AI Governance Moves to the Center of SEC Exam Priorities

The Bigger Picture

Artificial intelligence is becoming increasingly integrated into everyday investment management activities, including research, coding, portfolio management, and compliance monitoring. As those capabilities expand, the SEC’s Division of Examinations is increasing its attention on how emerging technologies affect regulated firms and their existing compliance obligations.

The 2027 priorities specifically identify emerging technologies, information security, cybersecurity, operational resilience, Regulation S-P, and Regulation S-ID among risk areas affecting multiple types of regulated firms. The SEC has also identified private funds, private credit, and other complex investment strategies as areas of focus.

For compliance teams, this broadens the AI conversation. Governance is not simply about determining which AI tools employees are permitted to use. Firms also need to consider how technology enters the organization through third-party software, how sensitive information is protected, and how evolving cyber threats could affect existing controls.

Key Takeaways

• The SEC’s 2027 examination priorities include emerging technologies and their potential impact on compliance, fraud prevention, market operations, and investor protection.
• AI-generated phishing and synthetic or deepfake voice and video used for social engineering are among the threats highlighted in the examination discussion.
• Cybersecurity, operational resilience, Regulation S-P, and protection of customer information remain important examination areas.
• Firms should consider AI exposure that arises through third-party software, not only independently approved AI vendors.
• Use of personal AI accounts for business can raise recordkeeping and Regulation S-P considerations.
• Private funds, private credit, and complex or illiquid investment products remain areas of examination focus.

Lori Weston’s Perspective

As highlighted by WealthManagement.com, Weston emphasized that firms need to look beyond the AI vendors they have explicitly approved because AI capabilities are increasingly being incorporated into other third-party software. She also pointed to ongoing review of third-party relationships and employee use of personal AI accounts for business as areas compliance teams should consider, particularly from recordkeeping and Regulation S-P perspectives.

This is an important shift for compliance teams. AI oversight increasingly intersects with existing responsibilities across cybersecurity, privacy, books and records, vendor management, and operational resilience rather than operating as an entirely separate compliance discipline.

What This Means for Investment Advisers

The 2027 priorities reinforce the need for firms to view AI governance as part of the broader compliance environment.

As AI functionality becomes embedded in existing technology platforms, simply maintaining a list of approved standalone AI tools may not capture a firm’s full exposure. Compliance teams should understand where AI capabilities are being introduced through third-party systems and how employees are using those capabilities in business activities.

Cybersecurity preparedness is another important consideration. The emergence of AI-enabled phishing and synthetic audio and video creates new variations of familiar social-engineering risks. Firms should evaluate whether existing controls remain appropriate as those threats become more sophisticated.

Regulation S-P is also moving beyond implementation readiness. According to the article, examiners will now be looking at whether firms have developed, implemented, and maintained applicable policies and procedures, including incident response, customer notification, and service-provider oversight.

The overall message is clear: AI adoption does not replace existing compliance responsibilities. Instead, it introduces new contexts in which those responsibilities must be evaluated.

Action Steps for Compliance Leaders

1. Review AI governance alongside existing cybersecurity, privacy, and information-security programs.
2. Assess third-party providers for AI functionality that may have been introduced into existing software.
3. Review employee use of personal AI accounts for business purposes.
4. Revisit Regulation S-P policies, including incident response and service-provider oversight.
5. Evaluate preparedness for AI-enabled phishing, deepfake, and other social-engineering threats.
6. Review compliance controls surrounding complex and illiquid investments that may receive increased examination attention.

These are practical considerations based on the examination priorities and Weston’s comments, rather than new SEC requirements. The SEC expressly notes that its examination priorities do not themselves create new legal obligations.

Frequently Asked Questions

What are the SEC’s 2027 Examination Priorities?

The Division of Examinations publishes annual priorities identifying areas it believes present heightened risks to investors or market integrity. For 2027, those areas include investment adviser compliance, complex and illiquid investments, private funds and private credit, cybersecurity, operational resilience, and emerging technologies.

Is the SEC focusing on artificial intelligence in 2027?

Yes. Emerging technologies are specifically identified among the SEC’s risk areas, including their effects on market operations, compliance, fraud prevention, and investor protection.

Why are deepfakes relevant to compliance?

The examination discussion identifies synthetic or deepfake voice and video, along with AI-generated phishing messages, as potential social-engineering threats firms should consider.

What should firms consider about third-party AI?

Weston noted that AI is increasingly embedded within third-party software, meaning firms’ oversight may need to extend beyond vendors marketed specifically as AI providers.

How does Regulation S-P factor into examinations?

The SEC’s priorities include Regulation S-P within information security and operational resilience. The article reports that examiners are moving from implementation preparedness toward evaluating policies and procedures covering areas such as incident response, customer notification, and service-provider oversight.

Are private funds also an examination priority?

Yes. The SEC identifies private funds, private credit, and other complex investment strategies among its FY 2027 examination focus areas.

Why It Matters

The SEC’s 2027 Examination Priorities demonstrate how quickly AI is becoming intertwined with traditional compliance responsibilities. AI governance now intersects with cybersecurity, vendor management, privacy, recordkeeping, operational resilience, and investor protection.

For investment advisers, the challenge is therefore broader than developing an AI policy. Firms need to understand where AI is being used, how it enters their technology environment, what information it touches, and whether existing controls remain effective as the technology evolves. The firms that approach AI governance as part of their overall risk and compliance framework will be better prepared for an increasingly technology-focused examination environment.