Your 2025 Form 10-K roadmap

Trading policies

In December 2022, the SEC adopted final rules amending Form 10-K to require disclosure relating to whether a company has adopted (and if not, an explanation of why not) insider trading policies and procedures governing the purchase, sale and other dispositions of the company’s securities by insiders or the company itself, and for the company to file its insider trading policy as an exhibit to Form 10-K. The insider trading policy and related disclosure requirement applied beginning with the 2024 10-K filed in 2025 for companies on the calendar year (see Items 408(b) and Item 601(b)(19) of Regulation S-K). The trading policy must be filed as exhibit 19 to Form 10-K, and Item 408(b) disclosure must be tagged in Inline XBRL.

Companies can include Item 408(b) disclosure in their Form 10-K as part of Part III Item 10, or they can opt to incorporate by reference the required disclosure from their proxy statement like they do for any other Part III disclosure. But note the proxy statement independently requires Item 408(b) disclosure even if that disclosure appears in the Form 10-K.

In addition, we have seen companies address trading by the company itself (in particular where trading by the company is not explicitly covered in the company’s insider trading policy) with a short statement to the effect that it is the company’s policy to comply with applicable securities laws, including insider trading laws, when engaging in transactions in the company’s securities.

The rules adopted in 2022 also added a quarterly disclosure requirement relating to both Rule 10b5-1 and non-Rule 10b5-1 trading plans adopted, modified or terminated by directors and officers during the applicable quarterly period. Companies on the calendar year began disclosing this information in 2023, and should ensure they include the relevant disclosures for the fourth quarter of this year in their 2025 10-K.

Cybersecurity

In July 2023, the SEC adopted final rules that mandate cybersecurity incident and risk management disclosures for public companies. On risk management, the final rules require public companies to make annual disclosures in Form 10-K to describe the company’s (i) processes to assess, identify and manage cybersecurity risks, (ii) board oversight of such risks and (iii) management’s role and expertise in assessing and managing such risks, in addition to describing whether any risks from cybersecurity threats have materially affected, or are reasonably likely to materially affect, the company (see Item 106 of Regulation S-K and Item 1C in Form 10-K). Companies on the calendar year began including these disclosures in their Form 10-K filed in 2024 (disclosure must be tagged in Inline XBRL).

Read our client updates SEC adopts cybersecurity disclosure mandates for public companies for further detail.

Clawback rule guidance

The SEC adopted final rules in October 2022 that directed U.S. stock exchanges to adopt listing standards requiring all listed companies to adopt and comply with a written clawback policy. The NYSE and Nasdaq adopted listing standards relating to clawbacks requiring listed companies to have a compliant clawback policy by December 1, 2023 (and that policy must be filed as exhibit 97 to the Form 10-K). Form 10-K was also amended to add check boxes indicating (1) whether the company’s financial statements included in the filing reflect correction of any error to previously issued financial statements and (2) whether any of those error corrections are restatements that required recovery analysis of incentive compensation.

In response to technical questions around circumstances that require companies to check one or the other checkbox as well as clawback disclosure requirements, SEC staff issued guidance earlier this year. The clawbacks-related C&DIs clarify when registrants should or should not check the checkboxes related to clawbacks in the Form 10-K cover page (Questions 104.20, 104.21, 104.22, 104.24 and 104.25), the inclusion of Item 402(w)(2) disclosure in the proxy statement (Question 104.22) and inclusion or incorporation by reference of Item 402(w)(2) disclosure from the proxy statement in the annual report (Questions 104.23 and 104.25).

The clarifications hew closely to the rule and its adopting release. For example, the C&DIs make clear that, if there is a “Big R” or “little r” restatement to a company’s financial statements, then the company should mark the checkbox indicating that a clawback analysis was required, even if no incentive-based compensation was received by an executive officer during the relevant time frame or the compensation was not based on a financial reporting measure impacted by the restatement.

