By: E.J. Yerzak, Managing Director
The AI exams have begun. We knew when the SEC released its Examination Priorities list that the regulator would be focusing on the use of artificial intelligence by financial services firms. Building upon its 2025 spotlight on generative AI applications and use of AI “to inform investment strategies,” the SEC’s 2026 priorities also include a focus on mitigating the risks of AI in cybersecurity attacks. Now that we are halfway through the calendar year, we are seeing signs that the SEC is making good on its promise.
AI is now a core focus of current exams.
Over the last few months, questions surrounding AI have crept into regulatory examinations but have mostly existed on the fringes of discussions. Is your firm using artificial intelligence? What are you using it for? Which staff are using it? Does your Form ADV include sufficient risk disclosure if your firm is using AI to drive investment decisions?
Now the floodgates have opened. SEC examiners are now including an entire section in examination document request letters that hone in on use of artificial intelligence. The requests fall into three key areas – AI disclosures, AI practices, and AI compliance.
AI Disclosures
Beginning under former SEC Chair Gensler, the SEC warned investment advisers about “AI washing” – touting AI capabilities that do not actually exist in an effort to capitalize on the latest buzz. As then-Director of the Division of Enforcement Gurbir Grewal stated in 2024, “if you claim to use AI in your investment processes, you need to ensure that your representations are not false or misleading.”
Fast forward to 2026. The SEC is now seeking information in exams about how investment advisers are marketing and disclosing their use of AI. Recent requests of this type include the following:
- A list of all marketing materials, channels, and media formats used by the adviser
- All mentions of the use of AI by the adviser in marketing and disclosures
AI Practices
Regardless of whether firms are actively and publicly marketing their use of AI, many RIAs are now using AI for various purposes, including investment research, call transcription, note-taking, and other functions. Several recent surveys (including Schwab and Insperex) suggest that between 63% to 70% of RIAs are currently using AI tools in their firms.
The SEC has taken notice, and its examinations now reflect that reality. Current SEC exam requests now include questions relating to the following:
- All AI tools and models in use at the adviser that relate to the management of client portfolios (including both off-the-shelf tools and proprietary tools developed in-house)
- Inputs: A list of data sources and client profile information used by those AI tools
- Outputs: How the adviser manages conflicts and risks associated with AI outputs, including validating errors, AI model performance, and data security
AI Compliance
Finally, the SEC wants to know how firms have adapted their compliance programs to keep pace with this expanded use of AI. SEC inquiries on this front relate to one or more of the following:
- What contingencies are in place if the adviser is over-reliant on a particular AI tool or set of tools, and such tools fail?
- Vendor due diligence and oversight conducted on such tools
- AI risk governance, including which staff are authorized to use the AI tools and for what purposes, and what management or committee structures are implemented for such AI risk governance
- How the adviser monitors AI use, including through policies and procedures, attestations, technical controls, and/or training.
Conclusion
We continue to observe an expanded regulatory focus on AI. SEC questions are no longer surface-level. Inquiries are now diving much deeper during regulatory exams. And while not every question is going to apply to every adviser, firms would be wise to begin preparing now for how they would answer such probing questions into their disclosures, practices, and compliance monitoring as they relate to AI.
For questions, comments, or requests about Salus GRC’s AI Governance and Risk services, contact ai@salusgrc.com.