SEC 8-K Filings: The Federal Record of Every Material Corporate Event

When a chief executive resigns, an acquisition closes, a company files for bankruptcy, an auditor walks out, or a ransomware crew locks up the network, the public is supposed to learn about it within four business days—not at the next quarterly report. The instrument that carries that news is the SEC's Form 8-K, the current report: the real-time disclosure channel that captures material corporate events as they happen. Where the annual 10-K and the quarterly 10-Q are periodic, the 8-K is event-driven, which makes it the fastest structured signal of corporate change in EDGAR. Our table holds roughly 136,000 current-report filings, each tagged with the numbered item codes that say, in the government's own taxonomy, exactly what happened.

This article covers what the 8-K is and how it differs from the periodic reports; the four-business-day clock and the materiality standard that triggers a filing; the item-code taxonomy that classifies every event, from material agreements and acquisitions to restatements, executive departures, bankruptcies, and the 2023 cybersecurity-incident rule; how the tagged corpus powers event studies and corporate monitoring; the structure of our sec_8k_filings table and its columns; the join to the EDGAR company registry by CIK and to the rest of a filer's disclosure history; a Python workflow that pulls a company's 8-Ks from EDGAR's submissions API and tallies them by item code; and the caveats—materiality discretion, the gap between an item tag and the substance of the event, late and amended filings, and the difference between an 8-K and the press release it often attaches—that every analyst must internalize before drawing conclusions.

What the dataset is

The Securities Exchange Act of 1934 obliges public companies to keep the market informed not only on a fixed calendar but as significant events occur. The vehicle for the second obligation is Form 8-K, formally the “current report,” which a domestic reporting company must file to disclose the occurrence of any of a defined set of material events. The 8-K is the connective tissue of corporate disclosure: it fills the gaps between the annual Form 10-K and the quarterly Form 10-Q so that investors are not left waiting up to three months to learn that the company has changed in a way that matters. Because every triggering event is reported through the same form and tagged with the same numbered item codes, the universe of 8-Ks is a single, machine-classifiable record of material corporate change across the entire population of US public companies.

In our database this record is stored as the table sec_8k_filings, with the grain of one row per 8-K filing—roughly 136,000 current-report filings. Each row is keyed by the accession number, EDGAR's unique identifier for the submission, and by the filer's CIK, the Central Index Key that names the company. The columns capture who filed, when, what the form was, and—the analytic payload—the item codes that classify the event:

accession_number   -- EDGAR's unique submission ID (NNNNNNNNNN-NN-NNNNNN)
cik                -- Central Index Key of the filer (joins to the registry)
company_name       -- the filer's name as carried on EDGAR
form_type          -- "8-K" (or "8-K/A" for an amendment)
filing_date        -- the date the report was filed with EDGAR
period_of_report   -- the date of the triggering event
items              -- comma-separated item codes (e.g. "5.02,9.01")
-- common item codes the "items" field carries:
--   1.01  entry into a material definitive agreement
--   1.03  bankruptcy or receivership
--   1.05  material cybersecurity incident (2023 rule)
--   2.01  completion of acquisition or disposition of assets
--   4.02  non-reliance on previously issued financials (restatement)
--   5.02  departure/appointment of directors or officers
--   8.01  other events
--   9.01  financial statements and exhibits

Two columns do the heaviest lifting. The cik is the join key: the Central Index Key is a persistent integer EDGAR assigns to every filer, and it is what ties an 8-K to the same company's registration record, its periodic reports, its insider transactions, and every other filing it has ever made. The items field is the substantive payload. Each 8-K is tagged with one or more numbered item codes drawn from the form's fixed taxonomy, and a single report frequently carries several—an acquisition announcement (Item 2.01) accompanied by the financial statements and exhibits that document it (Item 9.01), or a leadership change (Item 5.02) bundled with a press release (Item 8.01). Because the item code is part of the structured filing metadata rather than buried in the prose, the entire corpus can be filtered by event type without reading a word of the documents: every restatement, every executive departure, every bankruptcy, every reported cyber incident is addressable by its code.

