AI-Generated MD&A SEC Requirements: 2026 Compliance Walkthrough

Finance teams using AI to draft MD&A sections are operating under a deceptively simple legal reality: no SEC rule explicitly addresses AI authorship, yet the existing framework creates personal liability for CEOs and CFOs, ICFR control gaps, and comment letter exposure that most companies have not formally addressed. This walkthrough tells you exactly where the risks sit and what governance steps to take before the next 10-K.

Key takeaway: The SEC's Office of the Chief Accountant confirmed on June 4, 2026 that formal AI reminders are coming "in the next few months." They will not be prescriptive rules. They will ask hard questions your team needs to be able to answer now.

What the OCA Said in June 2026 (and Why It's the Lede)

The most current regulatory signal on AI in financial reporting came from OCA Deputy Chief Accountant Michal Dusza at the USC SEC and Financial Reporting Conference on June 4, 2026. Dusza was direct: the OCA is actively monitoring AI use in financial reporting but will not issue prescriptive rules, citing the pace of change as the reason for restraint.

His exact words, as reported by Thomson Reuters Checkpoint: "It's a little bit hard to be prescriptive about this because it is such a quickly evolving area, and there's such a variety of tools... it would be hard to create something, given just the pace of change, something that is prescriptive or definitive."

But he also said this: "Over the next few months, you may be hearing from us in a little bit more formal way, most likely simply in terms of reminders and the right questions to be raised... I do think it's important to pause and ask those questions and make sure that the implementation process is in fact deliberate, thoughtful, and subject to appropriate controls."

That framing matters. The OCA is not coming with a rulebook. It is coming with questions. The compliance gap is not about knowing the right answer to a new rule; it is about being able to demonstrate that your process was deliberate and controlled.

For broader context on the SEC's overall AI posture, including the June 2025 withdrawal of the Predictive Data Analytics proposal, see our SEC AI financial reporting guidance map.

The Legal Framework That Already Applies

AI-generated MD&A is not in a regulatory vacuum. Four existing legal frameworks apply, none of which contain AI-specific safe harbors.

The November 2020 MD&A final rule (Release No. 33-10890) is the most recent substantive update to Item 303. It predates the public availability of large language models by approximately two years (ChatGPT launched November 2022) and contains no AI-specific provisions.

The foundational standard comes from SEC Release No. 33-8350 (December 2003), which remains the primary interpretive authority more than 22 years later: "MD&A should be a discussion and analysis of a company's business as seen through the eyes of those who manage that business. Management has a unique perspective on its business that only it can present. As such, MD&A should not be a recitation of financial statements in narrative form or an otherwise uninformative series of technical responses to MD&A requirements."

That last sentence is a precise description of what AI tools most commonly produce.

Does AI-Generated MD&A Satisfy the "Management's Perspective" Requirement?

The short answer is: it can, but only with substantial human review and editorial control. Unreviewed AI output almost certainly does not.

The "management's perspective" standard requires that MD&A enable investors to see the company through the eyes of management. That is an authorial standard, not just an accuracy standard. The SEC's Division of Investment Management Director Natasha Vij Daly put the tension plainly in a February 2026 speech: "AI is different. The goal of AI is to take the human out of the loop. At least out of the real-time response loop. There will still be humans involved, to be sure, but if we are being honest, they are going to be in a more remote and supervisory role."

If management's role becomes supervisory rather than authorial, the certification that the MD&A reflects management's unique perspective becomes a supervisory attestation over AI outputs. That is a meaningful legal shift that no enforcement action has yet tested.

The practical implication: AI can legitimately assist with drafting, data synthesis, and identifying trends. But the analytical judgments, the selection of what is material, and the characterization of business conditions must come from management. Document that distinction clearly.

The SOX 302/906 Certification Problem

This is the most underappreciated personal liability issue for executives using AI in financial reporting.

Under SOX Section 302, the CEO and CFO certify, among other things, that the filing "does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading." SOX Section 906 carries criminal penalties for knowing or willful violations.

AI hallucinations and model drift create a direct vector into that certification. Consider the specific failure modes:

• Hallucinated figures: An AI tool synthesizing prior-period data may generate a percentage change that does not match the audited financials.
• Stale trend analysis: A model trained on data through a prior quarter may characterize a trend as ongoing when it has reversed.
• Fabricated qualitative context: Generative AI may produce plausible-sounding but factually incorrect characterizations of market conditions or competitive dynamics.

None of these are hypothetical. For a detailed treatment of AI hallucination risk in financial reporting specifically, see our AI hallucination in financial reporting walkthrough.

The governance implication is straightforward: every factual claim, every quantified change, and every trend characterization in an AI-assisted MD&A must be independently verified against source data before the CEO and CFO sign. That verification process needs to be documented.

