Disclosure Trends From the 2024 Reporting Season (April 2025)

The SEC’s final rule4 on cybersecurity disclosures became effective in December 2023; thus, for the second year, public companies were required to disclose in their annual reports material information regarding their cybersecurity risk management, strategy, and governance. Since the release of the final rule, the SEC has emphasized that disclosures should (1) represent processes registrants have in place and are not aspirational; (2) contain sufficient detail for a reasonable investor to understand those processes, including oversight of third-party service providers; (3) take into account the expertise of all management personnel responsible for managing cybersecurity risk; and (4) not be hypothetical if such cybersecurity risks have already materialized. While the details of the disclosures varied, in 2024 most companies expanded their cybersecurity disclosures from the prior year, as shown in the following chart:

As AI technologies become more ubiquitous in the business world, registrants are increasingly discussing the extent to which they have integrated or will integrate AI into their operations. References to AI, generative AI, or other AI-related matters continue to be incorporated heavily into registrants’ risk factors and business sections. Companies continue to disclose information about how they are using, or plan to use, generative AI in their businesses as well as any associated challenges, including risks related to traditional operating models, operational and market dynamics, data privacy, and labor market effects.

Many registrants continue to enhance their tax legislation risk factor disclosures to reflect the material risk posed by changes in tax laws in relevant jurisdictions, including the global minimum tax under the “Pillar Two”13 framework, which many jurisdictions have adopted, with changes beginning in 2024 and other changes expected to take effect in 2025. Most registrants have noted the uncertainty in the timing, scope, and impact of the United States’s adoption of the framework. MD&A and financial statement disclosures often addressed relevant jurisdictions that have enacted the new tax laws14 related to the global minimum tax for the fiscal year-end and included a description of the extent of the economic impact. The SEC staff has encouraged companies to provide an estimate of the impact or a range of possible impacts.

The macroeconomic landscape has been changing rapidly in response to increased global trade tensions associated with the implementation of new tariffs, affecting various industries and market dynamics. Registrants have disclosed, primarily within the risk factors section, that these tariffs are likely to affect their cost structures, profitability of their companies, and consumer demand and that they may need to make strategic adjustments to avoid potential issues with global supply chains. Further, many registrants have disclosed that these tariffs, along with retaliatory tariffs and related regulations and restrictions, may lead to increased volatility in operating costs and sales margins. We expect companies’ disclosures related to this topic will continue to evolve throughout 2025.

While regulatory requirements for sustainability disclosures are evolving, highlighted by the SEC’s recent withdrawal of its legal defense for its currently stayed climate disclosure final rule15 and the European Commission’s proposed omnibus initiative, most registrants have continued to disclose sustainability matters in their annual reports under existing disclosure requirements, including the SEC’s 2010 interpretive guidance on climate-change disclosures. Business section disclosures primarily addressed a registrant’s sustainability activities, including net zero or carbon neutral commitments (such disclosures were provided by approximately a quarter of the Fortune 500 companies). On the other hand, in MD&A, registrants discussed how climate matters might affect their financial condition, results of operations, and growth prospects. Given the evolving regulatory landscape, climate-related disclosures are becoming more granular and contain more specific risk factors that address a variety of impacts, such as physical impacts; reputational risk; and regulatory risk, including the effects of the E.U.’s Corporate Sustainability Reporting Directive (CSRD),16 International Sustainability Standards Board (ISSB) IFRS S2,17 and California’s Climate Corporate Data Accountability Act and Climate-Related Financial Risk Act.18