ESG updates

In September, the Eighth Circuit issued an order continuing a hold on petitions for review of the SEC’s climate disclosure rules, which are currently stayed as part of a broadly litigated rule challenge. The order shifts the burden to the SEC, which had informed the court in July that it did not intend to review or reconsider the rules. The court’s order effectively requires the SEC to resume defense of its rules or propose new rules, stating that it is the SEC’s “responsibility to determine whether its [f]inal [r]ules will be rescinded, repealed, modified, or defended in litigation.” The court’s order, however, did not specify the timeframe in which the SEC’s determination has to be made. It remains to be seen how the SEC will decide to proceed.

Companies should continue to take note of disclosure mandates adopted in the European Union that will impact U.S. companies that conduct business in the EU, as well as the series of climate-related legislation in California, including S.B. 253 (requiring reporting of greenhouse gas emissions) and S.B. 261 (requiring reporting of climate-related financial risks).

While the California Air Resources Board (CARB) has held three public workshops and issued several draft guidance documents relating to the two laws, certain key terms and interpretive questions still remain unresolved. Although CARB expects to finalize regulatory text relating to fees and compliance dates for S.B. 253 during the first quarter of 2026, the legal challenges seeking to invalidate the laws continue to proceed in the federal courts. On November 18, the Ninth Circuit issued an injunction pending appeal against S.B. 261, which would have required in-scope companies to publish “climate-related financial risks” reports by January 1, 2026. The injunction does not apply to S.B. 253.

In-scope companies should ensure that any reporting under S.B. 253 and S.B. 261, if ultimately upheld, is consistent with their climate-related disclosure in SEC reports, including their Form 10-K.

A client update on the most recent CARB guidance on these laws will be forthcoming.

Staff accounting policy on treatment of crypto assets

In January, the SEC issued SAB 122, which rescinded SAB 121, a controversial 2022 accounting policy that required a public company with responsibility for safeguarding crypto assets to recognize liabilities for those assets on its balance sheet. We had argued for the withdrawal of SAB 121 in a client update published soon after the 2024 election. Fully retrospective application is required in annual periods beginning after December 15, 2024, though earlier adoption is permitted.

Read our client update Seven easy pieces for the new SEC chair for a more detailed discussion.

Artificial intelligence

The SEC continues to be focused on disclosure around artificial intelligence, or AI, including “AI washing,” or making potentially false or misleading AI-related claims. As an increasing number of companies discuss AI in their periodic reports, often in the risk factors or business descriptions, or both, in addition to MD&A, companies should consider a principles-based (or materiality-focused) disclosure approach about how a company uses AI and both the opportunities and risks related to its use (including disclosure in the business section, risk factors, MD&A and financials). Commissioner Hester Peirce touted the “value of affording companies the discretion to make disclosures based on what is material to their particular circumstances” in a statement about AI disclosure in March 2025.

While the current Division of Corporation Finance has not issued new guidance on the topic, past guidance indicates that SEC staff might consider whether a company:

• Clearly defines what it means by AI and how it could improve the company’s results of operations, financial condition and future prospects.
• Provides tailored (and not boilerplate) disclosures around AI, commensurate with how material AI is to the company, about material risks and the impact of AI on the company’s business and financial results.
• Focuses on the company’s current or proposed use of AI rather than “generic buzz” unrelated to its business.
• Has a reasonable basis for claims around AI prospects.

Companies should also consider applicable AI legislation adopted in other states, in the European Union or other jurisdictions and update their AI-related disclosures to the extent they are impacted by this legislation. For example, read our client update European Parliament approves AI Act for a discussion of the AI Act and its implications. 

Geopolitical conflicts and related risks

In May 2022, the Division of Corporation Finance published a sample comment letter stating that companies may have disclosure obligations under the federal securities laws related to the direct or indirect impact that Russia’s invasion of Ukraine and the international response thereto have had or may have on their business.

Since Russia’s invasion of Ukraine, many companies have experienced heightened cybersecurity risks, increased or ongoing supply chain challenges and volatility related to the trading prices of commodities (regardless of whether they have operations in Russia, Belarus or Ukraine) that may warrant disclosure.

While the conflict in the Middle East has deescalated, if a company has any business exposure in the region, it should consider including disclosure of the potential (or actual) impact on its business and related risks stemming from any ongoing risks.

