Data as Liability: AI Adoption and Disclosed Breach-Risk Attention

The paper separates two ideas that are often bundled together in public discussion: inventing AI and adopting AI inside live business processes.11Work on AI diffusion has asked why firms invest in AI and where the returns show up, in growth, product innovation, productivity and organisational design (Babina et al. 2024; Brynjolfsson, Li and Raymond 2023; Acemoglu et al. 2022; Felten et al. 2021). The liability that follows when deployment requires firms to govern recurring data flows has received less attention. The central question is not whether AI is valuable. It is whether the move from research or invention into deployment creates a new liability margin that managers themselves treat as material.

The evidence comes from firms' own annual filings. That matters because the outcome is not media attention or realised breach incidence; it is the space firms devote to breach-related risk in legally consequential disclosures.22Risk disclosures are not empty boilerplate. In voluntary-disclosure models silence itself carries information (Verrecchia 1983; Dye 1985), and firms facing greater risk disclose more risk factors, which matter for pricing and market reactions (Campbell et al. 2014; Florackis et al. 2023). The main result is that AI adoption is the margin that moves with breach-risk attention, while AI invention becomes economically small once both margins are estimated together.

The customer-facing results sharpen the interpretation. AI systems that touch customers, personal information, vendors, and continuing data flows are the places where the liability side of AI diffusion becomes most visible. The managerial implication is that AI deployment is also a governance decision about security controls, vendor oversight, consent, data minimisation, and incident response.

AI adoption is associated with roughly 5 per cent higher breach-risk attention relative to the sample mean; AI invention is economically negligible once both enter the same specification.

Research question

Can firms adopt AI without also creating a disclosure-visible data liability, and is that effect driven by adoption rather than invention?

Why it matters

The paper speaks to a practical policy question. Regulation aimed at AI research and regulation aimed at deployed AI systems are not the same thing. If the liability signal appears mainly in adoption, then the relevant governance tools are closer to data protection, breach notification, vendor management, and customer-facing controls than to broad limits on invention.33Data-dependent technologies do not diffuse in a legal vacuum. Privacy regulation slowed the adoption of electronic medical records (Miller and Tucker 2009), and when the cost of handling sensitive data rises, adoption paths and the composition of innovation can change (Goldfarb and Tucker 2012; Frey, Presidente and Andres 2024).

Data and method

Data

The main panel uses roughly 84,000 firm-years of US listed-firm annual filings from 1994 to 2023. The paper builds layered text and LLM measures that distinguish AI invention language from AI adoption language.44Topic models and related text methods are an established way to measure risk salience from the Risk Factors section of 10-K filings, Item 1A (Bao and Datta 2014; Hassan et al. 2019; Sautner et al. 2023; Bybee et al. 2024). A narrower disclosure sample and paragraph-level classifications are used to validate and interpret the main filing-level evidence.

Method

The empirical design relates AI invention and AI adoption measures to disclosed breach-risk attention in firm filings, using fixed effects and placebo controls for non-AI digitisation language. The paper then examines customer-facing deployment, direct text statements that explicitly link AI to risk, and supplementary evidence from staggered state Data Breach Notification laws.55Treatment is assigned by the state of the firm's headquarters, following Miller and Tucker (2009). Notification duties can also depend on where affected consumers live, so this misclassification should bias the estimate towards zero rather than produce spurious negative results.

Findings

1. Adoption, not invention

   AI adoption is associated with roughly 5 per cent higher breach-risk attention relative to the sample mean; AI invention is economically negligible once both enter the same specification.Panel B. Adoption (blue) stays positive while invention (pink) is near zero in the full-sample horse races. See the figure.

2. Customer-facing deployment matters

   Among adopters, breach-risk attention is strongest where AI is customer-facing, consistent with the idea that live data flows create governance obligations.

3. Firms describe exposure, not protection

   In direct statements linking AI to breach vulnerability, 101 of 103 directional statements describe AI as expanding exposure rather than reducing it.

