
Only 48% of advisor firms require human review of AI output. With SEC examiners focused on AI, compliance experts outline steps to avoid violations under existing rules.
The SEC has not written a rule that specifically governs advisor use of artificial intelligence. Examiners are still asking firms to show that their AI use complies with existing investor protections and data privacy laws.
Carlo di Florio, president of the compliance consultant ACA Group, said his firm's recent survey of 411 investment advisor firms found that only 48% of respondents had a policy requiring a human to check AI-generated results at certain times. "That means over 50% don't have that formal policy in place, and we know that AI hallucinates and there's biases and there's errors," he said.
The SEC under former Chairman Gary Gensler had considered a rule that would have made firms responsible for finding and mitigating conflicts of interest in their AI use. The proposal was dropped last summer after strong pushback from wealth managers and trade groups. Di Florio said the advisors he speaks to do not want a comprehensive AI governance rule. They would like guidance on how existing rules apply.
One of the most prominent existing rules is Regulation S-P, which requires advisors to protect private client data. Recent revisions give advisors 30 days to tell clients after a security breach. Many firms have adopted internal policies that keep client data from being entered into a public version of a large language model. They have not required the same of outside service providers. ACA's survey found less than a third of respondents had policies governing third-party AI use. "Vendors are a major potential source of AI risk," di Florio said. "They might be using your information to educate their models."
Another regulation is the SEC's books-and-records rule, which requires advisors to keep accurate records of their finances, operations and dealings with clients. Di Florio said it is an open question what firms should do with client-meeting summaries generated by AI notetakers. "Are these transcripts books and records?" he said. "There's a very specific pain point where they would like to have some clarity."
The SEC's list of examination priorities for 2026 lists AI as a top focus. The consultant firm Comply wrote in its 2026 AI Regulatory Rundown that examiners will ask firms to show their AI use falls in line with existing obligations like the fiduciary duty. "Compliance teams need to have defensible proof around how and where AI is leveraged and how it's making decisions," Comply wrote.
Adam Spiegelman, founder of Spiegelman Wealth Management in California, said he has been cautious in his AI use. He pays for the Enterprise version of Anthropic's Claude to keep client data private. He also checks any AI-generated content against the original transcript. "The client got back to me and said, 'Wow, you really understand the concept,'" he said, describing a relationship-building use of the technology.
Di Florio said the SEC does not expect firms to check every AI output. Regulators want to see that firms have tested enough to have a reasonable expectation of avoiding misleading answers or hallucinations. "They want to see firms adopt it, so they're not going to come down with a heavy hand on AI adoption," he said. "They are looking at it in exams, and they are going to find those cases where they're going to say, 'Hey, this is stepping over the line.'"
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.