What Corp Fin Comment Letters Actually Flag (and Why AI Fails There)

The comment letter patterns that Corp Fin has documented for years map almost perfectly onto the known failure modes of AI-generated text.

Deloitte's DART analysis of SEC comment letters on MD&A identifies four recurring deficiency patterns:

1. Failure to quantify material components. Item 303(b)(2)(iii) of Regulation S-K requires that when a change is attributed to more than one factor, each factor must be quantified. AI-generated text routinely uses "primarily" and "partially offset" without numbers.

2. Recitation without analysis. Corp Fin's comment letter language is explicit: "It is not sufficient to merely recite the information that is available on the face of the financial statements without describing the events, transactions and economic changes that materially affected the reported amounts." AI excels at recitation. It struggles with genuine causal analysis.

3. Failure to disaggregate offsetting items. Release No. 33-10890 requires discussion of underlying reasons for material changes "in all situations in which one or more line items in the financial statements reflect material changes from period to period, including those in which material changes within a line item offset one another." AI tools tend to net the result and move on.

4. Vague trend and uncertainty disclosure. Item 303(b)(2)(ii) requires disclosure of known trends or uncertainties reasonably likely to have a material impact. AI-generated language tends toward generic macroeconomic commentary rather than company-specific analysis.

A practical pre-filing checklist for AI-assisted MD&A:

• Every percentage change is traced to a specific line item in the audited financials
• Every "primarily due to" or "partially offset by" statement is followed by a dollar or percentage quantification
• Offsetting items within a single line item are separately identified and quantified
• Trend and uncertainty disclosures name specific, company-identified risks, not generic sector commentary
• No figure in the MD&A contradicts a figure in the financial statements
• Management has reviewed and edited the AI draft, not merely approved it

The ICFR Gap: "Citizen-Led Innovation" and What OCA Is Watching

This is the dimension almost no existing MD&A guidance addresses, and it is where the OCA's June 2026 remarks were most pointed.

Dusza identified three specific AI risk areas in financial reporting that management needs to assess:

1. Third-party service provider AI. "Does management even have the right handle on what these systems are? What kind of assurance do you get from these providers around the AI that may be used in their service offerings?" Many financial reporting software platforms and ERP systems now embed AI internally. Companies may not know their systems are using AI to generate data that feeds the MD&A.

2. Data quality. The reliability of data fed into AI tools is a prerequisite for reliable output. If the underlying data has not been through normal financial close controls, AI-generated analysis built on it is unreliable.

3. Citizen-led innovation. This is the most acute near-term risk. Dusza's words: "That lower barrier to entry, and this sort of citizen-led innovation, how frequently do we update our risk assessment? How much do we understand about AI that may be proliferating throughout our business and financial reporting processes?"

The traditional ICFR model assumes that financial reporting systems are "accessed and changed by a small, appropriate group of people." When a financial analyst uses Microsoft Copilot or ChatGPT to draft the liquidity section of the MD&A without any IT governance or ICFR assessment, that assumption breaks down. The OCA is explicitly watching for this gap.

The OCA confirmed that the COSO framework and existing ICFR guidance are the applicable frameworks for managing AI risk in financial reporting, in the absence of AI-specific guidance. That means companies should be documenting AI tools used in MD&A drafting as part of their ICFR risk assessment and control environment documentation today.

Do You Need to Disclose That AI Was Used to Draft the MD&A?

No SEC rule currently requires disclosure of AI use in the MD&A drafting process itself. But the question is more nuanced than a simple no.

The SEC's IAC panel on AI (May 2024) identified disclosure and transparency as a core AI concern: "If AI systems are used to make investment decisions or generate financial reports, there may be concerns about the transparency and interpretability of these systems. The SEC requires clear disclosure of material information to investors."

That framing suggests the materiality analysis matters. If AI use in drafting creates a material risk of error, or if the company's AI governance process is a material part of how it manages financial reporting risk, disclosure may be warranted under existing materiality principles.

Where companies are disclosing AI use in financial reporting, the disclosure tends to appear in:

• Risk factors (Item 105): describing AI-related risks to the accuracy of financial reporting
• The MD&A itself: when AI costs or AI-related business developments are material
• Proxy statements: in the context of board and audit committee oversight of AI

For the specific question of how to frame AI disclosure in a 10-Q, see our AI disclosure in Form 10-Q walkthrough. For the risk factor versus MD&A allocation question, see our risk factor vs. MD&A decision framework.

Recordkeeping: What Happens to AI Drafts and Prompts

Once an AI-generated draft is incorporated into a 10-K or 10-Q, it becomes a record subject to SEC document retention and potential production in investigations.

