The long view

Filings containing this phrase, every month since 2008. The last point is the current month and is still filling, so it always looks lower than it will be.

2008 peak 126 in February 2024 2026

Who disclosed it

From SEC full-text search over 8-K filings. Every row links to the filing itself.

Company	Form	Filed
Artificial Intelligence Technology Solutions Inc. AITX	8-K	2026-06-15	filing
Boost Run Inc.	8-K	2026-05-14	filing
BNB PLUS CORP. BNBX	8-K	2026-05-27	filing
D-Wave Quantum Inc. QBTS	8-K	2026-06-01	filing
Boost Run Inc. BRUN	8-K	2026-05-11	filing
KIDZ AI Inc.	8-K	2026-07-21	filing

The full search on EDGAR

Which industries file it

Companies grouped by the industry classification on their own filing. A count, not a survey.

Industry		Companies
Software and IT services		140
Banking		36
Services and entertainment		32
Securities and investment		28
Instruments and medical devices		27
Chemicals and pharmaceuticals		20
Holding and investment offices		19
Insurance		18
Health services		15
Industrial machinery		15

What it obligates

Our corpus holds 106 controls across 37 frameworks whose text speaks to this. Not a judgement: these controls say so, and each is one lookup from its source document. Ordered by how much each framework has to say about it, so the one that will cost you the most work is first. Every name opens that framework in the corpus.

Framework	Controls
SOC 2 United States	54
MTCS (Singapore) verified Singapore	5
HKMA TM-G-1 verified Hong Kong	3
Monetary Authority of Singapore Technology Risk Management Guidelines verified Singapore	2
NIST SP 800-146 verified United States	2
SSAE 18 International	2
Kuwait National Cybersecurity Framework verified Kuwait	2
CSA STAR (Security, Trust, Assurance, and Risk) verified International	2
GLI-33 International (Gaming)	2
Nevada Gaming Control Board Cybersecurity Requirements verified United States — Nevada	2
Japan FSA Cybersecurity Guidelines for Financial Institutions verified Japan	2
Lloyd's Minimum Standards verified United Kingdom (Lloyd's)	2
IRS Publication 1075 verified United States	2
CIS Controls v8 verified International	1

What an auditor will ask you to produce

The artefacts named on those controls, most frequently cited first.

Policies and procedures aligned to COSO 17 principles
Risk assessment workpapers
Access control matrices and reviews
Logging, monitoring, and incident records
Privacy notice published and versioned
Consent capture and revocation records
Data subject access request log
Retention and disposal schedule for personal information

How it usually fails

Recorded when each control was verified against its source. This is where programmes that think they are covered turn out not to be.

Access reviews skipped
Change tickets lack approvals
Monitoring blind spots
Vendor assessments stale
Notice not versioned
Consent not granular

Where this comes from

The left half is public record: SEC full-text search over 8-K filings, counted across a 14 day window against the equivalent window before it. You can check every row.

The right half is ours: 723 frameworks and 20,473 controls, 531 of those frameworks verified against their source documents, with the auditor evidence and common failure modes recorded control by control. Controls appear here because their own text names this term.

Today's edition · How programmes fail · The obligation index