2025 reporting season hot topics: insiders, AI and cybersecurity

Public companies have many things to consider as the 2025 reporting season kicks off. Certain 2024 rule changes made by the SEC and SEC enforcement actions in 2024 will require a careful review of disclosure on a number of key fronts and requirements for the upcoming year are focused on insiders and material non-public information, as well as AI and cybersecurity disclosures. To be prepared, companies can start updating their proxy checklists and building in time to address certain disclosure requirements. These key hot topic items can be grouped into Insiders and Cutting-Edge Trends. Taking these into consideration now as companies are building out their 2025 reporting checklists will give companies a head start, and ensure a smoother reporting season as well as better compliance with new rules and requirements.

Insiders: a focus on material non-public information

Insider trading policies and disclosure

The SEC's changes to Rule 10b5-1 have already largely taken effect. Insiders are now required to satisfy four conditions in order to rely on the affirmative defense provided by Rule 10b5-1(c). These include:

· Cooling-off period between the time plan is adopted and the time that trades under the plan start, duration being the longer of 90 days following the adoption of a 10b5-1 trading plan or two business days following a Company's disclosure of financial results on 10-Q or 10-K, subject to a maximum cooling-off period of 120 days;

· Certification that requires any officer or director adopting a 10b5-1 plan to certify they are not in possession of material non-public information (MNPI) and is adopting the plan in good faith;

· Limits on multiple and overlapping 10b5-1 plans that are subject to a handful of very limited exceptions; and

· Limits on a person having no more than one single-trade 10b5-1 trading plan in any 12-month period.

These changes resulted in disclosures changes pursuant to amended Item 402(x), which now requires quarterly disclosure of the adoption or termination of any 10b5-1 plan.

Building on these 10b5-1 updates, the new Item 408(b) of Regulation S-K requires companies to disclose annually whether insider trading policies and procedures have been adopted and a description of these policies and procedures. Any company that has not adopted such insider trading policies and procedures will be required to disclose reasons for not doing so. In addition to the disclosure, companies will be required to include their insider trading policies and procedures as an exhibit to their annual report. These requirements will take effect in connection with the filing of 2024 10-Ks (or 20-F for foreign private issuers).

Due to the upcoming requirements for insider trading policies, this is a great time for companies to assess the status of their current policies (or to the extent they do not have one, implementing one). Updates should be made to ensure recent SEC enforcement actions are addressed as well as current trends given recent rule changes around 10b5-1. This would involve asking legal counsel to review the company's existing policy and comparing it to those companies that have already complied with this rule change. This will ensure a company will be ready to meet this requirement at the time of filing. 

Equity grant disclosures

Another area being impacted by the SEC's increased focus on MNPI is disclosure around a company's policies and practices regarding the timing of awards of stock options, SARs and similar option-like instruments (together, stock instruments), including providing disclosure around the timing for such grants as determined by the board. The SEC has become increasingly focused on the timing of grants of equity awards to executives that could be problematic when considering the timing of a company's release of MNPI. Beginning in a company's 2024 10-K or Proxy, a company must provide narrative disclosure on this and must disclose whether the board (or compensation committee) takes MNPI into account when determining the awards, including whether the company has timed the disclosure of MNPI with such an equity grant.

Additional tabular disclosure is required if, during the last fiscal year, these stock instruments were awarded to a named executive officer (NEO) within four business days before filing of a form 10-K or 10-Q or the filing or furnishing of a Form 8-K that discloses MNPI and ending one business day after any such filing. If such stock instruments were awarded, new Item 402(x) requires disclosure of:

· Name of NEO;

· Grant date of award;

· Number of securities underlying the award;

· Per-share exercise price;

· Grant date fair value of the award;

· % change in the market price of the underlying securities between the closing price one trading day prior to and one trading immediately following disclosure of MNPI.

As a practical matter, while these equity grant disclosures are new, fundamental principles around the granting of equity awards have not changed. Companies should ensure all equity awards are granted only during open trading windows and when the company otherwise has no MNPI. In addition, companies should be mindful that any granting of option awards should not occur during the four business day window leading up to the filing of a 10-Q or 10-K or during the one business day after such filing.

Cutting-edge trends: AI and cybersecurity

 AI and cybersecurity have become the new cutting-edge trends forcing the SEC to make rule changes and adjust to an ever-shifting landscape of technological advancement. Last year, the SEC introduced several new cybersecurity disclosure requirements, which companies have already implemented, but 2025 offers an opportunity for further review and refinement. The SEC has already noted areas of improvement, including that companies should watch for inconsistent statements around third parties used to support, manage or supplement cybersecurity processes and inadequate disclosure regarding the relevant expertise as is necessary to fully describe the nature of the expertise. In addition to companies reviewing previously provided cybersecurity disclosures to ensure consistency and compliance with practice, companies should be reviewing and updating risk factors to ensure adequate disclosures are being made - especially in light of recent SEC enforcement actions alleging deficiencies in company disclosure.

Another cutting-edge trend the SEC is prioritizing for 2025 disclosure is artificial intelligence. While no wide-sweeping regulation changes have been proposed, the SEC has adopted rules specific to broker dealers and investment firms and has brought enforcement actions against financial institutions. In addition, the SEC has been focused on tempering disclosures about AI, and has suggested companies focus on the following in connection with 2025 reporting:

· Specifically defining what AI means for the company in concrete terms specific to a company's technology and avoiding overhyped statements that do not have adequate support;

· Providing material risks and impacts specific to the company as opposed to boilerplate commentary that could apply to any company; and

· Ensuring companies have a reasonable basis for any claims made about AI.

Because of its proliferation, AI has quickly become a focus for many companies and, in light of AI being an SEC disclosure priority, companies would be advised to review their disclosures in light of the above SEC recommendations and make necessary changes to temper such statements. This is especially important in light of recent SEC enforcement settlements that were focused on companies providing support for claims made to avoid the SEC classifying such statements as "unsupported hype."

Planning ahead

Reporting seasons are always a challenging time for companies but proper planning that is purpose-driven can go a long way to improving a company's disclosure especially in light of rule changes or adjustments a company may need to make to such disclosure. Discussing these items early can ensure finance teams and others can modify disclosure as necessary and ensure filings are compliant with all recent rule changes.