Use of Artificial Intelligence (“AI”) across investment management has moved from experimental to routine, with advisers using AI to assist with portfolio management, marketing, client communications, meeting transcriptions, drafting and recordkeeping. Regulators have not engaged in rulemaking per se on the use of AI; rather, they expect investment advisers to consider the compliance program rule and existing requirements afforded by the Investment Advisers Act pursuant to Regulation S-P, Regulation S-ID, cybersecurity regulations, the IA marketing rule, the books and records rules and overall fiduciary duties owed to investors when governing the firm’s use of AI.
2026 Recap: Existing Rules and Closer Scrutiny
In 2023, the SEC proposed a rule on the regulation of AI predictive data analytics. The proposal was withdrawn in June 2025 and no further proposals have been submitted.
It should be noted, however, that the SEC has kept AI in focus, as can be seen in the 2026 SEC Exam Priorities released November 17, 2025, and 2027 SEC Exam Priorities released October 23, 2026. The priorities noted that use of automated investment tools, algorithmic models and AI representations remain an area of focus for the Department of Exams.
Current Risks: AI Washing, Hallucinations and Client Information
With AI use more embedded in the industry, recurring issues have emerged that point to regular compliance pitfalls that are easier to violate with AI.
In 2024, the SEC made it clear that overstating AI capabilities or use (AI washing) is a violation and remains a reason for enforcement. The first enforcement cases of AI washing resulted in $400,000 in penalties for Delphia and Global Predictions for advertising claims overstating AI use, which falls under the Marketing Rule. Therefore, any AI claims made on websites, pitch decks, or even Form ADV must be substantiated or risk violating the anti-fraud provisions of the Investment Advisers Act of 1940.
In addition to AI washing, one area of concern is lack of human oversight resulting in unchecked AI hallucinations. This is a common term used for AI output that is inaccurate. AI tools can produce inaccurate or fabricated information in response to a prompt. Without adequate human supervision and ongoing review, AI hallucinations can be passed off as accurate information. This is especially harmful to investors if used in investment planning and recommendations.
Even more potentially harmful, and a key area of focus for the SEC and FINRA, is the threat AI poses to safeguarding client data. Regulation S-P governs three important areas: (1) how client data is used and protected inside the firm, (2) vendor management and oversight requirements imposed on registrants for knowing how its service providers handle and safeguard client data, and (3) incident response programs, which include the obligation to notify affected clients of unauthorized access to their data and confidential personally identifiable information (“PII”). (See SEC 17 CRF Parts 270 and 275)
Regulators expect written policies reasonably designed to protect customer information against unauthorized access or use, and those obligations extend to oversight of vendors that handle client data. The question is, are you doing enough?
- Are your vendors aware of a 72-hour breach notification requirement imposed on registrants?
- Do you know what safeguards critical vendors have in place to safeguard your client information?
- Do you know how your vendor supervises their sub-contractors to ensure that such safeguards are being followed?
- Are you aware of how vendors are using AI and have you communicated this to your consumers?
Weak supervision or human oversight, lack of well-defined policies and procedures and documentation of incident response continue to be the focus of SEC examiners. Demonstrable compliance of internal controls in these areas, and knowing how AI is used and by whom, is the expectation of regulators, and failure to do so can lead to violations and reputational damage.
AI Guidelines and Outlook for 2027
For 2027, the SEC continues to signal an openness to innovation while remaining focused on compliant AI practices.
AI and the Investment Process
Earlier this year, the SEC’s Director of the Division of Investment Management, Brian Daly, stated that liability concerns presented the biggest obstacle in AI adoption among advisers. He offered that a balance of regulation and innovation was the goal and invited input from advisers and the industry. (SEC, Artificial Intelligence and the Future of Investment Management)
Going into 2027, firms should embrace innovation and this opening for dialogue, but understand that expectations of AI testing, supervision, and documentation remain a key requirement of the SEC and other regulators.
Considerations Going Into 2027
AI agents designed to complete tasks with limited human intervention are moving from pilot programs into everyday business operations, including compliance functions. Investment advisers should expect that trend to continue into 2027.
One concrete example of where this could lead comes from the SEC’s Division of Investment Management Director, Brian Daly, who, in his February 2026 address, offered the idea of a fund or adviser using an AI agent, trained on its disclosure documents, to answer investors’ questions in plain English. This could replace emailed PDFs and other digital “paperwork.” But in implementing this type of agent, firms must remain vigilant to ensure the customer identities and PII are not exposed.
As we approach 2027, it is clear that AI use and the regulation thereof remains evolving as AI technologies continue to develop as fast as they are adopted. Firms must remain proactive and establish a solid compliance framework for AI governance.
Examiners will continue to require that firms demonstrate the following:
- AI Inventory: Maintain an inventory of every AI tool used, how they are used, by whom, and identify the “human in the middle” supervising each AI tool.
- Diligence: Review data retention and consider the regulatory requirements as set forth by the books and records rule of the Investment Advisers Act of 1940.
- Internal Controls and Governance – Policies, Procedures and Testing: Document your AI governance in your Compliance Manual and regularly test for compliance with the firm’s AI policies; consider how cybersecurity, Regulation S-P and Regulation S-ID apply to your firm’s AI use.
- Human Oversight: Keep humans in the loop and record prompts, outputs and reviewer approvals.
- Audit AI claims: Ensure all AI claims are reviewed, can be substantiated and are consistent across marketing avenues, Form ADV, and client agreements.
- Client Disclosures: If using AI, work with counsel to define what disclosures should appear in client agreements and the firm’s Forms ADV.
- Training and review: Regularly train staff, test controls and update incident response for “super-intelligent” (“SI”) threats, such as deep fake voice or video or SI phishing messages.
Conclusion
AI is now part of how investment firms operate, and regulators have made clear that existing rules apply to it. Firms that treat AI governance as an ongoing discipline, rather than a one-time project, are best positioned for what comes next. Know which tools are in use, keep people accountable for AI output, make only claims that can be substantiated, and be deliberate in your protection of client information. Technologies will continue to evolve, but the fundamentals of fiduciary duty, compliance program obligations, and books and record requirements will not. A practical next step is to review current AI practices against the above checklist and address any identified gaps prior to the new year.
For assistance with understanding AI governance requirements and updating your AI policies and procedures, contact us at 619.298.2880 or email [email protected].
Author: Michelle L. Jacko, Managing Partner, Jacko Law Group, PC (“JLG).
JLG works extensively with investment advisers, broker-dealers, investment companies, private equity and hedge funds, banks, and corporate clients on securities and corporate counsel matters. For more information, please visit https://jackolg.com/.
The information contained in this article may contain information that is confidential and/or protected by the attorney-client privilege and attorney work product doctrine. This email is not intended for transmission to, or receipt by, any unauthorized persons. Inadvertent disclosure of the contents of this article to unintended recipients is not intended to and does not constitute a waiver of attorney-client privilege or attorney work product protections.
The Risk Management Tip is published solely based on the interests and relationship between the clients and friends of the Jacko Law Group P.C. (“JLG”) and should in no way be construed as legal advice. The opinions shared in the publication reflect those of the authors, and not necessarily the views of JLG. For more specific information or recent industry developments or particular situations, you should seek legal opinion or counsel.
You hereby are notified that any review, dissemination or copying of this message and its attachments, if any, is strictly prohibited. These materials may be considered ATTORNEY ADVERTISING in some jurisdictions.
