How Does the MIT AI Risk Initiative Track Company AI Risk Disclosures?

Updated

The MIT AI Risk Initiative tracks company AI risk disclosures by reviewing the public documents of 200 of the world's largest companies and recording which of 24 AI risks each one acknowledges. The results are published as a browsable dataset that you can compare against the Initiative's expert survey of which risks matter most. Use it when you want evidence of where corporate disclosure and expert priorities diverge, rather than a compliance score or a legal judgment about any company.

What the disclosure dataset covers

The site describes the company disclosures tool as showing "which of 24 AI risks 200 of the world's largest companies acknowledge in their public documents, and how that compares with what experts say matters most."

That definition sets the boundaries of the dataset:

  • Unit of analysis: a company, drawn from the world's largest firms by the site's own selection.
  • Evidence base: public documents, not interviews, audits, or internal records.
  • What is recorded: acknowledgment of a risk — whether the company names or addresses it — not the quality or effectiveness of any mitigation.
  • Fixed risk list: 24 risks, which lets you compare companies and risks on the same footing.

A company appearing in the dataset therefore means its public materials mention a given risk. It does not mean the company manages that risk well, and absence from the dataset does not prove a company ignores the risk — only that the reviewed documents did not acknowledge it.

How the comparison with expert consensus works

The disclosure data is designed to be read next to the Initiative's expert survey, which reports "expert consensus on which AI risks are expected to have the most severe harms, who is most vulnerable, and who is responsible for addressing them."

The comparison answers a practical question: are companies disclosing the risks that experts rank as most severe? The site frames the disclosure tool around exactly this gap — how corporate acknowledgment "compares with what experts say matters most." Two patterns are worth looking for:

  1. High-severity risks with low disclosure. Experts rank a risk as severe, but few of the 200 companies acknowledge it. This is the clearest signal of a disclosure gap.
  2. Widely disclosed risks that experts rank lower. Many companies mention a risk, but it sits lower in the expert ranking. This can indicate disclosure shaped by reputational or legal fashion rather than severity.

Because both datasets use the same risk taxonomy, the comparison is like-for-like. That shared structure is the main reason the two tools are useful together rather than separately.

How to explore company disclosures and mitigations

The site does not publish a step-by-step manual for the disclosure tool, so the following is a practical sequence based on what the tool is described to contain. Expect the exact filters and labels to match the live interface.

  1. Open the company disclosures tool from the "Our tools and data" section of the homepage.
  2. Pick a risk from the 24-risk list to see which companies acknowledge it. Starting from a risk rather than a company is usually faster when you are testing the disclosure gap.
  3. Pick a company to see the set of risks it acknowledges across its public documents.
  4. Read across to the expert survey for the same risk, and note whether the severity ranking and the disclosure count point in the same direction.
  5. Check the mitigation and response material. The site's navigation includes "Responses," "Mitigations," and "Governance" alongside "Company Disclosures," so related information on how risks are addressed sits in adjacent collections rather than only in the disclosure view.
  6. Use the AI Risk Navigator to move between datasets. The site describes it as connecting "our datasets so you can move between them and surface the patterns that matter" — useful when you want to follow one risk from expert ranking to company disclosure to incidents.

What to verify before relying on a result: confirm the document set and date range behind a company's entry, since disclosure is a snapshot of public materials at review time. A company that published a new AI policy after the review will not show it.

Where this fits alongside the other tools

The disclosure dataset is one of several connected collections. The homepage lists tools for expert priority rankings, a living repository of AI risks, real-world incidents, and global AI laws and policies mapped against the risks they address. The disclosure view is the corporate-behavior layer: laws show what is required, incidents show what has gone wrong, and disclosures show what companies say about risk.

For a governance or policy audience, the most defensible use is triangulation — a risk that experts rank as severe, that appears in incident data, and that few companies disclose is a stronger case for attention than any single dataset alone. The Initiative's stated purpose, "authoritative data and frameworks to help you identify, prioritize, and manage the risks from AI," matches that layered reading rather than any single score.

Limits to keep in mind

  • Disclosure is not performance. The dataset records acknowledgment in public documents; it does not measure whether mitigations work.
  • The company set is fixed at 200 of the largest firms, so smaller developers and open-source actors are outside the frame.
  • The 24-risk list is the Initiative's taxonomy. Comparisons are valid within the site's framework; mapping to another taxonomy requires care.
  • Public documents change. Treat any figure as a snapshot and check the review date before citing it in a decision.