Inflation and interest rates

Inflation has affected and continues to affect companies in different industries. While inflationary pressures appear to have eased, current economic conditions and uncertainty might require additional disclosure beyond what has historically been provided in a more steady-state economic environment. Companies should consider additional disclosure in MD&A trends, or otherwise in the period-on-period discussion, focused for example on how these trends have affected results of operations, sales, profits, capital expenditures or a company’s business and pricing strategy in the face of rising costs.

In addition, the cost of borrowing continues to be high for many companies relative to what it was for several years before 2022. Companies should consider updating disclosure (particularly in risk factors and MD&A) to reflect any continuing impact they are experiencing from current levels of interest rates and their ability to access capital markets.

Discrepancy between earnings calls and periodic filings

In comment letters related to customary 10-K reviews, SEC staff has focused on discrepancies between disclosure in the MD&A section and statements made in an earnings call (including related earnings releases and investor presentations). The SEC has questioned, among other matters, why a company strategy referenced in an earnings call is not discussed in MD&A, whether metrics discussed on an earnings call are key performance indicators that also ought to be included in periodic filings, or whether a revenue stream discussed on an earnings call deriving from certain activities that do not consistently fall within a particular segment should be broken out in the notes to the financials included in periodic filings.

Given the scope of the SEC’s review process and focus on statements made by companies in earnings calls, when drafting MD&A or other disclosure in periodic filings, a company should consider whether the disclosure in its periodic filings, including the Form 10-K, captures material information discussed or to be discussed on earnings calls so that there are no material discrepancies between statements made on those calls and disclosure in SEC filings.

Refer to our client update SEC issues disclosure guidance on key performance indicators and metrics in MD&A for a discussion of the SEC’s 2020 interpretive guidance on MD&A.

Non-GAAP financial measures

In December 2022, the SEC’s Division of Corporation Finance posted new and updated C&DIs on non-GAAP financial measures that companies should review, in particular if they present non-GAAP measures in their Form 10-K. Even in the absence of new guidance since then, non-GAAP measures continue to feature prominently in SEC comment letters. They could therefore benefit from careful review for compliance with the relevant rules and guidance.

As a reminder, Item 10(e) of Regulation S-K applies to Form 10-K filings. It requires:

• Presentation of the most directly comparable GAAP metric “with equal or greater prominence.”
• A quantitative reconciliation of the differences between the non-GAAP and GAAP metrics “by schedule or other clearly understandable method.”
• Explanation of the reasons management believes the non-GAAP metric provides useful information to investors.
• Explanation of the additional purposes, if any, for which management uses the non-GAAP metric.

Item 10(e) of Regulation S-K prohibits:

• Excluding any charge or liability that requires cash settlement from a non-GAAP liquidity measure, other than EBIT and EBITDA.
• Adjusting a non-GAAP performance measure to omit an item identified as “non-recurring,” “infrequent” or “unusual,” if the item is reasonably likely to recur within two years or there was a similar item in the past two years.
• Presenting a non-GAAP metric on the face of the GAAP financial statements or in the accompanying notes, or on the face of any required pro forma financial statements.
• Using titles or descriptions that are the same as, or confusingly similar to, titles or descriptions for GAAP financial measures.

SEC staff have in the past indicated that the lack of “equal or greater prominence” (which generally means GAAP discussion should precede non-GAAP discussion) continues to be a top area where they identify non-compliance with the rules.

Refresh risk factors, forward-looking statements and MD&A trends

Over the course of this year, companies and their boards rightly focused closely on the changing landscape of tariffs and the related impact on their business, including on the risks presented by the uncertainty around both the extent of the U.S. tariffs and any retaliatory measures adopted in response. Some companies pulled guidance earlier this year in response to the uncertainty. Because many companies have already included related disclosure in their current or quarterly reports filed over the course of this year, including in MD&A, they can and should leverage those disclosures and update them as appropriate in their Form 10-K, tailored as needed for the specific impacts on their business.

In addition, the government shutdown that began on October 1 and continued for six weeks was the longest in U.S. history. If the shutdown impacted or is expected to impact a company’s business in the fourth quarter of this year – for example by causing travel disruptions impacting a company’s operations or a delay in regulatory approvals or federal contracting on which the company is dependent – a company should disclose, if material, the extent of the impact on its business, financial condition and results of operations.