4. Bounded interpretation

   The outcome is disclosed breach-risk attention, not realised breach incidence, so the evidence is strongest about managerial salience and revealed materiality.

The paper contributes by separating AI invention from AI adoption in corporate text and showing that the liability side of AI diffusion is concentrated in deployment. It reframes AI risk as a data-governance complement to AI adoption rather than a simple tax on innovation.

Figures and tables

Scope and limits

The paper does not claim to measure actual breaches. Firm disclosures may reflect selection into AI adoption, managerial attention, legal caution, or expected exposure. The DBN evidence is supplementary and should not be read as a stand-alone causal design.66Data Breach Notification laws do not prohibit AI use. They raise the expected cost of a failed data process through notification duties, legal exposure, remediation burdens and reputational damage.

How to cite

@article{kansoy2026data,
  title   = {Data as Liability: AI Adoption and Disclosed Breach-Risk Attention},
  author  = {Fatih Kansoy and Yuhao Huo},
  journal = {University of Oxford Department of Economics Discussion Papers},
  year    = {2026},
  url     = {https://fatih.ai/aidata.pdf}
}

References

1. Acemoglu, D., Autor, D., Hazell, J. and Restrepo, P. (2022). Artificial intelligence and jobs: Evidence from online vacancies. Journal of Labor Economics, 40(S1), S293–S340.note 1
2. Babina, T., Fedyk, A., He, A. X. and Hodson, J. (2024). Artificial intelligence, firm growth, and product innovation. Journal of Financial Economics, 151, 103745.note 1
3. Bao, Y. and Datta, A. (2014). Simultaneously discovering and quantifying risk types from textual risk disclosures. Management Science, 60(6), 1371–1391.note 4
4. Brynjolfsson, E., Li, D. and Raymond, L. R. (2023). Generative AI at work. NBER Working Paper 31161.note 1
5. Bybee, L., Kelly, B. T., Manela, A. and Xiu, D. (2024). Business news and business cycles. Journal of Finance, 79(5), 3105–3147.note 4
6. Campbell, J. L., Chen, H., Dhaliwal, D. S., Lu, H. and Steele, L. B. (2014). The information content of mandatory risk factor disclosures in corporate filings. Review of Accounting Studies, 19(1), 396–455.note 2
7. Dye, R. A. (1985). Disclosure of nonproprietary information. Journal of Accounting Research, 23(1), 123–145.note 2
8. Felten, E., Raj, M. and Seamans, R. (2021). Occupational, industry, and geographic exposure to artificial intelligence: A novel dataset and its potential uses. Strategic Management Journal, 42(12), 2195–2217.note 1
9. Florackis, C., Louca, C., Michaely, R. and Weber, M. (2023). Cybersecurity risk. Review of Financial Studies, 36(1), 351–407.note 2
10. Frey, C. B., Presidente, G. and Andres, P. (2024). Redirecting AI: Privacy regulation and the future of artificial intelligence. CEPR Discussion Paper.note 3
11. Goldfarb, A. and Tucker, C. (2012). Privacy and innovation. Innovation Policy and the Economy, 12, 65–90.note 3
12. Hassan, T. A., Hollander, S., van Lent, L. and Tahoun, A. (2019). Firm-level political risk: Measurement and effects. Quarterly Journal of Economics, 134(4), 2135–2202.note 4
13. Miller, A. R. and Tucker, C. (2009). Privacy protection and technology diffusion: The case of electronic medical records. Management Science, 55(7), 1077–1093.note 3note 5
14. Sautner, Z., van Lent, L., Vilkov, G. and Zhang, R. (2023). Firm-level climate change exposure. Journal of Finance, 78(3), 1449–1498.note 4
15. Verrecchia, R. E. (1983). Discretionary disclosure. Journal of Accounting and Economics, 5, 179–194.note 2