‘AI-Washing’: Public Company SEC Enforcement Action and Disclosure Considerations

Recent enforcement action — believed to be the first against a public company — highlights risk of potential ‘AI-washing’ and SEC’s elevated scrutiny of the accuracy of AI-related public statements, including filed disclosures

SEC Enforcement Action

AI-related disclosures have nearly doubled in public company annual reports from 2023 to 2024, spanning a variety of sectors, largely in the risk factors, business and MD&A sections. As investor interest in AI has surged, over the past year senior SEC officials, including the agency chair and directors of the Division of Corporation Finance and the Division of Enforcement, have expressed concerns about the quality and credibility of corporate AI disclosures, repeatedly warning companies against the risks of “AI-washing” (when a company makes exaggerated or unfounded claims about its AI capabilities or the role of AI in its business to mislead the market). The multiple, agency-wide warnings have signaled that public companies across all industries should prepare for continued SEC (as well as investor and other stakeholder) scrutiny of their AI-related disclosures and other public statements, including in press releases, social media posts, investor presentations, marketing materials and earnings calls.

On January 14, 2025, the SEC announced settled charges against Presto Automation Inc. (Presto), a restaurant-technology company, for allegedly making numerous materially false and misleading claims in SEC filings and public statements about critical aspects of its flagship artificial intelligence product, Presto Voice, which employs AI-assisted speech recognition technology to automate aspects of drive-thru order-taking at quick-service restaurants. The company was also charged with failing to establish and maintain required disclosure controls and procedures. Presto became publicly traded through a September 2022 de-SPAC transaction, and was listed on Nasdaq until September 2024 (it now trades over-the-counter). This is believed to be the SEC’s first “AI-washing” enforcement action against a public company.

Based on the company’s current financial condition, cooperation during the agency’s investigation and subsequent remedial efforts (including improving the accuracy and completeness of its AI-related disclosures in subsequent SEC filings), no civil penalty was imposed.

As alleged in the SEC order:

The Company Failed to Adequately Disclose That It Did Not Own or Operate the Voice AI Technology Powering Presto Voice at Its Largest Customer

• Presto’s statements regarding the technology powering Presto Voice were misleading because the company failed to disclose that, from November 2021 to September 2022, the AI speech recognition technology in all units of Presto Voice that the company had then commercially deployed was actually owned and operated by a third-party supplier. The company deployed these units at restaurants of its largest Presto Voice customer.
• The order cites several examples of the company’s public statements during this time. A company press release, for instance, contained numerous references to “Presto’s voice ordering solution,” “Presto’s next generation solutions,” “Presto’s automated voice ordering technology” and “Presto’s solution.” The press release referred to the third-party supplier only once when it described developing the solution in partnership with Hi Auto, a reference that did not adequately disclose either the role of the third-party supplier in powering Presto Voice or the extent of the company’s reliance on the supplier’s technology.
• In addition, in multiple registration statements/prospectuses and other SEC filings during this time period, the company referred to Presto Voice (powered by the third-party supplier’s technology) as, variously, “Presto’s speech recognition technology,” “Presto’s Voice product” and “our technology.”
• The SEC asserted that these statements “were materially misleading because they implied that Presto was using its own technology to power Presto Voice and failed to disclose that the voice AI technology that powered all Presto Voice units during this time period was owned and operated by [a third-party supplier]. Even though Presto made limited disclosures about [the third-party supplier] in certain of its filings, these disclosures did not contain sufficient information to inform investors about the extent of Presto’s reliance on [the third-party supplier] to power Presto Voice units deployed at restaurant locations of Presto’s largest customer.”

The Company Falsely Claimed That Presto Voice Eliminated Human Order-Taking

• Subsequently, around September 2022, the company did deploy Presto Voice units powered by its own proprietary AI speech recognition technology with certain customers, but it falsely claimed that its own AI product eliminated the need for human order-taking. In reality, Presto Voice units powered by Presto’s proprietary voice AI technology lacked the capability to take orders on their own and required substantial human involvement. The company hired, trained and supervised human order-takers located abroad (primarily in the Philippines and India), who processed the vast majority of drive-thru orders placed through Presto Voice.
• The order notes that the company’s extensive reliance on humans to power its proprietary version of Presto Voice was well known inside Presto throughout 2022 and beyond. For example, on January 20, 2022, a Presto executive messaged another company executive explaining that “with HITL [humans in the loop], accuracy is not a major concern” and “…can even get to 95% or more with humans.” The conversation continued on January 21, 2022 with the Presto executive messaging that “[w]e’ll only be transitioning to our own Presto solution when we’ve nailed the HITL [humans in the loop] and have comparable accuracy/latency.”

The Company’s Presentation of Data Measuring Human Involvement in Customer Order Completions Was Misleading

• The company also claimed that it had achieved an exceptionally high rate of orders completed without human intervention with units of Presto Voice powered by its proprietary technology. In investor presentations and other public filings, the company used the terms “automated order completion” rate and “non-intervention” rate interchangeably to describe the capabilities of Presto Voice. The company’s use of these terms created the misleading impression that Presto Voice completed drive-thru orders without any (or with very limited) human involvement at the rates the company disclosed. In reality, the company’s reported “automated order completion” and “non-intervention” rates referred to rates at which drive-thru orders were completed without restaurant staff involvement (but not without any human involvement, such as human intervention at off-site locations).
• The company’s reports of similar rates with respect to units powered by the third-party supplier’s AI technology were misleading because the company failed to disclose that those rates were achieved in reliance on third-party technology.
• The order notes that, during the time period in which the company reported “automated order completion” and “non-intervention” rates to investors, certain Presto executives identified the potential for these terms to create confusion and misunderstanding among the company’s investors and customers. For example, in October 2022, a senior Presto executive messaged a group of other Presto executives that the company should not refer to “automation rate with customers because it infers no supervision which isn’t true.” A discussion among Presto executives ensued regarding whether “automated completion rate,” “intervention rate” or other terms were most appropriate to use with customers. In January 2023, another Presto executive raised concerns that the company was “telling investors Presto AI is running 95%+ accuracy without disclosing AI is doing NONE of the work and all orders are processed by humans.” Similar concerns were voiced internally by several other senior company executives.

