An AI disclosure audit is a thirty-minute exercise the CEO or general counsel runs on the company's public voice and likeness footprint plus the company's mandated public disclosures, to identify which lawful releases are now technically equivalent to the unlawful ones because AI tools can reconstruct the protected version from the released version. The NTSB case in May 2026 is one of the clearest recent federal examples. The same structural exposure applies to SEC filings, court records, deposition transcripts, FOIA responses, and the public audio footprint of every senior executive. The audit produces a one-page disclosure-exposure doctrine an audit committee can review and a quarterly cadence the governance calendar can hold.
What the NTSB released, what happened next
On May 19, 2026, the National Transportation Safety Board opened the public docket for its investigation into UPS Flight 2976, the November 4, 2025 cargo crash in Louisville that ultimately killed 15 people according to subsequent reporting (the NTSB investigation page records 14 fatalities at the time of last update, with one ground victim later dying on December 25, 2025). The docket contained the artifacts every investigation produces at this stage: photographs, technical analyses, witness statements, recovered-data summaries. Among them sat two items investigators had treated as the careful version of a hard problem. A written transcript of the cockpit voice recorder. And a PDF showing a spectrogram, a still image representing the audio waveform as colors and shapes across frequency and time. Federal law forbids the NTSB from releasing the actual cockpit audio. The spectrogram and the transcript were the closest the public was supposed to get.
Within roughly 24 hours of the docket release, posts appeared on X, Reddit, and YouTube containing audio clips that approximated the pilots' final voices, including the last thirty seconds of flight. Users had taken the spectrogram image and the written transcript, fed both through publicly available AI tools, and produced a synthesized rendering of what the cockpit might have sounded like. The reconstructions were not perfect. They were close enough that the families could hear approximations of voices belonging to Captain Richard Wartenberg, First Officer Lee Truitt, and Relief Officer Captain Dana Diamond.
On May 20, the YouTuber Scott Manley, who covers aviation and physics under the handle @DJSnM on X, posted a warning that the spectrogram contained reconstructable audio data: "you can probably reconstruct a lot of audio from the megabytes of data encoded in this image." The next day, May 21, the NTSB took its entire public docket system offline. On Friday May 22, the agency restored most of the system but kept 42 investigations closed pending review, including UPS 2976. NTSB Chairwoman Jennifer Homendy issued a statement saying the situation is deeply troubling, that emerging technology can be used to extract cockpit voice recorder audio from visualized data the agency shares to help the public understand accidents, and that the NTSB is urging X, Reddit, and others to take such posts down.
That is the fact pattern. From the news side, this is a horror story about AI doing something disturbing and new. From the operating side, this is a structural moment for every executive whose company is subject to a public-disclosure regime, which includes essentially all of them.
The fact most coverage missed
The technique is not new.
The math that lets you reconstruct an approximation of audio from a spectrogram image was published in April 1984 by Daniel W. Griffin and Jae S. Lim, two researchers at MIT. The paper is called "Signal estimation from modified short-time Fourier transform." It appeared in the IEEE Transactions on Acoustics, Speech, and Signal Processing. The algorithm has been in standard signal-processing textbooks ever since. It ships, today, in standard open-source audio libraries that any developer can install with one command. The Aalto University speech-processing reference includes it as a teaching example. The librosa Python audio library exposes it as a function with a default parameter set.
What changed in May 2026 was not the capability. The capability has been sitting in textbooks since the year the Macintosh launched. What changed was the population of people who could execute the capability. The audience moved from people with signal-processing training to anyone with a chatbot and a few minutes. The algorithm did not become more powerful. The skill floor on the algorithm collapsed.
That distinction is the operating reality for every executive trying to plan against AI. Most AI news arrives framed as a new capability. A high share of it is an old capability with the skill floor removed. The 1984-textbook fact is the durable read on the NTSB story. It also rewires how to read the next twelve months of AI capability headlines. When the headline says AI can now do something, the next question to ask is whether AI invented the capability or whether AI made the capability accessible to a population that previously could not run it. Most of the time, the second answer is the load-bearing one.
The distance that just collapsed
Every public-disclosure regime in the federal government was designed under one assumption. There is a meaningful distance between the data the law permits releasing and the sensitive information underneath. The transcript is not the audio. The spectrogram is not the recording. The redacted PDF is not the unredacted version. The earnings-call slide is not the internal forecast. That distance is what makes lawful disclosure possible. The law sets the line. The structure of the data preserves what sits beyond it.