The current report and the four-business-day clock

The defining feature of the 8-K—the thing that makes it valuable as a signal—is its speed. For most triggering events, the company must file the 8-K within four business days of the event's occurrence. That is a sharp departure from the periodic reports, which arrive on a fixed quarterly and annual schedule weeks after the period they cover. The four-day window is short enough that the 8-K functions, in practice, as the market's near-real-time feed of corporate developments: a resignation announced on a Monday is, in the ordinary course, a matter of public EDGAR record by that Friday. A handful of item categories carry different timing—certain Regulation FD and selected-financial-data disclosures are governed by their own triggers—but the four-business-day rule is the backbone of the form and the reason 8-Ks cluster so tightly around the dates of the events they describe.

What pulls an event into the 8-K net is materiality. The 8-K does not require disclosure of every corporate happening; it requires disclosure of the events the rules enumerate, and several of those items are themselves qualified by a materiality standard—a development is reportable when there is a substantial likelihood that a reasonable investor would consider it important. This is where judgment enters, and where the dataset's caveats begin. Some items are bright-line and leave little discretion (a bankruptcy filing, the completion of an acquisition, a change in the certifying accountant). Others—most pointedly the “other events” catch-all and the materiality-gated cybersecurity item—turn on a company's own assessment of significance, which means the presence or absence of a filing reflects not only what happened but how the company chose to characterize it. The four-day clock and the materiality trigger together explain both the timeliness that makes the 8-K useful and the discretion that makes it imperfect.

The item-code taxonomy

The 8-K is organized into numbered items, grouped into sections, and the item number is the form's native classification of what occurred. Knowing the taxonomy is what turns the corpus from a pile of filings into a queryable event stream. The items are organized into broad sections—registrant's business and operations, financial information, securities and trading markets, matters related to accountants and financial statements, corporate governance and management, asset-backed securities, Regulation FD, and other events—and within each section the specific items name specific events.

A handful of items carry most of the analytic weight. Item 1.01, entry into a material definitive agreement, captures the contracts that move a business: merger agreements, major supply or licensing deals, significant financings. Item 1.03, bankruptcy or receivership, marks the moment a company enters insolvency proceedings—a clean, bright-line signal of distress. Item 2.01, completion of the acquisition or disposition of assets, records when a deal actually closes, as distinct from the agreement that announced it. Item 2.02, results of operations and financial condition, is the item that carries earnings releases, making it one of the highest-volume items and a recurring, calendar-clustered event rather than an idiosyncratic one. Item 4.02, non-reliance on previously issued financial statements, is the restatement flag—the company telling the market that earlier financials can no longer be trusted, one of the most consequential and closely watched negative signals in the entire taxonomy.

On the governance side, Item 5.02, the departure or appointment of directors and certain officers, is among the most analytically rich items: it records executive and board turnover, including the abrupt CEO and CFO departures that often presage trouble. Item 8.01, other events, is the deliberate catch-all—the optional item a company uses to disclose anything it deems material that does not fit a specific item, which makes it both flexible and noisy. Item 9.01, financial statements and exhibits, is the attachment item: it is where the actual press release, agreement, or pro-forma financials ride along, and it co-occurs with many other items rather than standing alone. The newest entrant is Item 1.05, material cybersecurity incidents, added under the SEC's 2023 cyber-disclosure rule, which created a dedicated item for a category of event that previously had to be shoehorned into Item 8.01. Each filing is tagged with whichever of these items applies, and the multiplicity of tags on a single report is a feature: it is how the form expresses that one corporate event has several reportable facets.

The 2023 cybersecurity-incident rule

The most significant recent change to the 8-K is the addition of Item 1.05, the dedicated item for material cybersecurity incidents. In 2023 the SEC adopted a rule requiring public companies to disclose a cybersecurity incident that they determine to be material—and to do so generally within four business days of the materiality determination, rather than within four days of the incident itself, a distinction that matters because the full scope of a breach is often not knowable on day one. The disclosure must describe the material aspects of the incident's nature, scope, and timing, and its material impact or reasonably likely material impact on the company. The rule carved cyber out of the catch-all and gave it a structured home in the taxonomy.

For the dataset, Item 1.05 is a clean illustration of how regulatory change becomes a new analytic dimension. Before the rule, material cyber incidents that were disclosed at all tended to surface under Item 8.01, mixed in with every other “other event,” which made them hard to isolate systematically. After the rule, an analyst can filter the items field for “1.05” and pull the population of company-declared material cyber incidents directly—a structured, governmentwide, date-stamped record of breaches that did not exist as a queryable category a few years ago. The rule also exposes the materiality-discretion problem in sharp relief: because the trigger is the company's own determination of materiality, the Item 1.05 record reflects breaches that companies decided were material and chose to characterize as such, which is not identical to the universe of breaches that occurred. The item is a powerful new lens, but it is a lens onto disclosure decisions as much as onto incidents.

