The SEC's AI priorities turn on who signs the review

The SEC's 2026 examination priorities put governance, supervision, and oversight of artificial intelligence on the list, and the regulator has moved from flagging AI concerns to setting expectations without introducing a new rule. Instead, it leans on the fiduciary and disclosure obligations firms already carry rather than fresh rulemaking, which decides where the work lands: a firm is bound by the advice it gives and the disclosure it makes, whichever tool produced the draft.

The practical demands follow from that expectation. According to Financial Planning, the SEC expects firms to explain how an AI-assisted decision was reached, supervise AI-generated output, manage the conflicts of interest AI can introduce, and keep records that survive an exam; FINRA's priorities have barely moved by comparison, applying supervision of AI-assisted communications, recordkeeping, and suitability wherever generative AI is deployed. Neither regulator is asking which model a firm bought; both are asking who checked the output and what proves it.

The same account lists five acute compliance risks, three worth walking through slowly because each lands on a workflow most advisory practices already run.

Start with the email: an AI-drafted portfolio commentary reaches a client with a fund's recent performance misstated because the model summarized the wrong data, and the firm faces a fiduciary disclosure violation. Client communications are held to the same accuracy and supervisory standard regardless of how they were drafted, so every AI-generated client communication routes through a human approval step before it goes out, the way advisor-drafted correspondence already routes.

Then the trade: where a tool recommends or executes without testing the recommendation against a client's actual risk tolerance and investment objectives, the firm risks a suitability violation, which the account calls a core fiduciary breach; auto-execution based solely on an AI output is the specific gap examiners look for. AI can surface the recommendation, but a human advisor verifies suitability and makes the final call.

Then the data: client account details, holdings, or personal information entered into a public chatbot leaves the firm's controlled environment, which can collide with Regulation S-P's safeguarding requirements. The remedy is a procurement rule as much as a compliance one—firm-hosted or enterprise-grade tools with contractual data privacy protections, and consumer-facing chat products kept out of client work.

Read the three together and they collapse into a single requirement: a named human, a documented check, and a record that outlives the email. The lift is correspondence review pointed at a new class of draft, making it a matter of process design more than procurement; practices that already ran a review culture own the harder half of this.

Now the part the vendor decks skip. The business case for AI in a practice is time—the commentary draft, the meeting summary, the first pass at a planning memo—but every one of those outputs still needs the reviewer the SEC describes, so the hours come out of drafting and not out of signing. A practice that adopts AI to eliminate the review step has bought a disclosure risk with a faster turnaround; a practice that adopts it to compress drafting and staffs the review layer deliberately gets the time back, and that is the version of the trade an exam rewards.

The dangerous middle case is an approval step that lives in the policy manual but not in the workflow, which converts a drafting tool into an exhibit: when AI sits in the chain, the record shows it, and a signature on a review that did not happen is harder to explain than no signature at all. What the record exposes is a supervision failure, and it is the kind a document request is built to find.

This publication has worked this seam before. When the SEC proposed repealing its 2010 pay-to-play rule, we noted that the blanket contribution bans firms had adopted to avoid the rule would stand until chief compliance officers chose to reopen them—the operative constraint was the one firms wrote for themselves. The AI priorities run that mechanism in reverse, because there is no rule to comply with yet; the controls a firm writes now—the review step, the tool inventory, the privacy clause in the vendor contract—become the baseline a later exam measures against.

FINRA's own file this cycle reads as supervision mechanics rather than model governance: a ten-day pause proposed for suspicious account moves, a Senate push to make transfer locks a rule, an enforcement-data file that surfaced and then vanished. None of that moves the AI question, nor should it be read as the absence of one.

The first thing an exam request asks for is the review log—which output, which reviewer, which date, which client file.