A Unified ESG–Cybersecurity Framework for AI Governance: Managing Sustainability, Social, and Security Risks in Enterprise AI Adoption

Enterprise adoption of artificial intelligence (AI) creates sustainability, social and security risks that firms typically govern through separate ESG and cybersecurity structures. This study asks whether, and under what conditions, large U.S. firms disclose an integrated approach to governing AI across the three domains. It uses a configurational, text-as-data design: the latest Form 10-K of each S&P 500 registrant (N = 500; analysis sample, n = 488) was converted into dictionary-based measures of AI, AI-governance, environmental, social and cybersecurity disclosure, sentence-level co-mention of AI with each risk domain, and an eleven-element score of the Form 10-K Item 1C cybersecurity-governance disclosure. Latent Dirichlet allocation of 9,444 AI-context sentences recovered six themes. Latent profile analysis identified four overlapping disclosure profiles (sustainability-led and AI-light, social-led with weak cyber governance, AI-intensive integrators, and security-anchored moderates) that differ by sector and by year-on-year growth in AI-governance language. Fuzzy-set qualitative comparative analysis showed two equifinal paths to integrated AI-governance disclosure: social-risk framing combined with intensive AI use, which was retained in every robustness specification, and a narrower path combining environmental framing, AI use and large size. Item 1C cybersecurity governance did not enter either main path, but its role is uncertain because the score varies little across firms. AI was mentioned within Item 1C by 24.8% of firms, and 8-K Item 1.05 incident disclosures did not distinguish profiles. Because all measures come from automated coding of disclosure, the findings describe reported rather than verified governance, and the cross-sectional design does not support causal claims. The findings motivate a Unified ESG–Cybersecurity Framework for AI Governance that applies the four NIST AI RMF functions jointly across the three domains through one AI inventory, one risk taxonomy, one reporting line and one disclosure narrative.