Advisor Perspectives

What Will SEC Examiners Ask About Your AI? Start With the Inventory

The SEC's exam priorities point to two questions: what you say about your AI and how you supervise it. You cannot answer either question about a tool you have never written down, so start with a list.

AdvisorPilot

Ask a firm whether it uses AI and the answer is usually "a little." Ask where, exactly, and the room goes quiet. There is the meeting note-taker one advisor installed, the email assistant another turned on, the research summaries an associate runs before reviews, and the vendor feature that arrived in a software update with a toggle already set to on.

Here is our short answer to the question in the title. The SEC's published exam priorities suggest examiners may ask what you say about your AI and how you supervise it. You cannot answer either question about a tool you have never written down. So before the policy, before the training, and before the next marketing refresh, make a list. Call it an AI inventory, and treat it as the first page of every conversation your firm has about AI.

Is the SEC examining advisers' use of AI?

Yes, and it has said so two years running. The Division of Examinations' Fiscal Year 2026 priorities, released November 17, 2025, said the Division "will review for accuracy registrant representations regarding their AI capabilities or AI" and "will assess whether firms have implemented adequate policies and procedures to monitor and/or supervise their use of AI technologies," including for back-office operations.

The Fiscal Year 2027 priorities, announced October 23, 2026, keep the focus and change the vocabulary. The Division now uses the term "super intelligence (SI)" and notes that registrants are using generative SI tools "to support research, drafting, coding, and client communications, as well as advisory and portfolio management functions, and compliance monitoring and surveillance." It says it will "prioritize examinations of policies and procedures relating to monitoring SI," including back-office operations, and that it wants to understand "whether firms continue to comply with existing, technology-neutral obligations."

That last phrase matters. There is currently no final SEC rule specific to advisers' use of AI. In June 2025 the SEC formally withdrew its proposed rule on conflicts of interest in the use of predictive data analytics, along with other pending proposals, and said it does not intend to issue final rules on them (notice of withdrawal, June 12, 2025). The obligations that apply to your AI are the ones that already apply to everything else: your fiduciary duty, your compliance program, the marketing rule, your books and records, and Regulation S-P.

What happens when what a firm says about AI is not true?

On March 18, 2024, the SEC announced settled charges against two investment advisers, Delphia (USA) Inc. and Global Predictions Inc., for false and misleading statements about their use of AI. Delphia agreed to pay a $225,000 civil penalty and Global Predictions $175,000, $400,000 in total. According to the SEC, Delphia claimed AI and machine learning capabilities it did not have, and Global Predictions called itself the "first regulated AI financial advisor." Both firms were also charged under the marketing rule.

Those cases are about overstating AI. The everyday risk for most firms runs the other way. A website says "we use technology thoughtfully," the ADV says nothing, and meanwhile three tools are drafting client emails. Whether a description is too big or too small, the fix starts in the same place: knowing what you actually use.

What is an AI inventory?

An AI inventory is a plain list of every tool at your firm that uses AI to read, summarize, draft, score, or decide something, kept in one place and owned by one person. It is not a policy. It is the thing a policy is written about.

The test for whether something belongs on the list is simple. If a tool takes in information and produces something a person might rely on, send, or file, it goes on the list. That includes:

• Tools the firm bought on purpose, such as a CRM, planning software, or a drafting assistant
• Features that arrived inside software you already pay for
• Tools individuals signed up for on their own, often called shadow AI
• Anything your service providers run on client data on your behalf

The last two are where most lists come up short. The way to find them is to ask, not to assume. A short survey of every person at the firm, repeated on a schedule, will usually turn up more than a scan of the expense report.

What should the inventory list for each tool?

One row per tool, with the same columns every time. In our reading, these are the questions the two exam priority documents point toward: what you say, what you do, and how you supervise it.

1. Tool and owner. The product name, the version or plan, and the person at the firm responsible for it.
2. Who uses it. Advisors, associates, operations, compliance, or everyone. Note any use that is not approved.
3. What client data it touches. None, names and contact details, account and holdings information, or sensitive customer information. Note whether the vendor is a service provider that receives customer information.
4. What it produces. Meeting notes, email drafts, research summaries, client materials, scores, or alerts.
5. Who reviews the output. The named role that reads the output before anyone relies on it or sends it, and what that review looks like.
6. Where the record lives. Where the output, the final version, and any client communication are retained.
7. What the firm says about it publicly. The website, pitch materials, social posts, and Form ADV language that describe this tool or AI in general.

Column three is where Regulation S-P comes in. Under the 2024 amendments, a firm's incident response program must include written policies and procedures reasonably designed to require oversight of service providers, including making sure they protect against unauthorized access to customer information and notify the firm as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider. The FY2027 priorities say examiners will evaluate response programs "including customer notification procedures and oversight of service providers." An AI tool that touches customer information is a service provider question as much as an AI question, and the inventory is where the two meet.

Columns five and six are where a single system helps. When drafting happens inside the same platform that holds the client record, the inventory row is shorter and the review step is easier to see. Whatever you use, the row should answer the same seven questions.

Do your marketing and ADV language match what you actually use?

Column seven exists for this question. Lay the public statements next to the rest of the row and read them together. For automated investment tools, both the FY2026 and FY2027 priorities say assessments generally will include whether "representations are fair and accurate" and whether operations and controls are consistent with disclosures made to investors. The FY2026 priorities also say the Division "will review for accuracy registrant representations regarding their AI capabilities or AI."

A few patterns to look for:

• Claims bigger than the tool. "AI-driven portfolio construction" when the AI drafts meeting notes.
• Silence where there is real use. No mention of AI anywhere, while AI drafts client communications every day.
• Stale language. A description written for a tool the firm stopped using, or before a vendor added AI features.
• Inconsistency. The website, the pitch deck, and the ADV describing the same thing three different ways.

How to describe a tool, and whether a disclosure is needed, is not something an article can settle for you. Your CCO and counsel decide. The inventory gives them something accurate to decide about.

How often should you update the inventory?

There is no SEC-published frequency, so treat this as a practical default for your CCO to adjust, not a requirement. Most firms can live with three triggers:

• On a schedule. At least as often as the annual compliance review, and more often if the firm adopts tools quickly.
• On a change. Any new tool, any new AI feature in an existing tool, or any new kind of client data a tool touches.
• On a statement. Any time the website, a pitch deck, or the ADV is about to say something new about technology.

An inventory that was right last spring and wrong today is a list of what you used to do. The value is in keeping it current, and in being able to show when it was last checked and by whom.

This article is for general educational purposes for financial professionals and is not legal, compliance, regulatory, investment, or tax advice. It describes examination focus areas as published by the SEC Division of Examinations; see the linked sources for full text. Consult your compliance counsel about your firm's obligations.