• Risk factors. Companies are required to include a discussion of the material factors that make an investment in the company speculative or risky. Risks that have begun to materialize should not be presented as hypothetical. This means companies should take care not to say certain events “could” or “may” occur if they have already occurred. Instead, risk factors should describe how a risk has materialized and what the impact has been on the company, guided by the facts and circumstances.
  
  The risk factors disclosure could benefit from a fresh review to ensure material risks facing the company are appropriately disclosed, including risks stemming from artificial intelligence (such as risks and opportunities relating to using or not using generative AI), as well as any risks facing a company from the impact of tariffs or the ongoing war between Russia and Ukraine, as discussed above.
• Forward-looking statements. Companies can gain protection from liability by taking advantage of the safe harbor for forward-looking statements. But to do so, the cautionary language relating to any forward-looking statement should identify important factors that could cause actual results to differ materially from those in the forward-looking statements and be specifically tailored to the particular forward-looking statements. General boilerplate warnings are not sufficient. Consider whether the factors identified in last year’s 10-K continue to apply (or apply in the same way), and whether others might be added particularly to reflect updates made to risk factors.
• Management’s discussion and analysis. Companies are required to describe in their MD&A any known trends or uncertainties that have had or that are reasonably likely to have a material favorable or unfavorable impact on net sales or revenues or income from continuing operations, as well as any known trends or demands, commitments, events or uncertainties that will result in or that are reasonably likely to result in the company’s liquidity increasing or decreasing in any material way and any known material trends, favorable or unfavorable, in the company’s capital resources.

Read our client update SEC issues disclosure guidance on key performance indicators and metrics in MD&A for a discussion of the SEC’s 2020 interpretive guidance on MD&A.

10-K filing deadlines for calendar year companies

Large Accelerated Filer: March 2, 2026 (or 60 days after fiscal year end)

Accelerated Filer: March 16, 2026 (or 75 days after fiscal year end)

Non-Accelerated Filers: March 31, 2026 (or 90 days after fiscal year end)

These deadlines account for the fact that under SEC rules, a filing due date that falls on a weekend or a federal holiday extends the filing deadline to the next business day.

Confirm your filer status

Confirm your filer status – whether large accelerated, accelerated, non-accelerated, EGC and/or SRC. Note that in March 2020, the SEC adopted amendments to the accelerated filer and large accelerated filer definitions in Rule 12b-2 under the Securities Exchange Act of 1934, or the Exchange Act. A summary of the amendments is available here.

Public companies need to consider their public float as of the end of their second fiscal quarter (June 30 for calendar year-end companies) as part of their filing status test. The public float on June 30, 2025 (and other criteria) in turn will determine a company’s 2026 filer status, which impacts, among other things, the due dates for periodic reports next year.

SEC staff released guidance relevant to SRCs addressing when changes in a company’s status as a “smaller reporting company” under the revenue test in Rule 12b-2 result in the company becoming an accelerated filer or large accelerated filer. The staff noted that if an issuer determines as of the last business day of its second fiscal quarter that it no longer qualifies as a smaller reporting company under the revenue test, it nevertheless remains eligible to file as a smaller reporting company for the remainder of that fiscal year and until its first Form 10-Q of the following year.

Mind your XBRL disclosure

Check with your financial printer to confirm how much lead-time will be required to complete XBRL tagging. The SEC has been expanding the scope and types of disclosure that require XBRL and/or Inline XBRL tagging, including, for example, the rules on clawbacks as well as for cybersecurity and 10b5-1 plans / trading policy disclosure.

The Division of Corporation Finance posted a sample comment letter regarding companies’ XBRL and Inline XBRL disclosure obligations. Among other things, the letter reminds companies to properly tag their disclosure in Inline XBRL. The letter goes on to flag other XBRL requirements that companies may have overlooked in their filings.

Separately, the SEC’s Office of Structured Disclosure posted a statement which noted that some companies are incorrectly tagging basic and diluted earnings-per-share data and reminded issuers to review their tagging of EPS data and make necessary corrections. The SEC also has flagged recent errors in tagged public float data reported by companies on their Form 10-Ks.

