SEC's AI exam is a governance audit

Two years ago the SEC fined two investment advisors, Delphia (USA) and Global Predictions, $400,000 combined for allegedly exaggerating how they used artificial intelligence. The fine was pocket change. The point was larger: the SEC had drawn its first line against "AI washing" — the gap between what a firm claims about its technology and what the technology actually does.

Now examiners are looking for a different kind of gap. Citywire reports that recent SEC exam requests have asked advisors to explain how they oversee AI internally: whether they have AI committees, and whether those committees keep written minutes. A committee with minutes is the difference between "we care about AI" and "here is who is responsible." It forces meetings to happen, names to be attached, and decisions to be recorded.

The SEC has no rule that requires a standalone AI policy. It doesn't need one. The Advisers Act compliance rule already demands written policies and procedures reasonably designed to prevent violations. Regulation S-P already requires firms to protect client information and supervise the service providers who handle it. The Marketing Rule already bars unsubstantiated or misleading claims. Fiduciary duty already applies to any decision that touches a client's assets or data. AI just carries those old obligations into a new tool. The fiscal 2026 exam priorities make the scope explicit. Staff will assess whether firms have adequate policies for monitoring and supervising AI in trading, the back office, fraud detection, and anti-money-laundering. They will also test whether marketing claims match actual capability.

The absence of an AI-specific rule is not a reprieve. The exam priorities place AI inside the existing framework. The SEC is telling advisors the technology gets no grace period.

That leaves RIAs with two distinct problems. One is the pitch: overstate what the AI does and you invite an AI-washing charge. The other is internal operations: use AI somewhere without supervision and you have a compliance violation that has nothing to do with marketing. The second is the one most firms underprepare for, because it demands an inventory. Which employees use which tools? Which vendors process client data? Who validated the output? Who reviews it? NobleCloak, a governance platform for regulated firms, puts it bluntly: "You can't govern what you can't see."

The request for committee minutes suggests the SEC wants evidence of process, not a policy on paper. A policy can be adopted and ignored. Minutes are a record of people doing the work. For a firm with a strong compliance culture, this is a modest addition. For one that has let AI ride into the operation through chat tools and spreadsheet add-ins, the exam will be the first time anyone takes a full inventory. That inventory, or its absence, will be the finding. Firms that have never asked these questions should worry less about the technology and more about the gaps in their own supervision.

The right response is to build the inventory before the exam arrives, assign clear ownership, and run every public claim through the same substantiation standard the Marketing Rule applies to performance numbers. If a firm says a model improves portfolio construction, it should be able to point to the test that backs it up. If a chatbot drafts client emails, someone should review the drafts before they go out, the same way they review any other correspondence.

None of this is exotic. The lesson is not that AI is uniquely dangerous; it's that AI is uniquely easy to adopt quietly. The SEC appears to understand that. The exam requests are standard questions, put to a technology that arrived before governance did. Advisors who treat AI as an ordinary supervised activity will pass with a shrug. Those who have treated it as a magic corner of the business, where normal rules pause, will get the educational experience. The exam will be educational either way. The only question is whether the lesson arrives as a deficiency letter or a routine conversation.

The technology is new. The questions are old. Who is responsible, what did they decide, and where is the proof? A firm that cannot answer all three should expect the deficiency letter.