Data as liability

Working paper

Artificial intelligence makes data more productive, but it also makes data more costly to govern. This paper asks where that governance cost shows up in firms’ own risk disclosures. Using roughly 84000 firm-years of SEC annual filings for US listed firms from 1994 to 2023, the paper builds layered text and LLM measures to separate AI invention from AI adoption and relates both to disclosed attention to data breach risk. AI adoption is associated with roughly 5 per cent higher breach-risk attention relative to the sample mean; AI invention is economically negligible once both margins enter the same specification. The wedge survives an explicit non-AI digitisation placebo built from the same filings. Among adopters, breach-risk attention is highest where deployment is customer facing. Firms that explicitly connect AI to breach vulnerability describe it as expanding exposure in 101 of 103 directional statements. Supplementary evidence from staggered state Data Breach Notification laws is directionally consistent with the disclosure results.

Authors: Kansoy, F; Huo, Y

• Publication status: Published
• Publisher: University of Oxford
• Series: Department of Economics Discussion Paper Series
• Place of publication: Oxford
• Publication date: 2026-03-25
• Paper number: 1109
• Language: English
• Keywords: Data Breach Notification laws; data breach risk; corporate disclosure; staggered difference-in-differences; artificial intelligence; text-as-data