A filing lands on EDGAR at 3:47pm. Buried in it is a change to capital allocation language that moves the thesis on a core holding. The desk finds out the following morning, from a news digest, after the price already moved.
That gap has a cost. It also compounds, because it is not one filing. It is every filing, across every name in the book, every day.
Portfolio filing alerts exist to close it. Built properly they convert filings, transcripts, and regulatory disclosures into structured signals that reach the right analyst while the information still carries an edge. Built badly they produce a channel nobody reads by week three.
Most guides on this subject explain how to watch EDGAR. That works until your book holds a company that does not file with the SEC, which for most institutional desks is the majority of the book. This guide covers the full workflow, including the parts that break at the border.
Quick guide: building portfolio filing alerts in seven steps
Define the coverage universe and the document types that carry signal. Map every name and every filing category, including the non US equivalents.
Set materiality tiers before writing a single rule. Decide what interrupts an analyst and what waits for the digest.
Choose your sources and understand what each one will not give you. EDGAR is free, authoritative, and has specific limits worth knowing before you build on it.
Build extraction rules that compare against the prior filing. Keyword matching catches the obvious and misses the expensive.
Route by coverage, tier, and escalation. An alert that reaches the wrong person is the same as no alert.
Link every alert back to its source document. An alert without the changed paragraph attached creates work rather than removing it.
Backtest, tune the false positive rate, and automate. Run it against historical filings before it touches a live desk.
Step 1: Define the coverage universe and the document types that carry signal
Start with the names. A concentrated equity fund might track 50 holdings and 100 watchlist names. A multi strategy desk can reach several thousand across asset classes and geographies. Write the number down, because it determines everything about the architecture that follows.
Then map the documents. In the United States, the hierarchy is reasonably clear. Form 8-K carries unscheduled material events and must be filed within four business days of the triggering event. Form 4 reports insider transactions within two business days. Schedule 13D, following the 2024 amendments, is due within five business days of crossing the 5 percent threshold. Annual and quarterly reports carry signal in specific sections rather than in the headline numbers, particularly risk factors, management discussion, and guidance language.
Within 8-K, the item code matters more than the form. Item 1.05 covers material cybersecurity incidents. Item 2.02 covers results of operations. Item 4.02 covers non reliance on previously issued financial statements, which is the restatement signal. Item 5.02 covers the departure or election of directors and principal officers. Item 7.01 covers Regulation FD disclosure and is frequently a press release in a wrapper. Treating all 8-Ks as equivalent is the first design error most teams make.
Outside the United States the mechanism changes but the materiality does not. In the United Kingdom, Regulatory News Service announcements perform a similar function, with the National Storage Mechanism holding the regulated information. In Japan, timely disclosure runs through TDnet while statutory filings sit in EDINET. In mainland China, CNINFO publishes A-Share disclosures in Mandarin, including material that has no Western equivalent. A German ad hoc disclosure carries exactly the same thesis risk as an 8-K if the company sits in your book.
This is the step where most alert projects quietly narrow their ambition. The universe defined on the whiteboard is global. The universe that gets built is whatever EDGAR makes easy.
Step 2: Set materiality tiers before writing a single rule
Not every filing deserves an interruption. The purpose of a tier is to separate signal from noise at detection, before anything reaches an inbox, because filtering after delivery has already cost the analyst the attention.
Two tiers is usually enough.
Immediate covers guidance language changes, executive departures, material agreements, restatements, regulatory actions, and cybersecurity incidents. These justify a push notification or a flagged item in the research platform.
Review covers routine quarterly results inside consensus, proxy filings with no governance change, and insider transactions below a position size threshold. These belong in a daily or weekly digest.
The harder design question is what the threshold actually tests. A tier defined on form type is crude, because an 8-K can be a restatement or a press release. A tier defined on language is far more useful. A shift from expecting continued growth to anticipating headwinds is a qualitative change that no keyword filter catches, and it is precisely the change worth waking someone for.
Write the tiers down before building, and have the covering analysts sign off on them. An alert system whose thresholds were set by the person who built it rather than the people who receive it tends to get muted.
