AI in Corporate Reporting: The Control Gap Between Use and Evidence
Artificial intelligence is already present in corporate reporting. The more important question is whether organisations can explain where it is used, who remains accountable, what evidence is retained and how an unreliable output would be identified before publication.
An AI reporting control gap exists when technology is used inside the reporting process without matched ownership, review standards, source traceability and escalation procedures. The risk includes inaccurate narrative, misinterpreted reporting requirements, confidential information entering an unsuitable tool and management relying on analysis that cannot be reconstructed.
The Financial Reporting Council’s July 2026 research shows how quickly the issue is forming. Thirty-nine per cent of responding organisations reported current use of generative AI and a further Thirty-one per cent were piloting it. Applications included narrative drafting, copy editing, trend analysis, consistency checking and interpretation of reporting standards. Yet only 44% of surveyed companies had mandated human oversight. The FRC also identified a possible disconnect between actual use by reporting teams and management or board awareness.
The visibility problem extends beyond formal implementation. The Office for National Statistics reported AI use by approximately 35% of UK businesses with ten or more employees, compared with 55% of employees reporting AI use for work or education under a separate survey measure. The ONS cautions that the measures are not directly equivalent, but the difference reinforces the need to distinguish approved enterprise deployment from individual activity.
The underlying weakness may sit below the tool. ACCA and CA ANZ found that data quality and insufficient skills were each cited by 42% of finance professionals as barriers to data integration, while 40% identified difficulty combining multiple sources. AI cannot correct uncontrolled data lineage merely by producing a more fluent answer.
The diagnostic should therefore begin with the reporting process, not the software licence.
- First, identify every point where AI can influence a reported number, disclosure, commentary, benchmark or management conclusion. This should include embedded functionality inside enterprise software, not only standalone tools.
- Second, assign accountability. The preparer, reviewer and executive relying on the information should not be treated as one undefined “human in the loop”.
- Third, define the evidence standard. Source documents, prompts, outputs, amendments, approvals and exceptions should be retained in proportion to the significance of the judgement.
- Fourth, test the boundary between assistance and judgement. Extraction, reconciliation and first-draft activity may suit controlled automation. Management commentary, forward-looking statements and complex technical interpretations require a higher review threshold.
The Bank of England, FCA and HM Treasury have separately stated that boards and senior management of regulated firms should understand frontier-AI risk sufficiently to set direction and oversee control functions, including risks arising from external applications, software libraries, services and supply chains.
Where the diagnostic begins
- Where is AI used in the reporting cycle?
- Which uses are known to management?
- Can material outputs be traced to approved sources?
- Who may accept, amend or reject a result?
- What evidence would withstand audit or regulatory scrutiny?
The reporting environment does not need to prohibit AI. It needs to make its use visible, controlled and reviewable. Adoption without that structure creates speed without defensibility.
Merixa supports leadership teams in assessing reporting architecture, internal controls, evidence standards and accountability before AI becomes embedded in externally relied-upon information.