Companies that are navigating enforcement and litigation pursued by the U.S. Securities and Exchange Commission (SEC) should be able to show how they address AI-enabled cyber threats, oversee their own use of AI, and substantiate statements about that use. These companies should prepare for the SEC to assess preparation for AI-generated phishing and deepfake impersonation, alongside cybersecurity governance, access controls, incident recovery, and third-party risks.

Those are some of the takeaways after the SEC’s Division of Examinations released its 2027 priorities in late October, identifying cybersecurity and emerging technologies among its focus areas.

Companies can prepare for growing AI-related risks and regulatory scrutiny by taking a closer look at their AI inventory, cybersecurity defenses, disclosures, third-party relationships, incident response procedures, and supporting documentation. The goal is to identify gaps before they become compliance, security, or examination issues.

AI-enabled cyber threats and customer protection

Examiners will review responses to identity-theft risks, including account takeovers and fraudulent transfers.

SEC registrants should test whether verification procedures can withstand convincing impersonations of clients, executives, or service providers. Requests involving money movement, account changes, or sensitive information should be verified through established channels even when a voice or video appears authentic.

Under amended Regulation S-P, covered institutions must maintain written policies and procedures to safeguard customer information, including an incident-response program with customer-notification procedures and service-provider oversight. The rule requires notice of certain incidents involving sensitive customer information, subject to specified exceptions.

Financial institutions and creditors subject to Regulation S-ID that offer or maintain covered accounts must maintain written identity-theft prevention programs and update them periodically to reflect changing risks.

Oversight of firms' own AI use

The SEC will review monitoring policies for AI used in fraud detection, back-office operations, anti-money laundering compliance, Regulation BI compliance, and trading.

Companies should test tools for their intended uses, define when personnel must intervene, and limit permissions according to the functions a tool needs to perform. Where a tool can initiate transactions or change records, firms should consider approval requirements and procedures to suspend its operation. Oversight should also cover AI features added to existing vendor software.

AI representations and disclosures

For automated investment advisory services, trading algorithms, and related tools, reviews generally will consider the accuracy of representations, consistency between operations and disclosures, and alignment of algorithmic advice or recommendations with investors' investment profiles or stated strategies.

Companies should compare AI-related statements with actual capabilities, limitations, data practices, and human oversight. The review should cover relevant filings, offering documents, due diligence questionnaires, websites, pitch materials, client agreements, and privacy notices. Descriptions prepared when a tool was introduced may become inaccurate as its functions or use change.

Actions companies should take now

• Inventory AI use and assign responsibility. Identify internally developed tools, vendor products, and AI features embedded in existing systems. Record each tool’s owner, purpose, users, data access, testing, and approval status. Prioritize uses involving client information, investment decisions, transactions, or compliance obligations.
   
• Test defenses against impersonation. Exercise verification procedures for wire instructions, account changes, and password resets. Include AI-generated phishing and voice or video impersonation in training and testing. Document failures and confirm that corrective measures work.
   
• Check disclosures against practice. Assign business owners to validate AI-related claims and retain supporting evidence. Correct inconsistencies. When adopting a tool or materially changing its use, assess whether applicable disclosure obligations require updates to Form ADV or other materials.
   
• Review vendor dependencies. Assess vendor access to firm and client data, permitted data uses, subcontracting, incident reporting, and service continuity. Determine whether contractual restrictions and technical controls address the firm’s intended use of third-party AI tools.
   
• Exercise response and recovery procedures. Test coordination among security, compliance, legal, operations, and service providers. For firms subject to Regulations S-P or S-ID, include applicable notification, oversight, and identity-theft requirements. Record decisions and assign responsibility for unresolved weaknesses.
   
• Organize examination support. Assemble relevant inventories, policies, testing results, vendor diligence, and marketing substantiation. Confirm that personnel can retrieve required records. Use compliance reviews and targeted testing to track remediation of prior examination findings and known exceptions through closure, and reassess controls after business or technology changes.

For more information, please contact us or your regular Parker Poe contact. Click here to subscribe to our latest alerts and insights.