Step 3: Choose your sources, and understand what each one will not give you
Three source categories matter, and each carries constraints that are better understood before you build than after.
Direct regulatory feeds. EDGAR for SEC filings, the National Storage Mechanism and RNS for the United Kingdom, EDINET and TDnet for Japan, CNINFO for China A-Shares, and the equivalent repository in every other jurisdiction you cover. These are authoritative and free, and they come with real engineering constraints.
The SEC limits automated access to ten requests per second per user, counted across every machine and IP address you use rather than per connection, a policy in force since July 2021. Exceeding it gets the address throttled until the rate drops back under the threshold. For a single analyst that ceiling is invisible. For a monitoring workflow polling several thousand names across multiple document types, it arrives faster than most teams model, and one cold cache burst of parallel requests can take the service down for everyone behind that address.
The EDGAR RSS feeds are pull based rather than push based, so you are polling on an interval and your latency floor is that interval. Vendors who work with the feed at scale report that a meaningful share of filing types do not reliably appear in it. The full and quarterly index files are rebuilt weekly on Saturday mornings so that post acceptance corrections are incorporated, which means an index read midweek is not necessarily final. None of this makes EDGAR unusable. It makes EDGAR a source that needs engineering around it rather than a feed you subscribe to.
Structured earnings content. Transcripts, prepared remarks, and question and answer sections carry language shifts that never appear in the regulatory filing. Guidance softens in the Q and A before it changes in the release. Monitoring this layer requires transcript coverage across the whole universe rather than the names a provider happens to cover well.
Regulatory and enforcement publications. New rules, consultation papers, enforcement actions, and no action letters can reprice an entire sector at once. This is the category most desks skip, and it is the one where a single alert can matter more than a hundred company filings.
Step 4: Build extraction rules that compare against the prior filing
This is where do it yourself systems most often fail.
The naive approach scans for terms: restatement, going concern, material weakness. That catches the obvious cases, which are also the cases the market has already priced by the time you read them.
The useful approach compares the current filing against the prior period version of the same document, section by section, and surfaces additions, deletions, and changes in framing. Risk factors, management discussion, guidance language, and related party disclosures are where the signal concentrates. A new risk factor that was absent last quarter is worth more than any keyword hit.
For transcripts, run the same comparison across prepared remarks and the question and answer section. New terminology, a previously unmentioned risk, or a change in how management answers the same analyst question often carries more information than the reported numbers.
Two problems make this harder than it sounds.
The first is document structure. Filings are not consistently formatted, sections are not reliably labeled, and tables are frequently the part that matters. Extraction rules written against clean text fail against a PDF appendix, and a comparison engine that cannot align sections between periods will report the whole document as changed.
The second is language. A Japanese earnings outlook section carries the same weight as an American management discussion. Extraction rules that only work in English apply your monitoring unevenly across the book, which is a subtler failure than no monitoring at all, because the gaps are invisible from inside the system.
Step 5: Route by coverage, tier, and escalation
Route on three attributes: the company identifier, the document type, and the materiality tier from step two.
A workable default sends 8-K filings and transcript language changes on holdings directly to the covering analyst, sector wide regulatory updates to the head of research and the compliance desk, and insider transactions above a defined threshold to the portfolio manager.
Escalation is the part teams skip and then regret. If a high materiality alert is not acknowledged within a set window during market hours, it should escalate to a second reviewer. Without that rule the workflow inherits the single point of failure it was built to remove, since one analyst on a flight reproduces exactly the gap described at the top of this article.
Deliver into the tools the desk already uses. Slack, Teams, email digests, or direct integration with the portfolio management system all work, provided the alert arrives with enough context to triage without opening the source document.
Step 6: Link every alert back to its source document
An alert that says a material change was detected, with no evidence attached, has moved work rather than removed it. The analyst now has to find the filing, locate the section, and retrieve the prior version to compare.
Every alert should carry the changed passage, the prior version alongside it, the document identifier or accession number, and a direct link to the original filing at the source.
