Geopolitics Now Writes the Risk Factors: What 10-K Filings Reveal About Data, Sanctions and AI Rules

Annual reports are written by lawyers who are paid to imagine what could go wrong. That makes the risk factor section of a Form 10-K one of the better early-warning systems for how corporate risk is changing, because a company that leaves out a known risk invites securities litigation later. Read a year’s worth of those sections side by side and a pattern stands out: the risks that used to sit under “international operations” now show up in the privacy, cybersecurity and AI paragraphs, and the reason given is increasingly geopolitical.

We wanted to test that impression rather than repeat it. On November 2, 2026 we ran a set of phrase searches through the SEC’s EDGAR full-text search, restricted to Form 10-K filings, and compared the 12 months from November 1, 2025 to October 31, 2026 with the same window two years earlier. We also read the relevant risk factors in two large technology filers, Meta Platforms and Akamai Technologies, to see how the abstract trend reads in an actual filing. The result is a useful map for privacy, security and AI governance teams who need to explain to a board why data rules have become a geopolitical problem, and what to do about it.

What the filings show

EDGAR’s full-text search counts documents inside filings that contain a phrase, so the numbers below measure how often a topic is mentioned, not how many companies consider it material. A single filing can contain more than one matching document, and a mention can be a passing reference in a long list. With those caveats, the direction is clear.

Three readings follow from the table. First, the fastest growth is in laws that did not exist or did not apply two years ago: the EU AI Act, the NIS2 cybersecurity directive, the EU’s Digital Operational Resilience Act for financial services, and the U.S. Protecting Americans’ Data from Foreign Adversaries Act of 2024. Second, AI and export controls now travel together in a much larger share of filings, which reflects the way chips, models and compute have become instruments of national policy. Third, data localization and cross-border data language grew more slowly, because many filers already carried it. The one decline, mentions of the EU-U.S. Data Privacy Framework, is a reminder that counting words is not the same as measuring risk; companies may simply have consolidated their transfer disclosures.

How two filers describe the same pressure

Numbers show frequency. The text shows how companies frame the problem, and the framing matters because it is what investors, regulators and plaintiffs read.

Akamai’s annual report, filed February 20, 2026, is unusually direct. In its risk factor discussion it states that “certain jurisdictions are adopting or tightening data localization and data residency requirements that restrict where customer or employee data may be stored, processed, accessed or encrypted.” It points to the Justice Department’s January 8, 2025 rule on preventing access to U.S. sensitive personal data by countries of concern, noting that the rule prohibits certain data brokerage transactions and restricts some investment, employment and vendor agreements absent specified cybersecurity controls. It then adds that EU “digital sovereignty” measures “have gathered steam over the past year based on the emergence of geopolitical tensions, including between the US and Europe.” That last clause is notable. A few years ago, geopolitical data risk in a U.S. filing almost always meant China or Russia. Akamai now names transatlantic tension as a driver.

Meta’s 10-K, filed January 29, 2026, shows what a single legal instrument can carry. Describing the EU-U.S. Data Privacy Framework, the company warns in its annual report that “a further invalidation of the EU-U.S. DPF by the CJEU could create considerable uncertainty and lead to us being unable to offer a number of our most significant products and services, including Facebook and Instagram, in Europe.” The framework survived its first court test when the EU General Court dismissed a challenge in September 2025, but that ruling is on appeal to the Court of Justice, so the risk Meta describes remains open.

Neither filing is a prediction. Both are disclosures of exposure. That distinction is useful for privacy teams, because it means the company’s own securities lawyers have already conceded, in a document signed by the CEO and CFO, that these risks are real enough to disclose. Internal programs that treat cross-border data and AI rules as low-priority are now out of step with what the company tells investors.

The four geopolitical risks that land on privacy and security teams

Reading across filings, most of the geopolitical language that touches data falls into four groups. Each has a different owner inside a company, which is part of why they are hard to manage.

• Localization and sovereignty: usually infrastructure and engineering, with legal sign-off.
• Adversary-state data restrictions: often trade compliance or national security counsel.
• Transfer mechanisms: the privacy office.
• AI rules: product, legal and, increasingly, a separate AI governance function.

1. Data localization and sovereignty requirements

These are rules about where data may sit and who may access it. They include localization mandates in countries such as China, sector rules for financial and health data, and newer sovereignty requirements in public-sector cloud procurement. The practical effect is that a single global data architecture may no longer be lawful for every market, and that “access” from another country, including by support engineers, can count as a transfer. Our guide to data localization laws by country covers the main regimes.

2. Outbound data restrictions aimed at adversary states

The United States now has two overlapping regimes: the Justice Department’s Data Security Program under 28 CFR Part 202, and the Protecting Americans’ Data from Foreign Adversaries Act, which the FTC enforces against data brokers. They cover different actors and different transactions, which is why we wrote a separate explainer on how PADFA and the DOJ program differ. Both turn ordinary vendor, employment and investment contracts into compliance questions.

3. Transfer mechanisms that depend on politics

EU-U.S. transfers rest on an adequacy decision that, in turn, rests on U.S. executive commitments about intelligence access. Two predecessors were struck down. China’s cross-border rules depend on security assessments, standard contracts or certification, and the thresholds have changed several times. A transfer mechanism that depends on a political commitment can change when the politics do, so contingency planning, not just paperwork, is required. For the China side, see our explainer on China cross-border data transfer.

