SEC examiners want your AI governance on the record

AI controls are a named target in the SEC's fiscal 2026 examination priorities. Citywire reports that recent examination requests go a step further: examiners want to know whether a firm has an AI committee, and whether that committee keeps written meeting minutes. The subtext is supervision.

That scrutiny runs on existing authority. No SEC rule requires a standalone AI policy, experts say. The requirements are the ones already on the books: the Marketing Rule, Regulation S-P, the Advisers Act compliance rule, and fiduciary duty all apply to a firm's use of AI. The 2026 priorities tell examiners to check whether policies and procedures monitor AI used for trading, back-office operations, fraud detection, and anti-money laundering, and whether public claims about AI capabilities match what the technology actually does.

RIA exposure runs in two directions. The first is AI washing—overstating AI capabilities to clients. That was the conduct behind the SEC's 2024 enforcement cases against Delphia (USA) and Global Predictions. The combined settlement was $400,000. The second is quieter: failing to supervise the AI actually running inside the firm. The recent requests suggest examiners now look beyond marketing.

Citywire's reporting doesn't specify who should sit on an AI committee or how often it should meet. What the requests do establish is that the body must exist and its work must be on the record. That could be two people at a small RIA or a standing committee at a large one. The minutes are the deliverable examiners can hold.

The underlying standard is the Advisers Act compliance rule: written policies reasonably designed to prevent violations. For AI, that means procedures for how tools are selected, how outputs are reviewed, and who is accountable. Recordkeeping is already required, so AI-related decisions and reviews need a documentary answer. Regulation S-P already requires safeguarding client data and overseeing service providers, which pulls AI vendors into the review.

The Marketing Rule is the other half. If a firm tells clients it uses AI for rebalancing, examiners will check that rebalancing is what the AI does. The 2024 cases put the industry on notice; the 2026 priorities make the match between claim and capability an exam theme. A firm can get ahead of that by writing down every public AI claim and auditing it against the tool's actual behavior before an examiner does.

Visibility comes first. “You can't govern what you can't see,” warns NobleCloak, a governance platform for regulated firms. The inventory is harder than it sounds because AI has spread through the stack. As Wealth Advisor Daily has reported, vendors are shipping AI features into their platforms—Advyzon introduced an AI suite, YCharts incorporated Zephyr SMA data into proposals—and RIAs are building their own tools on top of that. A firm that wants to pass an exam first has to know what is in use: which tools, which employees, which client data flows through them.

The documentation follows the inventory. Give each AI process an owner, put the oversight on a compliance calendar, and have a committee keep minutes of what it reviewed and changed. That is the evidence examiners are asking for. Fiduciary duty is the backstop: a firm should be able to explain, in plain terms, how the AI serves the client, not just the firm's margins.

No SEC rule uses the phrase “AI committee.” The exam asks whether oversight exists, and whether the firm can prove it. An inventory and a set of minutes cost little; explaining their absence costs more. Every rule an examiner will use to probe AI already exists; the 2026 priorities just say where to look.