This matters for compliance as much as for speed. When an auditor asks why the desk acted on a particular disclosure, the chain from alert to source paragraph to research note needs to already exist. Reconstructing it afterward is expensive and rarely convincing.
The wider context is worth noting here. In Grant Thornton's 2026 AI Impact Survey of 950 business leaders, 78 percent lacked strong confidence that they could pass an independent AI governance audit within 90 days. Any automated monitoring workflow that produces conclusions without a traceable evidence chain is adding to that exposure rather than reducing it.
Step 7: Backtest, tune the false positive rate, and automate
Before the workflow touches a live desk, run it against three to six months of historical filings for a subset of the universe. Count both failure modes: alerts triggered by changes that did not matter, and material changes the rules missed.
As a working guide, a false positive rate around 10 percent is tolerable at launch. Above 25 percent the rules need tightening and the channel will be muted before it earns trust. Below 5 percent you are probably filtering too hard and suppressing real signal, which is the more expensive error because it is silent.
False negatives deserve more attention than they usually get. A noisy alert system annoys people. A quiet one that missed a restatement costs money, and nobody finds out until afterward.
Once live, review quarterly. Portfolios turn over, risk themes move, and new disclosure regimes create filing types that did not exist when the rules were written.
Where do it yourself alert systems break
Most desks that attempt this in house get a working prototype for United States large caps within a few weeks. The difficulty arrives afterward, and it arrives in the same four places every time.
Coverage stops at the border. The prototype is built on EDGAR because EDGAR is well documented and free. Extending it to the United Kingdom, Japan, Germany, and mainland China means a separate integration per jurisdiction, each with its own format, its own update behavior, and its own idea of what a company identifier is.
Entity resolution is harder than the alerting. The same issuer appears under different identifiers across EDGAR, an exchange feed, a transcript provider, and the internal position keeping system. Without a resolved entity master, alerts either miss filings or fire against the wrong holding, and both erode trust quickly.
Parsing is a maintenance commitment, not a project. Document formats change without notice. A parser that handled a company's annual report last year fails on this year's version, silently, and the failure looks identical to no filing having been published.
Nobody owns it. The system is usually built by one person alongside their actual job. It works until they move teams.
The underlying finding is consistent with what the industry reports about itself. In the Grant Thornton and ThoughtLab asset management survey of 500 senior executives, more than half cited limited access to quality data as a major barrier to scaling AI, and roughly half had not built processes to clean, normalize, and tag internal data or to source quality external data. The constraint is rarely the alerting logic. It is the data layer underneath it.
What changes once the universe goes global
Three things get materially harder outside the United States, and they are worth pricing into any build versus buy decision.
Translation has to be analytical rather than literal. A machine translated disclosure is usually good enough to read and rarely good enough to run a language comparison against, because the same source sentence can translate differently between quarters and produce a change signal that does not exist.
Some disclosure types have no Western equivalent. Mainland listed Chinese companies are required to disclose institutional on site research meetings, publishing the questions asked by visiting brokers and asset managers. Between 75 and 80 percent of covered companies publish that material within three days of the meeting. For a desk with A-Share exposure this is among the highest signal content available anywhere, and almost no monitoring workflow built on Western sources touches it.
Timing conventions differ. Filing deadlines, market hours, and disclosure practice all vary by jurisdiction, so an escalation rule calibrated to New York hours behaves unpredictably against a Shenzhen filing.
How Orbit supports this workflow
Orbit is an award winning AI investment research platform, and the part relevant to filing alerts is the infrastructure underneath rather than any single feature.
Orbit processes 70 million documents a year across more than 75,000 companies and over 80 exchanges, spanning 308 document types parsed at better than 99 percent accuracy with tables extracted, sections tagged, and entities resolved across markets. Filings are monitored across more than 100,000 sources and become queryable within minutes of publication. Coverage includes 5,500 China A-Share tickers with the institutional on site research transcripts described above, in original Chinese and professional English translation.