These technical requirements are likely not high on the list of companies’ priorities, but the failure to comply with XBRL tagging requirements could impact their eligibility to use short-form registration statements, so they would be well-advised to understand when tagging is required and ensure their filing agents are focused on the requirements.

Check for broken links

The SEC’s EDGAR Communications Office posted a reminder (updated in June 2024) reminding companies to confirm that the internal links (including links in exhibits) in their EDGAR filings are working properly before submitting filings on EDGAR. In addition, the announcement emphasized that companies should check whether existing filings have broken links and that they should fix these links. It is an often-missed point in the flurry to meet filing deadlines, so companies should work with their financial printer or other filing agent handling their filings to check internal links once there is an advanced proof to avoid any errors or a last-minute rush.

Item 405 and disclosure of late beneficial ownership reports

Regulation S-K Item 405 requires disclosure of any late filing or known failure by an insider to file a report required by Section 16. This is Part III disclosure that companies are likely to include in their annual proxy statement and incorporate it by reference into their Form 10-K. We include the requirement here to highlight that the SEC does pay attention to compliance with this disclosure requirement, as evidenced by the most recent SEC enforcement sweep in 2024. Companies should closely track delinquent filings, if any, to ensure compliance with Item 405 disclosure requirements whether in their Form 10-K or their proxy statement.

Read our client update SEC announces enforcement sweep targeting late beneficial ownership and insider transaction reports for more detail on the recent enforcement sweep.

Description of registrant’s securities

Confirm that the description required to be included as an exhibit to Form 10-K accurately reflects the underlying documents (such as the charter, bylaws and certificate of designations) and that it is current. Many companies have recently adopted amendments to their bylaws (such as advance notice bylaw provisions and other changes), which may require an update to their existing disclosure.

SOX certifications

Confirm that the CEO’s and CFO’s SOX certifications track the certification language required by Sections 302 and 906 of the Sarbanes-Oxley Act.

Signatures

The SEC allows use of electronic (rather than manual) signatures, including for Form 10-K. But there are attestation requirements for the first use of an electronic signature and specific procedures that must be followed afterwards, which are set forth in Rule 302(b) of Regulation S-T. In addition, Rule 302(b)(2) requires the manually signed attestation form to be retained for a minimum of seven years after the date of the most recent e-signed document.

Read our client update SEC to permit electronic signatures in filings for more information on the requirements relating to electronic signatures.

The new SEC’s Spring 2025 regulatory agenda did away with the prior administration’s rulemaking priorities like human capital management and corporate board diversity rules, focusing its rulemaking efforts instead on easing compliance burdens for companies and facilitating capital formation, including by simplifying pathways for raising capital. An ambitious deregulatory agenda promises to take shape in 2026, including initiatives to rationalize disclosure practices focused on executive compensation and making quarterly reporting optional, though some rulemaking initiatives could be delayed by the government shutdown.

Read our client update Davis Polk submits comment letter on the SEC’s Roundtable on Executive Compensation Disclosure Requirements for a discussion of the comment letter we submitted following the Roundtable on Executive Compensation Disclosure Requirements in June 2025.

This year marked a transition for the SEC Division of Enforcement under the leadership of new Chairman, Paul Atkins. Chairman Atkins has made clear that he intends to reorient the SEC’s enforcement priorities, with a renewed focus on fraud and other egregious misconduct that genuinely harms investors. Chairman Atkins also has made procedural changes to the investigative process that gives the Commissioners greater oversight of enforcement activities.

Public company enforcement is a core area of focus, and the SEC likely will continue to investigate traditional accounting and financial reporting matters, but we do expect a shift away from enforcement actions premised on emerging disclosure areas such as ESG. We also think it is unlikely the Atkins Commission will pursue aggressive internal controls theories against public companies that were asserted by the prior administration. Another area of focus is likely to be insider trading, which can implicate conduct by executives and employees of public companies.