AI is closing that distance, regime by regime.
The NTSB is one of the clearest recent federal examples, but the structural exposure runs across every other federal public-records system. Public companies, investor-relations sites, and third-party transcript services publish earnings-call audio and transcripts, while some earnings-related materials may also appear in SEC filings, creating hours of training material for any voice replica of any CEO who hosts public calls. The Freedom of Information Act produces redacted documents whose redaction patterns and surrounding context may allow AI tools to infer parts of the underlying text, especially when formats repeat across documents. Some federal court audio files are available through PACER and other court systems when made part of the court record, providing attorney and judge voices that map to named legal proceedings. Deposition transcripts in the public record provide a written counterpart that can be fed alongside any clipped audio. The Federal Energy Regulatory Commission publishes filings that name individual engineers and contain technical detail readable as training input. Congressional hearing audio is publicly archived for every elected representative and every witness. Regulatory comment letters carry signatures and titles attached to specific positions a competitor or adversary may want to clone.
The pattern is the same in each case. The release is lawful. The structure was designed to protect what the law forbids. The structure no longer protects what the law forbids, because AI tools have collapsed the gulf between the released version and the underlying sensitive version. The legal regime defines the line. The technical reality has moved underneath it.
This is the part most coverage of the NTSB story is missing. The story reads as a structural early-warning about every federal disclosure regime and, by direct extension, every corporate disclosure regime that runs on the same logic. Treating it as a one-off horror about a cargo crash misses the load-bearing point.
What this means for your own public footprint
The same logic applies inside the company.
Pick any senior executive at a publicly visible firm. The CEO. The CFO. The general counsel. Now count the hours of their voice that are already publicly available. Earnings calls. Investor day presentations. Podcast appearances. Conference keynotes. Panel interviews. Fireside chats with journalists. Internal town halls that were leaked. YouTube clips from speaking engagements. The cumulative duration is usually measured in hours, often in tens of hours.
The question is no longer whether someone could clone that executive's voice. The capability is publicly available, has been since at least early 2024, and the skill floor has continued to drop. The question is what happens when someone does. A fraudulent voice call to a CFO authorizing a wire transfer. A synthesized voice on social media stating a political position the executive never held. A fake earnings preview circulated to short the stock. A deepfaked apology issued during a real crisis. A clip of the CEO appearing to admit something the CEO never said, dropped into a regulatory complaint.
Some versions of this are already real, especially executive impersonation and payment fraud. The 2024 Arup case, in which a finance worker authorized a $25 million transfer after a deepfaked video call impersonating senior figures, is the named precedent the audit-committee literature points to. The NTSB case adds a new dimension. The public footprint that creates the exposure is the same footprint the company's investor relations team, communications team, and conference circuit deliberately built. The disclosure was always the strategy. The disclosure now also doubles as training data. Treating it as something that needs governance is no longer paranoia. It is fiduciary work.
Boards are beginning to ask. Audit committees should be asking. The leading firms in regulated industries are starting to put a written disclosure-exposure posture on the governance calendar. The trailing firms will be reactive after the first incident. The next twelve months will separate the two groups.
The 30-minute AI disclosure audit
This is the load-bearing section of the article. It is also the part you can run before the next board or audit committee meeting. The first pass takes about thirty minutes. The output is a written one-page artifact the executive sponsor can take to the audit committee, and a quarterly cadence the governance calendar can hold from there forward.
Run the five steps in order. Do not try to optimize the first pass. The point is to surface the exposure, not to design the perfect protection.
Inventory your senior executives' public voice and likeness footprint.
For the CEO, CFO, and general counsel, list every public source of voice or video that is searchable today. Earnings calls. Podcast appearances. Keynote videos. Panel interviews. Investor-day recordings. YouTube channels. Conference fireside chats. Total runtime. Locations the audio sits. Whether transcripts also exist for each. A research analyst can do this in twenty minutes per executive with a search engine and a podcast directory. The output is a simple table with name, source, location, runtime, and transcript-yes-or-no.
Map your company's public-disclosure surface.
