What will SEC examiners ask financial firms about AI in 2027?
The SEC's examination staff will scrutinise AI monitoring, cyber preparedness, automated advice and trading controls across more than 34,000 registrants. The priorities guide inspections; they are not a new rule or proof that a firm has failed.
The short version
- What happened
- SEC examination staff say they will test how financial firms monitor AI used in fraud detection, back-office operations, anti-money-laundering compliance, investment recommendations and trading.
- Who it affects
- For investors and customers, the intended safeguard is straightforward: an automated recommendation, fraud decision or account-security process should still be explainable, supervised and consistent with the protections that apply when a person performs the work.
- What remains unproven
- The priorities are a staff statement with no legal force; they do not alter the federal securities laws or create new obligations.
Keep in mind
The priorities are a staff statement with no legal force; they do not alter the federal securities laws or create new obligations.
The SEC provides no denominator for AI-focused examinations, failed controls, affected customers or losses, so the scale of the problem and programme cannot be measured from this document.
The report uses the agency's term 'super intelligence' for a broad set of generative and advanced systems. It does not define a technical capability threshold.
Both sources come from the regulator running the programme; there is not yet an independent outcome evaluation.
Source analysis · 2 linked sources. Primary analysed source date: 23 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
AI moves into the SEC's cross-market inspection plan
US investment advisers, funds, broker-dealers and other regulated market businesses now have a clearer view of the AI questions SEC examiners intend to pursue in fiscal 2027. The Division of Examinations' 23 October plan puts emerging technology beside cybersecurity and operational resilience as a risk area spanning market participants. The SEC says its broader programme reaches more than 34,000 registrants.
The practical focus is not whether a firm uses AI, but whether its claims, controls and supervision match that use. Staff say examinations will prioritise policies for monitoring AI in fraud prevention, back-office work, anti-money-laundering and Regulation Best Interest compliance, and trading. For automated advice and investment tools, reviewers will ask whether representations are fair, operations match investor disclosures and recommendations fit the customer's profile or the stated strategy.[1][2]
Deepfakes and automated attacks become compliance questions
The programme also turns AI-enabled crime into an operational-readiness test. The report says examiners will review preparation for automated cyberattacks, including AI-generated phishing and synthetic voice or video used in social engineering. Identity-theft programmes may be checked for responses to AI-related risks, stolen credentials, account takeovers and fraudulent transfers. Firms relying on cloud or other vendors remain responsible for how those dependencies are controlled.[2]
The distinction that matters
Three AI pathways an SEC examination may follow
The staff priorities connect a firm's use of advanced systems to existing technology-neutral duties.
Core operations
Trace AI in fraud controls, AML, back-office work and trading
Check monitoring, supervision and compliance with existing rules
Customer-facing tools
Review automated advice, recommendations and disclosures
Test fair claims, consistent controls and fit with investor profiles
AI-enabled threats
Review phishing, deepfakes, stolen credentials and vendor exposure
Test prevention, detection, response and customer safeguards
A priority is not a new rule—or a finding of harm
The limits matter. This is a staff roadmap for choosing and conducting examinations, not a regulation, enforcement case or claim that every listed technology is unsafe. The report explicitly says it creates no new obligations and that priorities may change with market events. It gives no estimate of how many firms will be examined for AI, how frequently controls fail or what investor losses AI has caused.
Compliance teams can nevertheless use the document as a concrete checklist: map every automated decision or communication to an owner, disclosure, monitoring process and incident response; then preserve evidence that the control works. Future risk alerts, examination observations and enforcement records would show whether the new focus identifies recurring failures or produces measurable protection for customers.[1][2]