Event studies and corporate monitoring

The combination of timeliness, a triggering-event date, and machine-readable item tags is exactly what the academic and practitioner technique of the event study requires, and the 8-K corpus is one of its richest raw materials. An event study measures how a defined corporate event affects a company's stock price by comparing returns around the event date against an expected baseline. The method needs a precise event date and a clean event classification—both of which the 8-K supplies: the period_of_report dates the event, the filing_date dates the disclosure, and the item code classifies what kind of event it was. Researchers use 8-Ks to study the market reaction to acquisitions (Item 2.01), to restatements (Item 4.02), to CEO departures (Item 5.02), and now to disclosed cyber incidents (Item 1.05), pooling thousands of events of a single type into a statistically powerful sample precisely because the item tag makes the events comparable.

Beyond formal event studies, the 8-K corpus is the backbone of real-time corporate monitoring. Because filings arrive within days of the events they describe and are tagged by type, the dataset can be operated as a streaming feed of corporate change: a watchlist that surfaces every new Item 4.02 restatement across a portfolio, every Item 5.02 executive departure at a set of competitors, every Item 1.03 bankruptcy in an industry, or every Item 1.05 cyber incident sector-wide. This is how credit analysts watch for distress, how M&A bankers track deal flow, how governance teams monitor board turnover, and how journalists catch the resignation no one announced in a press release. The same structure supports trend analysis at scale—counting restatements over time as a barometer of accounting quality, or charting the ramp of Item 1.05 filings as companies adapt to the cyber rule—turning the individual filing into a population-level indicator of the health and turbulence of corporate America.

Joining to the company registry and the filing history

The 8-K table is most valuable not in isolation but as one facet of a filer's complete EDGAR footprint, and the cik is the universal key that makes the integration possible. Three joins matter most.

The first is to the EDGAR company registry. EDGAR maintains a master index of every filer keyed by CIK—the company's name, its ticker symbol or symbols, its state of incorporation, its standard industrial classification (SIC) code, and the addresses on record. Joining sec_8k_filings to the registry by CIK is what lets an analyst interpret an 8-K in context: it supplies the industry needed to study restatements or cyber incidents sector by sector, the ticker needed to align a filing with market data for an event study, and the canonical name needed to disambiguate filers whose names appear similar. Without the registry join, a CIK is an opaque integer; with it, every filing is anchored to a known company of known industry and listing status.

The second join is to the rest of the same company's filing history. The 8-K does not live alone: the same CIK files 10-Ks and 10-Qs (the periodic reports the 8-K fills the gaps between), proxy statements, and registration statements. Reading the 8-Ks alongside the periodic reports is how an analyst reconstructs the narrative arc of a corporate event—the Item 1.01 that announces a merger agreement, the Item 2.01 that records its completion, and the next 10-K that absorbs the acquired business into the audited financials. The 8-K supplies the timely flash; the periodic reports supply the durable, audited account; together they tell the whole story, and the CIK is what stitches them in sequence.

The third join is to the ownership and insider record. The people and events an 8-K describes frequently appear in adjacent EDGAR datasets: the executive whose departure is reported under Item 5.02 has a trail of Form 4 insider transactions; the acquirer who triggers an Item 1.01 may have filed a Schedule 13D disclosing an activist stake that precipitated the deal. Joining 8-Ks to the insider-transaction and beneficial-ownership filings, all keyed through the company's CIK and the individuals' own identifiers, is what lets an analyst connect a governance event to the trading and ownership dynamics behind it—the cross-filing analysis that turns a single 8-K into a node in the larger graph of who owns, runs, and trades a public company.

Analytical uses

A national, company-resolved, date-stamped, item-tagged record of material corporate events supports a distinctive set of analyses that the periodic reports alone cannot.