Orbit Agent Builder is where the monitoring logic lives. Analysts define what an agent reads, what it extracts, and how it reports, with no code and no engineering support, then run it on a schedule or trigger it on a new filing. The materiality tiers from step two and the comparison rules from step four are expressed as agent instructions rather than as a codebase somebody has to maintain. Agents in the Orbit Agent Marketplace can be opened and edited rather than accepted as supplied.
Every output carries a citation to the source document and page, which satisfies step six without additional engineering. Orbit MCP extends the same corpus into Claude, ChatGPT, Copilot, and Gemini, so an analyst receiving an alert can interrogate the underlying filings in the tool they already have open, and the REST API supports teams that would rather build their own delivery layer on top.
The choice for most desks is not whether to monitor. It is whether to spend an engineering year rebuilding the data layer or to put that year into the monitoring logic that is actually specific to their process.
These are conversations that matter deeply to us at Orbit. If your desk is weighing that decision, we would rather you tested the coverage against your own book than took our word for it.
Frequently asked questions
What is a portfolio filing alert?
A portfolio filing alert is an automated notification triggered when a company in your coverage universe publishes a regulatory filing or disclosure document that meets a defined materiality threshold. The point is the threshold. A notification on every filing is a feed rather than an alert, and it gets muted within weeks.
Which filing types signal material change?
In the United States, Form 8-K carries unscheduled material events, with the item code determining the signal value. Item 4.02 indicates non reliance on previously issued financials, Item 5.02 covers departures of directors and principal officers, and Item 1.05 covers material cybersecurity incidents. Annual and quarterly reports carry signal in risk factors, management discussion, and guidance language rather than in the headline figures. Outside the United States, RNS announcements in the United Kingdom, TDnet and EDINET disclosures in Japan, and CNINFO publications for China A-Shares serve equivalent functions.
How quickly should a filing alert reach an analyst?
For material event filings the useful target is minutes. The binding constraint is usually the source rather than the alerting logic, since EDGAR RSS feeds are pull based and your latency floor is your polling interval. Orbit monitors more than 100,000 sources and makes filings queryable within minutes of publication.
Can I build this on EDGAR alone?
For United States coverage, yes, with caveats worth knowing first. The SEC limits automated access to ten requests per second per user across all machines, the RSS feeds are pull based and do not reliably carry every filing type, and index files are rebuilt weekly to incorporate post acceptance corrections. For anything outside the United States, EDGAR gives you nothing, and each additional jurisdiction is a separate integration.
How do I reduce false positives in filing alerts?
Filter on item codes rather than form types, so a Regulation FD press release does not carry the same weight as a restatement. Compare flagged language against the prior period version of the same section and suppress changes that are only dates or formatting. Escalate genuinely new content, particularly risk factors that were absent last quarter. Backtest against historical filings and treat a rate above 25 percent as a signal that the rules need tightening.
What is the difference between a filing alert and a news alert?
A filing alert is triggered by a primary source document submitted to a regulator or exchange. A news alert is triggered by secondary coverage of that document. The filing is earlier and carries the original language, which is why institutional desks prioritize it, though news remains useful for context the filing does not provide.
Do filing alerts work for non English disclosures?
They can, though the translation has to be analytical rather than literal. Running a period over period language comparison against machine translated text produces false signals, because the same source sentence can translate differently between quarters. The comparison needs to run against the original language with translation applied to the output.
Do filing alerts cover sustainability and governance disclosures?
Yes, and this is increasingly where the regulatory exposure sits. Sustainability reports, climate transition plans, stewardship disclosures, and governance documents can all be monitored for language changes, new policy publications, and shifts in reporting methodology. Under CSRD, SFDR, and the UK Sustainable Disclosure Requirements, the audit trail from alert to source document matters as much as the alert itself.
Should we build this in house or buy it?
The alerting logic is the easy part and it is also the part specific to your process, so it is worth owning. The data layer underneath, which means monitoring sources across dozens of jurisdictions, parsing inconsistent formats reliably, resolving entities across markets, and keeping all of it current daily, is a permanent engineering commitment rather than a project. Most desks that build end up licensing the data anyway, at which point the question is whether the delivery layer justified the team maintaining it.