After the SEC Began Investigating Presto, the Company Disclosed the True State of Its Technology and Relationship with the Third-Party Supplier

• After learning that the SEC staff began an investigation regarding the accuracy of Presto’s disclosures of its technology, the company disclosed additional information in SEC filings from October to December 2023. These disclosures explained the extent of the company’s relationship with the third-party supplier and its reliance on humans to complete orders placed through Presto Voice units powered by the company’s proprietary technology.
• Specifically, in a Form 10-K filed in October 2023, the company included specific disclosures regarding its relationship with the third-party supplier, including the supplier’s identity and that its voice AI technology powers Presto Voice units deployed at the restaurant locations of Presto’s largest customer. The company also disclosed for the first time that Presto Voice utilized human agents located off-site to “enter, review, validate and correct orders received by Presto Voice” and that the use of human agents was “to ensure that the desired level of accuracy in order taking is achieved.”
• In additional filings in November and December 2023, the company disclosed for the first time that “over 70% of orders taken by our Presto Voice solution require human agent intervention” and subsequently clarified that the 70% of orders that required human agent intervention referred to orders at the few locations where the most advanced version of Presto Voice was being piloted, and that human agent intervention was required on 100% of orders at the substantial majority of locations where the original version of Presto Voice units was installed.

The Company’s False and Misleading Statements Were Material

• The order highlights that an analyst who covered Presto’s stock did not know the extent to which humans were involved in taking the majority of Presto Voice orders until reading the new disclosures in the company’s November 2023 SEC filing. Prior to these disclosures, the analyst also understood the company’s statements about “automated order completion” and “nonintervention” rates to refer to rates of any human intervention in the order-taking process, not just restaurant staff intervention. The analyst would have considered this information to be material in assigning a rating to Presto’s stock.
• Other investment professionals expressed to the company that its public disclosures may not have included information they considered to be material. For example, in August 2023, employees of an investment bank were left with basic questions about important facts relating to the company’s relationship with the third-party supplier after analyzing an SEC filing that provided incomplete information about the relationship. The investment bank employees requested that the company explain, among other things, whether the third-party supplier was “providing the underlying AI technology” powering Presto Voice and whether there were any Presto Voice customer agreements “where Presto owns the entire underlying tech stack.”

SEC Disclosure Expectations

Although existing SEC disclosure requirements do not explicitly refer to AI, through comment letters, public statements and enforcement actions, the staff has emphasized the following:

• Existing SEC rules and regulations may require AI-related disclosure in numerous sections of companies’ periodic reports, including business, risk factors, MD&A and the financial statements.
• Discussions about AI in board meetings, earnings calls and investor presentations suggest materiality, and companies should consider providing corollary disclosures in SEC filings.
• Companies should clearly define for investors what they mean when referring to AI in the context of their specific business. Include definitions of, or clearly explain, industry-specific technology such as machine learning, algorithms, generative AI, deep learning and large language models. Specify how and where it is being used in the company, and whether it is being developed by the company or supplied by others. Discuss involvement of third parties. Avoid “generic buzz” unrelated to the company.
• Companies should have a reasonable basis for their claims about how AI could improve their results of operations, financial condition and future prospects, and they should disclose this basis to investors. Ensure disclosures are supported with internal documentation.
• Disclosures about the opportunities associated with the use of AI should be balanced in presentation with the related risks. Companies should include a discussion of the potential limitations, obstacles and uncertainties associated with AI adoption and deployment.
• Companies should provide tailored and specific (rather than boilerplate or generic) information about material AI risks reflecting the company’s unique circumstances and challenges, considering factors such as company size and the stage of AI integration, and the reasonably likely impacts of AI technology on their business and financial results.
  • The Acting Director of the SEC’s Division of Corporation Finance has noted that a recent staff review of AI risk factor disclosures prepared by leading public companies found that most were generic and not tailored to the specific nature of their business, despite the fact that AI’s impact depends on a company’s particular size and needs.
  • AI-related risks can include operational, legal/regulatory, competitive, cybersecurity, ethical/reputational and third-party risks, among others. In particular, companies should consider addressing operational and market dynamics, cybersecurity, data privacy, intellectual property issues, potential for discrimination and bias, litigation, the cost of complying with international, federal and state AI regulations, consumer protection concerns and labor requirements. If applicable, companies should discuss how not implementing AI in their products and services could cause a competitive disadvantage relative to other companies.
• For AI risks determined to be material, companies should consider providing disclosures about their AI risk management and corporate governance policies, including the board’s role in risk oversight (if applicable).

In addition, the SEC staff has stated it will compare what management says about the use and impact of AI on earnings calls and in other public statements to AI-related disclosures included in the company’s annual report and other SEC filings to ensure there is a consistent message. Accordingly, companies should confirm their AI-related claims are uniform across speakers, business lines and communication platforms.

In recent comment letters, the staff has asked companies to provide additional context or more specificity for their AI-related disclosure; to revise their disclosure to provide a more balanced discussion of AI (including of the potential limitations, obstacles and uncertainties associated with AI adoption, use and commercialization); to explain their basis for making AI-related performance claims; to provide definitions of industry-specific terminology; to clarify whether the AI was developed by the company or supplied by a third party; and to discuss any material AI-specific risks (including operational, legal and competitive).

For more information about assessing AI-related risks, see our client alert.