most commonly acknowledge and which did they not?
Five risk categories accounted for over half of all acknowledgements: Discrimination, weapons and cyberattacks, fraud and scams, loss of privacy, and devaluation of human creativity.
But other risks in their 24 AI risk categories, such as AI being capable of cyber-offense and self-proliferation, were rarely acknowledged. None of the companies acknowledged power centralization (the concentration of power among those who control advanced AI) or competitive dynamics (racing to deploy AI at the expense of safety). Of the largest 100 companies, only 2% acknowledged AI misalignment in which AI systems can act in opposition to the goals of designers or users, and only 1% acknowledged multi-agent risks, which can arise when AI agents interact. Only 4% acknowledged dangerous capabilities, and just 16% acknowledged AI security vulnerabilities.
Are companies more likely to acknowledge risks they are vulnerable to and responsible for addressing?
The researchers found that generally companies in sectors that experts judged as more vulnerable to a risk were more likely to acknowledge that risk. However, even where a company’s sector was judged to be extremely vulnerable to a risk, the company publicly acknowledged it only 23% of the time.
While AI risk experts assigned developers of general-purpose AI with the highest responsibility for addressing misalignment risks, only 15% of public companies in this role among the world's 100 largest companies acknowledged this risk, while 85% acknowledged discrimination risks.
"Companies are mostly disclosing the risks that affect their operations, like discrimination and fraud," said Peter Slattery, a research scientist at MIT FutureTech. "This means that risks to markets, institutions, and the public remain largely unmentioned, even by companies that experts judged as being particularly responsible for addressing them."
What are some solutions?
The researchers argue that regulators and investors should set new expectations for how companies report on AI risk. They propose an approach similar to climate reporting, where companies are required to report against a standard set of AI risks and state which mitigations they are employing based on their sector’s vulnerability and role in the AI ecosystem. For example, large banks would report on how they manage AI-enabled cyberattacks and fraud, while developers of general-purpose AI would report on the risks experts judged them most responsible for addressing, such as dangerous capabilities.
Attachment
Casey Bayer MIT Sloan School of Management 914.584.9095 bayerc@mit.edu