List every category of mandated or voluntary public disclosure the company produces. SEC filings and earnings audio. Press releases. Regulatory comment letters. Court records the company is a named party in. Public testimony. Industry-association testimony. FOIA-responsive material if the company holds federal contracts. Public board minutes if the company is a nonprofit or public agency. The output is a second simple table with category, public location, audio-or-video-yes-or-no, and named individuals attached.
Identify which exposures are now technically equivalent to non-permitted disclosures.
This is the rereading step. For each item in the two tables above, ask the question the NTSB did not ask in time. Could the released version be used by an AI tool to reconstruct the underlying sensitive version, or to create something the company would never authorize releasing. The earnings call plus transcript becomes the input to a fake CFO voice call. The deposition transcript becomes context for a synthesized statement attributed to a named attorney. The keynote video becomes the source for a fake apology video. The output is a flag column on each row: low, medium, or high reconstruction exposure. Most rows will be medium or high. That is the point.
Draft a one-page disclosure-exposure doctrine for the audit committee.
One page. Three sections. Section one names the surface (the inventories above). Section two states the company's posture (which exposures the company will accept, which it will mitigate, which it will eliminate, and by when). Section three names the operating rules (incident response process when a synthesized clip appears, internal employee policy on using AI voice tools on internal audio, board reporting cadence). The doctrine is a living document. Version one is for the audit committee to review and ratify at the next meeting. It will improve quarter over quarter.
Add a quarterly review cadence to the governance calendar.
The exposure changes as the company's public footprint grows and as AI tools continue to lower the skill floor on new categories of reconstruction. A static doctrine drifts into theater. Put the quarterly review on the audit committee or risk committee calendar with the doctrine itself as the standing artifact. Track the changes. Walk the doctrine forward as the technical reality moves. This is the structural fix the NTSB did not have and is now building under public scrutiny. The company has the chance to build it under internal control instead.
The audit produces three artifacts: two inventory tables, a one-page doctrine, and a calendar entry. None of the four requires a vendor, a procurement cycle, or new headcount. All of them are within reach of any general counsel or audit committee chair this week.
Where this sits in The 7 Levels of AI Proficiency
The 7 Levels of AI Proficiency framework reads the NTSB story differently at each level, and that difference is itself the diagnostic. The story is the same. The capacity to act on the story is what changes.
At Level 1 (Cadet, AI Aware), the executive sees the news and stops at concern. Something disturbing happened. AI is moving fast. The conversation at the dinner table is real. The conversation at the next board meeting will probably mention it. There is no further move.
At Level 3 (Lieutenant, Critical Thinker), the executive starts asking the rereading question. If a federal agency designed to protect this kind of information just got caught by AI accessibility on a 42-year-old algorithm, what else does the company's own disclosure surface look like under the same lens? Where else has the law's assumption about the distance between public and private just stopped being true? The Level 3 move is the act of asking. It does not require building the audit. It requires reading the news as a structural signal about the company's own posture, not as a story about somebody else's failure.
At Level 5 (Captain, Design Thinker), the executive builds the audit. The five-step exercise above is a Level 5 artifact. It requires designing a process the company did not have, with named owners, structured outputs, and a quarterly cadence. It is the move from asking the question to producing the institutional answer.
At Level 7 (Mission Director, AI Orchestrator), the executive operationalizes the doctrine across the company as continuous practice. The disclosure-exposure posture becomes part of how investor relations decides what to release, how legal advises on public testimony, how communications prepares the CEO for podcast appearances, and how the audit committee tracks structural risk. The doctrine stops being a document on a quarterly calendar and starts being a discipline embedded in the operating cadence.
The framework does not say every executive needs to operate at Level 7. It says the level is a measurable property of how the executive reads the story and what the executive does next. If you are reading this article and recognizing the question for the first time, you are at Level 1 on this surface. The move to Level 3 is asking the rereading question across your own organization's disclosure surface this week. That move is available to anyone reading. It does not require approval, budget, or a vendor.
The regulatory catch-up
The legal regime is behind the technical capability. That is the durable pattern across AI policy in 2026, and the NTSB case sits inside it.
The NO FAKES Act, introduced in the 119th Congress as H.R. 2794, would create a federal cause of action for unauthorized AI-generated voice and likeness replicas. The bill includes post-mortem rights and a registration-based structure that can extend protection, subject to limits and named exceptions for documentary, news, and parody use. Specific durations and triggers are set in the bill text and subject to legislative change. As of May 24, 2026, the bill is introduced, not enacted. A Senate companion is in the legislative process. The legislative timeline is uncertain.
