Summary: The SEC Division of Examinations has said it will assess whether advisers have adequate policies and procedures to monitor and supervise their use of AI. There is no new AI rule behind this. Examiners are applying existing obligations, which means they will ask for evidence that the policy runs: an inventory, approval records, vendor diligence, and proof that what you tell clients about AI is accurate.
What the SEC has said
The Division's Fiscal Year 2026 Examination Priorities address AI directly. Examiners will review the accuracy of firms' representations about their AI capabilities, and will assess whether firms have adequate policies and procedures to monitor or supervise AI use, including in fraud detection, back-office operations, AML and trading.
Jon Cook, writing in Advisor Perspectives in August, describes three advisers with more than $1 billion in assets each that were asked for AI governance documentation during recent exams. None could produce enough. He also cites an InvestmentNews survey finding only 15% of RIAs had an established AI policy.
Two points matter for planning. First, the SEC doesn't need an AI-specific rule to ask these questions. Supervision, recordkeeping, Reg S-P and the marketing rule already apply. Second, a policy is where the request starts, not where it ends.
What examiners are likely to ask for
1. The policy, and proof it was distributed. The written AI policy, its effective date, and a record showing employees received and acknowledged it.
2. An inventory of AI in use. Which tools, used by whom, for what. Examiners will compare this to what they see elsewhere: vendor lists, expense data, the tools named in your marketing. An inventory built from a survey tends to fall apart under that comparison. One built from systems data holds up better.
3. Approval records. For each approved tool: who requested it, the stated purpose, the data it may touch, who reviewed it, any conditions, and the date. Examiners look for a process applied consistently, not a set of emails.
4. Vendor diligence files. Amended Reg S-P now requires advisers to oversee service providers that handle customer information, including notice from the provider if that information is breached. For AI vendors, the file should cover training on your data, retention, sub-processors and the underlying model provider.
5. Exceptions and how they were handled. If you found an unapproved tool, what happened next? A record of detection, review and decision shows supervision working. The absence of any exceptions over a year usually means nobody was looking.
6. Your public claims about AI. Marketing materials, DDQ answers, pitch decks and Form ADV language that describe your use of AI. The SEC has already brought "AI washing" cases against advisers whose claims overstated their capabilities. Whatever you say publicly should match the inventory.
Build the evidence pack before the letter arrives
Exam document requests come with short deadlines. Firms that do well keep the materials current rather than assembling them under time pressure.
| Evidence | Where it usually lives today | What good looks like |
|---|---|---|
| AI policy and acknowledgments | Compliance shared drive | Versioned, with distribution records |
| AI inventory | A spreadsheet, updated annually | Generated from systems data, refreshed continuously |
| Approval records | Email threads | One record per tool, with purpose, data and reviewer |
| Vendor diligence | Annual questionnaires | Current terms, monitored for changes between reviews |
| Exceptions log | Usually doesn't exist | Every discovery, with the decision recorded |
| Public AI statements | Marketing and IR files | Checked against the inventory before each use |
If any row in the middle column describes your firm, start there.
Where Clarier fits
Clarier keeps this evidence current as a byproduct of running the program. Discovery feeds the inventory, intake creates approval records, vendor monitoring keeps diligence files up to date, and every decision lands in an audit trail. When a document request arrives, the evidence pack is an export rather than a project. See how this works for diligence and exams.
To see which parts of this list your firm could produce today, take the AI program maturity assessment.
This post is general information, not legal advice. Talk to your compliance counsel about your firm's specific obligations.
