How to Show an SEC Examiner How You Supervise AI Use

What will an SEC exam ask about your firm's AI use?

Expect two lines of questioning: whether what you tell clients about AI is accurate, and whether you have policies and procedures to supervise how staff and systems use it. Both appear in the Division of Examinations' Fiscal Year 2026 Examination Priorities.

Under emerging financial technology, the Division says it will review registrant representations about AI capabilities for accuracy and assess whether firms have implemented adequate policies and procedures to monitor and supervise their use of AI, including for fraud prevention, back-office operations and anti-money laundering. The cybersecurity section adds a focus on the training and security controls firms use to identify and mitigate new risks associated with AI. The priorities are a staff statement of focus areas, not a rule, and the Division typically publishes a new edition each fall, so check the latest one before your next exam. Our read of the 2026 priorities for RIAs covers the other focus areas.

For a CCO, the practical meaning is simple. An examiner who asks "how do you supervise AI?" wants documents, dated and specific to your firm, that show a process exists and runs.

Is there an SEC rule written specifically for adviser AI use?

No. The SEC proposed a rule on conflicts of interest from predictive data analytics in 2023, then withdrew it effective June 17, 2025 along with 13 other pending proposals. Examiners apply the rules you already follow:

• Rule 206(4)-7 requires written policies and procedures reasonably designed to prevent violations, a designated chief compliance officer, and a review at least annually. An AI tool used in advice, trading, operations or client communications falls inside that program.
• The Marketing Rule, Rule 206(4)-1, bars untrue statements of material fact in advertisements and material statements of fact the adviser cannot reasonably expect to substantiate on demand. That is where AI claims get tested.
• Rule 204-2 requires you to keep written communications relating to advice, including ones drafted with AI, and records documenting your annual compliance review. See which records Rule 204-2 requires and for how long.
• Regulation S-P, 17 CFR 248.30, requires written safeguards for customer information and oversight of service providers, including a requirement that they notify you of a breach within 72 hours. An AI vendor that receives client data is a service provider. Check that your vendor contracts include the 72-hour notice.

What happens when a firm's AI claims do not match reality?

The SEC treats it as a misrepresentation case. On March 18, 2024, the Commission settled charges against two advisers, Delphia (USA) Inc. and Global Predictions Inc., for false and misleading statements about their use of AI, with civil penalties totaling $400,000.

Delphia said in SEC filings, a press release and on its website that it used AI and machine learning incorporating client data in its investment process, and the SEC found it did not have those capabilities. Global Predictions described itself on its website and social media as the first regulated AI financial adviser and promised expert AI-driven forecasts. Both firms were cited under the Marketing Rule.

The lesson for an exam is that your Form ADV, website, pitch decks and RFP answers are evidence. Every sentence about AI in them should map to a tool in your inventory and a documented use.

What evidence shows an examiner that you supervise AI use?

A short, consistent file that answers who uses what, with which data, under which rules, and who checks. It sits inside your broader SEC exam evidence binder. Keep these items current and dated:

• An AI inventory: every approved tool, including AI features inside your CRM, portfolio system and meeting software, with the business owner, approved uses and the categories of client data each tool may receive.
• An AI section in your compliance manual under Rule 206(4)-7 that names approved tools, prohibited uses (such as personal AI accounts and pasting client nonpublic personal information into unapproved tools) and who approves new tools.
• Technical controls that enforce the policy: firm-managed accounts only, blocks on personal AI sign-ins, and data loss prevention rules that stop client data from reaching unapproved sites.
• Monitoring records: captured prompts and outputs or DLP alerts, a review schedule, and a log showing the reviewer, date, what was found and what was done.
• Vendor files for each AI provider: contract terms on data retention and model training, security review, and the Reg S-P service provider oversight steps.
• Training records showing staff were told the rules and when.
• Your annual review documentation under Rule 204-2(a)(17), with AI covered as a named topic.

The SEC's September 2026 risk alert on annual compliance reviews lists policies that do not match practice and weak oversight of delegated functions among staff observations. AI is a fast way to create both gaps, because tools change faster than manuals.

What should a dual-registered firm add for FINRA?

The broker-dealer side carries a separate supervision duty. FINRA Regulatory Notice 24-09 reminds members that its rules are technology neutral, so Rule 3110 supervision and Rule 2210 communications standards apply when representatives use generative AI. Our guide to supervising GenAI under FINRA Rule 3110 covers what to log.

FINRA's 2026 Annual Regulatory Oversight Report lists effective practices that line up with the evidence above: formal review and approval of AI use cases, written policies, testing, storing prompt and output logs, tracking model versions and keeping a human in the loop. A dual-registered firm can keep one AI inventory and one log set and point both regulators to it, as long as each rule's specific requirements are met.

What should you do this quarter?

Run a mock document request against yourself before an examiner does:

1. Build or refresh the AI inventory, and include AI features vendors switched on inside software you already license.
2. Pull every public statement about AI (Form ADV Part 2A, website, marketing, due diligence questionnaires) and confirm each one matches a documented use.
3. Write or update the AI section of the compliance manual and have the CCO approve it.
4. Turn on logging for approved AI tools and DLP alerts for unapproved ones, set a review cadence, and start the review log this month.
5. Open a vendor file for each AI provider that touches client data, with Reg S-P service provider terms.
6. Add AI as a named topic in this year's annual review and keep the record under Rule 204-2.

How does s90 help?

s90 sets up and runs the controls behind this file for advisers and broker-dealers: AI guardrails that limit staff to approved tools, prompt monitoring with review logs, and DLP that keeps client data out of unapproved sites. Our agreements commit to producing requested evidence within 24 hours and to notifying you of a breach within 72 hours, which helps when an examiner's request list arrives. If you want to see what an AI supervision evidence file looks like for a firm your size, talk with our team.