State-level work has moved faster on specific surfaces. Tennessee's ELVIS Act provides voice-replica protections under state law. Other states have introduced or enacted variants of digital-replica legislation, particularly around political deepfakes and likeness rights for entertainers. The state patchwork is inconsistent, which is the normal pattern at this stage of a federal-state cycle on a new technology surface.
For an executive trying to read the regulatory direction, the most useful posture is to treat the NO FAKES Act as the direction federal policy is moving, build internal company doctrine that anticipates it, and watch the regulatory tracker for status changes. The AI Law Tracker at ailawtracker.org is the source LaunchReady maintains for this surface. It carries bill-by-bill status across all 50 states and federal action. The point of tracking is not to wait for a law to pass before acting. The point is to act before the law passes, with the law as a signal about where the structural risk is moving.
What changes from here
The NTSB just provided the most extreme primary-source proof yet that a 42-year-old assumption about public-records design no longer holds. The agency was lawful, careful, and explicitly avoided the part the law forbids. AI tools made the careful version equivalent to the forbidden one inside 24 hours. Every other federal disclosure regime is exposed to the same dynamic. Every corporate disclosure regime that runs on the same logic is exposed to the same dynamic. The exposure is structural, not incidental.
The audit takes thirty minutes. The output is a one-page doctrine and a calendar entry. The board conversation goes from theoretical to specific. The company moves from Level 1 reading-the-news to Level 3 asking-the-question to Level 5 building-the-audit. Run it this week.
Related reading: Performative AI Governance: 6 Tests From the New CARMA Paper and The 7 Domains of AI Governance: A Framework for Mid-Market Leaders and Career-Altering: What the Alabama AI Sanctions Order Means for Every Profession.
Sources
- National Transportation Safety Board. Investigation page DCA26MA024 (UPS Airlines Flight 2976).
- TechCrunch. "AI is being used to resurrect the voices of dead pilots." May 22, 2026.
- CNN. "A PDF let the internet hear the final words in the cockpit of a UPS plane as it crashed. The NTSB now wants it taken down." May 22, 2026.
- The Register. "Feds unwittingly leak pilots' pre-crash conversation." May 23, 2026. Contains the Jennifer Homendy "deeply troubling" statement.
- FlyingMag. "NTSB: UPS Cockpit Voice Recordings Fabricated With AI." Contains NTSB official statement on the docket pulldown.
- Scott Manley (@DJSnM). X post warning that the spectrogram contained reconstructable audio data. May 20, 2026.
- Aalto University. Speech-processing reference. Griffin-Lim algorithm explainer.
- librosa documentation. Griffin-Lim function reference. Standard Python audio library.
- U.S. Congress. NO FAKES Act of 2025, H.R. 2794, 119th Congress. Bill text.
- UPS Airlines Flight 2976. Crash background, casualty count, crew identification.
- AI Law Tracker. Bill-by-bill status of state and federal AI legislation, including digital-replica and post-mortem voice and likeness provisions.
- The 7 Levels of AI Proficiency framework. LaunchReady.ai.
Frequently Asked Questions
What happened with the NTSB and the dead pilots' voices?
On May 19, 2026, the National Transportation Safety Board released the public docket for its investigation into UPS Flight 2976, the November 4, 2025 cargo crash in Louisville that ultimately killed 15 people according to subsequent reporting (the NTSB investigation page records 14 fatalities at the time of last update, with one ground victim later dying on December 25, 2025). The docket included a written transcript of the cockpit voice recorder and a PDF showing a spectrogram (a still image of the audio waveform). Federal law forbids the NTSB from releasing the actual audio. Within about 24 hours, people on social media used the spectrogram plus the transcript with AI tools to reconstruct an approximation of the pilots' voices, including the last 30 seconds of flight, and posted clips to X, Reddit, and YouTube. The NTSB pulled its public docket system offline May 21, restored most of it on May 22, and kept 42 investigations closed pending review. NTSB Chairwoman Jennifer Homendy called the situation deeply troubling.
Did AI invent the voice reconstruction technique?