The SEC also announced the creation of a new Cyber and Emerging Technologies Unit earlier this year, signaling a shift away from a focus on crypto enforcement and a possible return to traditional cybersecurity issues, including fraudulent cybersecurity disclosures by public companies.

Read our client update SEC repurposes Crypto Assets and Cyber Unit for a more detailed analysis.

Ongoing SEC focus on AI washing

The SEC continues to focus on AI-related disclosures and AI washing. In April, the SEC filed a complaint charging the former CEO of a mobile shopping application with defrauding investors of over $40 million by making misleading claims about his company’s use of AI. The former CEO allegedly told investors that the application used automated technology that used AI to complete purchases without human involvement, whereas in reality most orders were input manually by contract employees. In product demos for investors, the company is alleged to have made it falsely appear that the app was automatically completing purchases, when in fact company engineers processed the orders behind the scenes manually. The SEC’s complaint charges the former CEO with violations of Section 17(a) of the Securities Act and Section 10(b) and Rule 10b-5 under the Exchange Act.

The case serves as another reminder that claims relating to the use of AI may be scrutinized so companies should ensure that their disclosures relating to how they leverage AI are accurate and well-supported.

Focus on fraudulent conduct involving disclosures

In September, the SEC brought claims against the former Chief Medical Officer (CMO) of a pharmaceutical company for alleged misstatements about the effectiveness of the company’s primary drug candidate. The SEC also brought and settled claims against the pharmaceutical company for similar statements.

According to the SEC, between November 2019 to April 2021, the company and its CMO made multiple misstatements about the test results for its primary drug candidate. The defendants allegedly claimed that the drug provided more effective treatment than its competitors, but failed to disclose that the results were based on post-hoc changes to the analyses. The SEC also alleged that defendants falsely claimed that the FDA had approved of its earlier methodology for analyzing test results. After the CMO’s departure, the company acknowledged the post-testing modifications in an April 2021 press release and provided more accurate results related to the drug’s effectiveness. The company agreed to pay a civil penalty of $1,250,000.

The enforcement action is illustrative of the new SEC’s turn away from aggressive controls theories and focus on fraudulent conduct involving disclosures, as was the case for other settled charges the SEC brought in March for disclosure failures.

Third Circuit affirms dismissal of claim over investigation disclosures

In August, the Third Circuit affirmed the dismissal of securities fraud claims alleging that a company misled investors by failing to disclose government investigations. The court held that the company had no obligation to disclose merely being the subject of an investigation, particularly when the scope and potential charges were uncertain. The panel also rejected arguments that GAAP required earlier disclosure of the investigations as loss contingencies, noting that the company could not have reasonably estimated potential liability at the time.

This case illustrates the importance of understanding the considerations that apply when determining how and when investigations or other legal proceedings should be disclosed, and the content of such disclosures.

Second Circuit, Peloton and more on hypothetical risks

Also in August, the Second Circuit affirmed in part and vacated in part the dismissal of securities fraud claims against Peloton Interactive. Investors alleged that Peloton misled the market about product demand and inventory levels at the end of the COVID-19 pandemic. The court agreed with the district court that most of the challenged statements were accurate in context, tied to guidance that was subsequently met or inactionable puffery. However, it held that plaintiffs plausibly alleged actionable misstatements based on two categories – the CEO’s description of a price cut for its bike as “absolutely offensive” rather than defensive, despite allegations the cut was driven by excess inventory, and risk factor disclosures in certain of Peloton’s 2021 SEC filings that continued to warn that excess inventory “may” occur, even though the problem had already materialized.

While cases around “hypothetical” risk factors will always depend on the attendant facts and circumstances, this decision highlights the importance of reviewing the specific disclosure and the facts prevailing at the time to carefully assess whether the way a particular risk factor is drafted makes sense given what the company knows has happened.

What are the disclosure implications?

There is not a one-size-fits-all takeaway from these enforcement actions and litigation, and companies should evaluate the implications of each case in light of their existing internal controls and procedures, and their related disclosure practices. While these cases may prompt companies to reassess certain internal processes, companies may also reasonably conclude that their processes are appropriate and determine not to effect any changes.

Read our client update SEC & CFTC Enforcement Update for more detailed analyses of recent enforcement actions.