Restatement tracking by industry and over time is one of the most established uses. Filtering for Item 4.02 isolates the population of companies that have told the market their prior financials cannot be relied upon, and rolling those filings up by SIC code and filing date produces a barometer of accounting quality—which industries restate most, whether the rate is rising or falling, and which restatements cluster around audit-firm or regulatory events. Because the item tag is unambiguous, the measure is reproducible in a way that text-mining for “restatement” in prose never could be.

Executive-turnover and governance analysis exploits Item 5.02. Aggregating director and officer departures across companies surfaces patterns in CEO and CFO turnover—the abrupt, unexplained departures that correlate with subsequent bad news, the board refreshment that follows activist campaigns, the seasonal cadence of planned successions. Combined with the registry, the analysis can be cut by industry, size, and listing status to ask which kinds of companies churn their leadership and when.

M&A and distress monitoring pairs Items 1.01 and 2.01 with Item 1.03 to track the two ends of the corporate lifecycle: deal flow on one side (agreements signed and acquisitions completed) and insolvency on the other (bankruptcies and receiverships). Finally, cyber-incident analysis brings the newest item to bear: filtering for Item 1.05 produces the structured record of company-declared material breaches, which can be studied for frequency, sector concentration, disclosure latency, and—through an event study—market reaction, a category of analysis that the 2023 rule made systematically possible for the first time.

Python workflow: pulling a company's 8-Ks from EDGAR

The script below pulls a single company's 8-K filings from EDGAR's submissions API on data.sec.gov, tags each filing with its item codes, and computes three of the core metrics: the filing cadence (how many 8-Ks the company files per year), the event mix by item code (which categories of event dominate), and a governance-event flag (how many filings carry the Item 5.02 director-or-officer-change tag). No API key is required, but EDGAR mandates a descriptive User-Agent header identifying the caller—requests without one are throttled or blocked—and the service expects callers to stay under roughly ten requests per second. The submissions endpoint returns a filer's recent history including the items field that carries the comma-separated item codes for each 8-K.

import requests
import pandas as pd
from collections import Counter

# SEC EDGAR submissions + full-text-search APIs -- no key required, but
# EDGAR mandates a descriptive User-Agent identifying the caller. Requests
# without one are throttled or blocked. Keep request rate under ~10/sec.
HEADERS = {"User-Agent": "AI Analytics research info@ai-analytics.org"}
SUBMISSIONS = "https://data.sec.gov/submissions/CIK{cik:010d}.json"
FTS = "https://efts.sec.gov/LATEST/search-index?q={q}"  # full-text search


def submissions(cik):
    # The submissions API returns a company's recent filing history,
    # including form type, accession number, filing date, and -- for 8-Ks
    # -- the item codes carried in the "items" field (a comma string like
    # "5.02,9.01").
    r = requests.get(SUBMISSIONS.format(cik=int(cik)), headers=HEADERS, timeout=60)
    r.raise_for_status()
    return r.json()


def recent_8ks(cik):
    data = submissions(cik)
    recent = data["filings"]["recent"]
    frame = pd.DataFrame({
        "form": recent["form"],
        "accession": recent["accessionNumber"],
        "filed": recent["filingDate"],
        "items": recent.get("items", [""] * len(recent["form"])),
    })
    eightks = frame[frame["form"] == "8-K"].copy()
    eightks["filed"] = pd.to_datetime(eightks["filed"], errors="coerce")
    return data.get("name", str(cik)), eightks


def analyze(cik):
    name, eightks = recent_8ks(cik)
    if eightks.empty:
        print(f"No 8-K filings in recent history for {name}.")
        return

    # --- 1. Filing cadence ----------------------------------------------
    span_days = (eightks["filed"].max() - eightks["filed"].min()).days or 1
    per_year = len(eightks) / (span_days / 365.25)
    print(f"{name}: {len(eightks):,} 8-Ks in recent history "
          f"(~{per_year:.1f} per year)")

    # --- 2. Event mix by item code --------------------------------------
    # Each 8-K can carry several items; split the comma string and tally.
    item_counts = Counter()
    for raw in eightks["items"].fillna(""):
        for code in str(raw).split(","):
            code = code.strip()
            if code:
                item_counts[code] += 1
    print("  Most common items:")
    for code, n in item_counts.most_common(8):
        print(f"    Item {code:<6} {n:>4}  {ITEM_LABELS.get(code, '')}")