4. Divergent AI rules

The EU AI Act is in force and was amended in July 2026 by the Digital Omnibus on AI, which pushed back the high-risk system obligations to December 2, 2027 for Annex III systems and August 2, 2028 for AI embedded in regulated products. In the United States, Akamai’s filing describes state AI laws as “a complicated legislative patchwork” and refers to a December 2025 executive order that endorsed a federal moratorium on enforcing state AI laws. Add export controls on advanced chips and models, and the same AI product can face transparency obligations in Europe, uncertainty in U.S. states and licensing rules on the hardware it runs on.

Why this belongs to the privacy program, not just government affairs

It is tempting to file geopolitical risk under “macro” and leave it to strategy teams. That approach fails because the controls that reduce the exposure are privacy and security controls. You cannot assess whether a localization rule bites without a current data map. You cannot evaluate a DOJ-rule vendor restriction without knowing which vendors touch which data categories. You cannot plan for a transfer mechanism failing without knowing which processing depends on it. The same point came through in our earlier analysis of how geopolitical risk is rewriting privacy, cybersecurity and AI governance: the external conditions change, but the work lands on the teams that hold the data inventory.

There is also a disclosure-consistency problem. If the 10-K says localization and transfer rules are material risks, the company should be able to show that it tracks them. Regulators and plaintiffs have started to compare public statements with internal practice, and the SEC’s posture on cyber and AI disclosures continues to shift, as we covered in companies recalibrating AI and cyber risk disclosures. A gap between what the filing says and what the program does is itself a risk.

A five-step geopolitical data risk review

The following review is designed for a privacy or security lead who needs to produce something useful for the audit or risk committee in a quarter, not a year.

1. Pull your own risk factors and annotate them. List every sentence in your latest 10-K or annual report that mentions data transfers, localization, sanctions, export controls or AI regulation. For each, name the internal owner and the control that addresses it. Blank cells are your first findings.
2. Map data by jurisdiction of storage and of access. Most data maps record where data is stored. Add where it is accessed from, including support, engineering and vendor personnel, because several regimes treat remote access as a transfer.
3. Screen vendors and counterparties against the adversary-data rules. Identify vendors, employees and investors who could be “covered persons” under the DOJ rule, and any sale or licensing of data that could fall under PADFA. Record the decision either way.
4. Write a transfer-failure playbook. For each transfer mechanism you rely on, document what you would do in the first 30 days if it were invalidated or suspended: which flows stop, which move to standard contractual clauses, which need technical measures such as local processing or encryption with locally held keys.
5. Track AI obligations by market, not by product. Maintain a simple register of AI systems with the markets they serve and the rules that apply in each. The AI Act’s delayed dates give time, not an exemption.

Each step produces evidence. That matters more than the format. When a regulator or auditor asks how the company manages a risk it disclosed, a dated record of decisions is far more persuasive than a policy.

Where software helps, and where it does not

Tools cannot decide whether a transfer is lawful or whether a vendor is a covered person; that is legal judgment. What tools can do is keep the inputs current. Captain Compliance’s assessment workflows are built to screen new vendors, projects and technologies through one intake and route them to the right review, including privacy impact assessments, DPIAs and transfer impact assessments, while keeping the evidence behind each decision. On the website side, scanning shows which third-party scripts and trackers actually send visitor data to which destinations, which is often where unexpected cross-border flows begin. Neither replaces counsel, and neither guarantees compliance with any particular regime, but both shorten the distance between a risk factor and a record.

Frequently asked questions

Does a mention in a 10-K mean the company considers the risk material?

Not necessarily. Risk factors are meant to describe material risks, but companies often list laws inside broad sentences out of caution. That is why counts are only a signal. The more specific language, like Meta’s statement about losing the ability to offer Facebook and Instagram in Europe, is the stronger evidence of perceived materiality.

Why did mentions of the EU-U.S. Data Privacy Framework fall?

We cannot say from search counts alone. Plausible explanations include companies consolidating transfer language under broader headings after the September 2025 General Court ruling, or using different terms such as “adequacy decision.” The legal risk did not disappear; the appeal remains pending before the Court of Justice.

We are not a public company. Does any of this apply?

The disclosure obligation does not, but the underlying rules do. Private companies are subject to the DOJ data rule, PADFA, the AI Act and foreign localization laws on the same terms. Public company filings are simply a convenient way to see how sophisticated legal teams describe the exposure.

Is geopolitical data risk mainly about China?

Less than it used to be. U.S. adversary-data rules are aimed at China, Russia, Iran, North Korea, Cuba and Venezuela, but the sovereignty and transfer risks now include allies. Akamai’s filing explicitly ties EU digital sovereignty measures to tensions between the United States and Europe.

How often should this review be repeated?

At least annually, aligned with the 10-K or annual report cycle, and whenever a triggering event occurs: a court ruling on a transfer mechanism, a new sanctions package, or a change in AI rules in a major market.

The sentence nobody wants to write

Every risk factor quoted here was drafted by people trying to protect their company from being accused of hiding something. Read together, they describe a world in which where data sits, who can see it and which AI rules apply depend partly on diplomacy. The open question for most companies is not whether to add another sentence to next year’s filing. It is whether, if one of those risks actually materializes, the privacy team will be able to show it saw the same thing the lawyers did, and acted on it.