Risk Factors and Other Hot Topics for Public Companies to Consider in 2025

Each year, as companies prepare to draft their year-end Annual Reports on Form 10-K, changes in rules, regulations, and disclosure trends, along with new laws and executive orders from the current presidential administration, can add complexity and uncertainty. The following are key considerations and reminders for companies.

New Insider Trading Policy Disclosure and Exhibit Filing Requirements

In December 2022, the U.S. Securities and Exchange Commission (“SEC”) adopted several amendments to Exchange Act Rule 10b5-1 and accompanying amendments to Regulation S-K requiring disclosure of companies’ insider trading plans. Specifically, new Item 408(b) of Regulation S-K requires companies to disclose whether they have adopted policies and procedures governing transactions in the company’s securities that are reasonably designed to prevent insider trading and to file such policies and procedures as an exhibit to their Annual Report on Form 10-K. If a company has not adopted such policies, it must explain why. These requirements apply starting with the Form 10-K for the fiscal year ending December 31, 2024, for calendar year-end companies. 

Risk Factors and Other Hot Topics

All companies should re-evaluate their risk factor disclosures annually to ensure they have not become outdated or inaccurate, and include risks related to rule changes, regulations, and disclosure trends. Topics to pay special attention to are as follows:

Cybersecurity

Cyberattacks are becoming more frequent and severe, and the human and financial impact of attacks continues to rise in line with the increasing digitization of critical infrastructure. In 2023, the SEC adopted final rules requiring disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy, and governance.

Risk factors discussing cybersecurity should include any risks related to the company’s processes for identifying, assessing, and managing cybersecurity threats, as well as any risks associated with the company’s oversight procedures and/or reliance on third parties or technology for notifications of cybersecurity incidents. These should align with disclosures elsewhere in the Form 10-K.

Artificial Intelligence

The rise of artificial intelligence (“AI”) was one of the hottest topics in 2024, and the SEC has indicated that it may increase its focus on AI-related disclosures. Companies should carefully evaluate whether AI-related risk factors are relevant to their business. If they are, companies should provide risk factor disclosures that are tailored to their specific business and operations. For instance, if companies use proprietary AI or rely on third-party service providers, it may be appropriate to discuss the risks associated with either approach. Companies developing their own AI may consider risks related to this application and the resources required to advance it. Additionally, companies may choose to assess risks linked to generative AI concerning security, data privacy, and reliability.

Climate Change and Extreme Weather

Although the SEC has recently voted to end its defense of the rules requiring disclosure of climate-related risks, companies must still consider whether climate change and associated extreme weather events pose material risks. For example, companies that have been affected by a natural disaster (like a hurricane or wildfire) or are at potential risk due to the increased frequency and intensity of extreme weather events should disclose the risk to the company’s business and financial performance.

Evolving U.S. Legal and Political Landscape

The transition between Republican and Democratic presidential administrations often leads to a period of regulatory uncertainty, but the speed of change in the days following President Trump’s inauguration has been unprecedented. Consequently, this has created a high degree of legal and political uncertainty that may pose material risks for public companies, which should be disclosed by those companies.

• Tariffs – Since February 1, 2025, President Trump has issued several executive orders related to tariffs, first directing the United States to impose new tariffs on imports from Canada, Mexico, and China, as well as 10% tariffs on dozens of other countries. Then, in some cases, he paused certain tariffs for many countries while further increasing tariffs on others.  This revolving door of on-again/off-again tariffs and retaliatory actions has created significant uncertainty and risks for many companies that rely on imports for their manufacturing. Companies should consider whether these policies might impact their business or financial performance. Any existing risk factors related to this should be updated in accordance with recent statements from President Trump and his advisors.
• Illegal Discrimination Executive Order – On January 21, 2025, President Trump signed an executive order titled “Ending Illegal Discrimination and Restoring Merit-Based Opportunity.” The executive order ends the use of DEI policies and programs not only within the federal government but also among federal contractors, and it requires federal agencies to create strategic enforcement plans targeting illegal DEI programs in the private sector, including public companies. The force and applicability of this directive, along with the meaning of “unlawful DEI programs,” remain unclear. Accordingly, companies may wish to consider addressing this uncertainty in their risk factors to the extent that it may pose a material risk to their operations.
• Inflation and Interest Rates – While the Federal Reserve cut interest rates in 2024, it has declined to reduce rates further thus far in 2025 as it awaits additional progress on inflation, more clarity regarding the effects of President Trump’s tariff program, and monitors the country’s economic indicators. Companies should reassess their risk factors in light of the 2024 rate cuts and the current pause in rate reductions, and continue to monitor developments.
• Immigration – President Trump has taken clear steps to radically reset immigration, including issuing several executive orders related to illegal immigration.  Trump has also focused attention on several non-citizens here on student visas, work visas, and travel visas, revoking many visas and expelling many non-immigrant visa-holders from the country.  The result of his sweeping actions has led to mass deportations as well as fear and uncertainty, all of which could have an impact on businesses, particularly agriculture, construction, hospitality, home health care, and child/elder care, as well as businesses involved in the travel and tourism industries. Accordingly, companies may wish to consider addressing this uncertainty in their risk factors to the extent that it may pose a material risk to their operations.

Geo-Political Issues

Geopolitical risks possess the potential to influence the global economy, affecting growth, inflation, financial markets, and supply chains. Ongoing conflicts, such as the Russia-Ukraine war and the Israel-Hamas war, have exacerbated regional instability and harmed energy and food security, causing higher prices that lead to increased inflation rates. The US-China relationship may also affect sourcing patterns and tariff costs. Furthermore, governments in the Asia-Pacific region and other parts of the world are devising strategies to secure access to critical minerals.

Companies should detail any direct or indirect exposure to geopolitical issues, such as the Russia-Ukraine conflict, through investments, properties, employees, supply chains, operations, and other facets of business. Moreover, as global supply chains become increasingly interconnected, companies should continually assess whether their disclosure of risks to their business from geopolitical forces remains adequate. In addition, the SEC recently published a sample comment letter highlighting the disclosure obligations for companies with operations in China.  Companies based in or with a majority of their operations in China should disclose any material risks related to the role of the PRC in intervening in or exercising control over a company’s operations in the PRC. Companies that are not based in China but otherwise have business exposure there should also review and consider the sample comment letter.

Hypothetical Risk Factors

It is crucial that hypothetical statements in risk factor disclosures (e.g., indicating that an event “could” or “may” occur rather than “has” or “did” occur) undergo thorough scrutiny and evaluation. The SEC has instituted enforcement actions against numerous companies for disclosing as hypothetical risks that have already transpired. Companies should thus continue to ensure that risk factors are not written as hypothetical possibilities when the risks have already materialized. For example, a company should not claim that it “may experience data breaches” when the company has, in fact, experienced data breaches.

For more information about disclosures, risk factors, and other compliance matters or to speak with a Securities Attorney, please contact Brenda Hamilton at 200 E Palmetto Rd, Suite 103, Boca Raton, Florida, (561) 416-8956, or by email at [email protected].

Hamilton & Associates | Securities Attorneys
Brenda Hamilton, Securities Attorney
200 E Palmetto Rd, Suite 103
Boca Raton, Florida 33432
Telephone: (561) 416-8956
Facsimile: (561) 416-2855
www.SecuritiesLawyer101.com