    # --- 3. Governance-event flag ---------------------------------------
    # Item 5.02 = departure/appointment of directors and officers.
    gov = eightks[eightks["items"].fillna("").str.contains("5.02")]
    print(f"  Director/officer-change 8-Ks (Item 5.02): {len(gov):,}")
    return eightks


# A small label map for the items this script reports on.
ITEM_LABELS = {
    "1.01": "material definitive agreement",
    "1.03": "bankruptcy or receivership",
    "1.05": "material cybersecurity incident",
    "2.01": "completion of acquisition/disposition",
    "2.02": "results of operations",
    "4.02": "non-reliance on prior financials (restatement)",
    "5.02": "director/officer departure or appointment",
    "8.01": "other events",
    "9.01": "financial statements and exhibits",
}

analyze(320193)   # Apple Inc. (CIK 0000320193)

Two practical notes apply. First, the submissions endpoint returns only a filer's recent filings in the primary JSON; a company with a long, dense history will have older filings paged into supplementary files referenced by the same endpoint, so a complete longitudinal pull must follow those references rather than stopping at the first response. Second, for cross-company work—scanning every recent 8-K for a given item such as a 5.02 departure or a 1.05 cyber incident, rather than profiling one filer—EDGAR's full-text search service (efts.sec.gov) and the daily and full filing indexes are the right tools: the full-text search can return all filings of a form type tagged with a particular item over a date range, and the index files enumerate every submission for bulk download, both far more efficient than walking the per-company submissions endpoint across thousands of CIKs.

Limitations and analytical caveats

The 8-K corpus is the most timely and comprehensive public record of material corporate events in the United States, but it carries structural limitations that an analyst must internalize before drawing conclusions from it.

Materiality is a judgment, so absence is not evidence of non-occurrence. Many items—and Item 1.05 and the Item 8.01 catch-all most of all—are triggered by the company's own determination that an event is material. That means the dataset records the events companies decided were material and chose to disclose under a given item, which is not identical to the universe of events that occurred. A breach a company judged immaterial, a contract it characterized as ordinary-course, a soft departure it framed as a planned transition—these may be under-tagged or absent. Reading the non-appearance of an 8-K as proof that nothing happened over-reads what the data can bear; the corpus is a record of disclosure decisions as much as of events.

An item tag is a classification, not the substance. The item code tells you the category of an event—a director or officer change, a material agreement, an other event—but it does not tell you the magnitude, the direction, or the specifics. An Item 5.02 covers both the routine retirement of a long-tenured director and the abrupt firing of a CEO under a cloud; an Item 1.01 covers both a transformative merger and a modest financing. The full texture lives in the body of the filing and its exhibits, not in the tag. Analyses that count item codes without reading the underlying documents are measuring event frequency, not event significance, and should resist the temptation to treat every instance of an item as equivalent.

Late filings and amendments complicate the timeline.The four-business-day rule is a requirement, not a guarantee: companies sometimes file late, and a late 8-K stretches the gap between the event and its appearance in the data. Companies also amend filings—the 8-K/A—to correct, supplement, or complete an earlier report, most commonly to attach the audited financial statements that an acquisition disclosure required within a longer grace period. An analyst building an event timeline has to decide how to treat amendments (as new events, as updates to the original, or as duplicates) and has to recognize that the filing_date can lag the period_of_report by more than four days. Conflating the disclosure date with the event date, or double-counting an original and its amendment, distorts any cadence or event-study analysis.

An 8-K is not the same as the news, and not every event maps to one filing. The 8-K often attaches a press release as an exhibit under Item 9.01, but the filing and the press release are not interchangeable: the release may say more, or less, or frame the event differently, and material information sometimes reaches the market through other channels first. Conversely, a single business development can generate several 8-Ks over weeks—the agreement, the completion, the related governance change—while a single 8-K can bundle several items at once. The mapping between real-world events and filings is neither one-to-one nor stable, which means reconstructing the true sequence of a corporate episode requires reading the filings as a connected narrative rather than as independent rows.

Held with these caveats in mind, the sec_8k_filings table is a uniquely valuable resource: a company-resolved, date-stamped, item-tagged record of the material events that move public companies—roughly 136,000 current reports through which mergers, departures, restatements, bankruptcies, and, since 2023, cyber incidents enter the public record within days of happening, the real-time half of a disclosure system whose durable, audited account arrives later in the periodic reports the 8-K exists to stay ahead of.