No. The core technique is the Griffin-Lim algorithm, published in 1984 by Daniel W. Griffin and Jae S. Lim of MIT in the IEEE Transactions on Acoustics, Speech, and Signal Processing. The algorithm estimates audio phase from a magnitude spectrogram by iterating forward and inverse short-time Fourier transforms. It has been in standard signal-processing textbooks and open-source audio libraries (such as librosa) for decades. What AI changed was who can execute the technique. The population moved from people with signal-processing training to anyone with an internet connection and a chatbot. The algorithm did not change. The accessibility of the algorithm changed.
Is what the AI users did illegal?
The federal legal answer is unsettled in May 2026. The NO FAKES Act, introduced as H.R. 2794 in the 119th Congress, would create a federal cause of action for unauthorized AI-generated voice and likeness replicas, including post-mortem rights subject to limits. Specific durations and triggers are set in the bill text. As of May 24, 2026, the bill is introduced, not enacted. Some state laws (including Tennessee's ELVIS Act for voice replicas) cover parts of the surface. The NTSB itself is asking platforms to remove the clips on grounds of family privacy and investigative integrity, but is not asserting criminal liability. The legal regime is behind the technical capability, which is exactly the kind of moment companies should be building internal policy against rather than waiting for.
What is the NO FAKES Act and when does it pass?
The NO FAKES Act is H.R. 2794 in the 119th Congress. It would create a federal cause of action for unauthorized AI-generated voice and likeness replicas. It includes post-mortem rights and a registration-based structure that can extend protection, subject to limits and named exceptions for documentary, news, and parody use. Specific durations and triggers are set in the bill text. As of May 24, 2026, the bill is introduced and not yet law. The companion bill is in the Senate. The 2026 session is active. The most useful posture for a CEO is to treat the NO FAKES Act as the direction the federal regime is moving, build internal policy that anticipates it, and watch the AI Law Tracker for status changes.
What is the 30-minute AI disclosure audit?
A five-step exercise the CEO or general counsel can run before the next board or audit committee meeting. Inventory the public voice and likeness footprint of the most senior executives (earnings calls, podcasts, keynote video, panel interviews). Map the company's public-disclosure surface (SEC filings, FOIA-eligible material, court records, regulatory comments, public testimony). Identify which exposures the law currently permits and which are now technically equivalent to non-permitted disclosures because AI tools can reconstruct the protected version from the released version. Draft a one-page disclosure-exposure doctrine for the audit committee. Add a quarterly review cadence to the governance calendar. The audit takes about thirty minutes for the first pass and produces a written artifact the board can review.
Which other federal disclosure regimes face this exposure?
Every public-records regime in the federal government was designed under the assumption that there is a meaningful distance between what the law permits releasing and the sensitive information underneath. AI is closing that distance in domain after domain. Earnings-call audio and transcripts published by companies and third-party services, Freedom of Information Act responses, federal court audio files available through PACER when part of the court record, deposition transcripts in public records, FERC filings, congressional hearing audio, and regulatory comment letters all carry training-data risk for voice and likeness replicas. The NTSB case is one of the clearest recent federal pullbacks. The structural exposure existed before and will continue to surface across agencies as the next twelve to twenty-four months play out.
How does The 7 Levels of AI Proficiency apply to public-disclosure risk?
The 7 Levels of AI Proficiency framework reads this story differently at each level. At Level 1 (Cadet, AI Aware) an executive sees the news and stops at concern. At Level 3 (Lieutenant, Critical Thinker) the executive starts asking the rereading question across the company's own disclosure surface. At Level 5 (Captain, Design Thinker) the executive builds the audit and the disclosure-exposure doctrine. At Level 7 (Mission Director, AI Orchestrator) the executive operationalizes the doctrine as continuous practice across the company. If you are reading this and recognizing the question for the first time, you are at Level 1. The move to Level 3 is asking the rereading question across your own organization's disclosure surface this week.
What should a board or audit committee ask about this?
Four questions the audit committee should put on the next agenda. What is the public voice and likeness footprint of our senior executives, in hours of audio and named locations. Which of our company's mandated public disclosures are technically reconstructable into the version the law forbids. What internal policy governs employee use of public AI voice tools on internal recordings (town halls, internal podcasts, leaked audio). When the NO FAKES Act or a state-level analog passes, what is the company's compliance posture, and who owns it. Each question maps to a finding that can go on a written page and into a quarterly review.
Find your AI Proficiency level
The free 7 Levels of AI Proficiency assessment places you across seven stages of AI capability. Under ten minutes. Research-backed scoring.