Skadden's September 2024 analysis draws a clear line: "AI-generated records that are transmitted through email, chat or otherwise, would trigger retention requirements, assuming the subject matter brings them within the rules."

For corporate filers drafting MD&A, the practical implications are:

• AI-generated drafts transmitted via email or collaboration tools (including Microsoft Copilot outputs shared in Teams or Outlook) are records that should be retained under the company's document retention policy.
• Prompts used to generate MD&A content may be discoverable in an SEC investigation and should be retained alongside the outputs.
• Intermediate drafts that show the evolution from AI output to final certified filing are evidence of the human review process and should be preserved.

Skadden distinguishes AI-generated content retained only internally (less clearly within scope) from content that is transmitted or incorporated into a filing (clearly within scope). The moment a draft goes into the 10-K, the retention obligation attaches.

A Governance Framework Before the Next 10-K

The OCA's reminders, when they arrive, will ask whether your process was deliberate, thoughtful, and subject to appropriate controls. Here is a framework to be able to say yes.

Step 1: Inventory AI tools used in the MD&A drafting process. Document every tool, including embedded AI in ERP and financial reporting platforms. Dusza's question is pointed: does management know what AI is in the systems it relies on?

Step 2: Assess each tool as part of the ICFR risk assessment. Under COSO, any process that affects the reliability of financial reporting is within scope of the control environment. AI tools used in MD&A drafting are not exempt. Document the assessment, even if the conclusion is that existing controls are sufficient.

Step 3: Establish a human review protocol with documented sign-off. Every factual claim in an AI-assisted MD&A should be verified against a primary source (audited financials, board-approved forecasts, signed contracts). The reviewer should document what was checked and when. This is the evidentiary record that supports the SOX 302 and 906 certifications.

Step 4: Apply the Corp Fin comment letter checklist before filing. Run the AI-generated draft against the four deficiency patterns above. If the draft uses "primarily" without a number, fix it. If offsetting items are netted, disaggregate them. Do this before the draft reaches the CEO and CFO, not after.

Step 5: Retain the full documentation trail. Prompts, intermediate drafts, review sign-offs, and the final filed version should all be retained under the company's document retention policy. If the SEC opens a comment letter or investigation, this trail is the difference between a defensible process and an unexplained one.

Step 6: Brief the audit committee. Audit committees are asking questions about AI use in financial reporting that management teams cannot yet answer. Brief the committee on which AI tools are used, what controls govern them, and how they are assessed in the ICFR evaluation. This is also increasingly a proxy disclosure question.

Step 7: Consider reaching out to Corp Fin. The SEC's Division of Investment Management director explicitly invited engagement in February 2026: "To the extent that you have concerns about how our existing laws, rules and regulations constrain your deployment of new technologies, please reach out." For companies with novel AI use cases in financial reporting, a no-action letter or informal staff guidance is an underutilized option.

FAQ

Has the SEC brought any enforcement action specifically targeting AI-drafted MD&A? No public enforcement action specifically targeting AI-drafted MD&A has been announced as of September 2026. The SEC's enforcement actions on AI to date have focused on "AI washing" (misrepresenting AI capabilities to investors) rather than AI use in the drafting process. That does not mean the existing anti-fraud provisions are inapplicable; it means the enforcement risk is currently expressed through comment letters and ICFR scrutiny rather than formal actions.

Does the SEC require companies to disclose that AI was used to draft the MD&A? No current rule requires this disclosure. Whether voluntary disclosure is advisable depends on a materiality analysis: if AI use creates a material risk to the accuracy of financial reporting, or if it is a material part of the company's financial reporting process, disclosure may be warranted under existing principles.

What is the difference between using AI as a drafting tool versus an analytical tool in MD&A? AI as a drafting tool (generating narrative from data management provides) creates a lower legal risk profile if management reviews and edits the output substantively. AI as an analytical tool (identifying trends and uncertainties that management then describes) creates additional risk if the AI's analytical conclusions are not independently verified, because Item 303 requires that trend and uncertainty disclosures reflect management's actual assessment, not a model's output.

Do AI-generated MD&A drafts need to be retained under SEC rules? Once incorporated into a filing or transmitted via email or collaboration tools, yes. Skadden's analysis confirms that transmitted AI-generated content triggers retention requirements. Retain prompts, intermediate drafts, and review documentation alongside the final filed version.

What should the audit committee be asking management about AI use in MD&A drafting? At minimum: which AI tools are used, whether they have been assessed as part of the ICFR risk assessment, what human review process governs AI-generated content before certification, and whether third-party financial reporting software embeds AI that management has not separately evaluated.