The SEC Takes Operational AI Risk into the Examination Room

Fact: on 23 October, the US Securities and Exchange Commission published its fiscal year 2027 examination priorities. Across more than 34,000 registrants, examinations may cover AI used for investment analysis, customer management, code development and compliance monitoring, as well as AI-generated phishing, deepfake audio and video, and risks arising from third-party technology.

The 2026 priorities concentrated on whether firms described their AI capabilities accurately and supervised its use. The new document places greater emphasis on outcomes, controls and cyber defences once AI enters everyday operations. Reuters presents AI alongside private assets and tokenised securities as a regulatory focus. My judgement is that AI governance is moving from principles and claims into an auditable phase: firms will need evidence of responsibility, permissions, testing and incident response. This remains an examination priority, however, not a new law or an enforcement finding.

Sources:
https://www.sec.gov/newsroom/press-releases/2026-109-sec-announces-fiscal-year-2027-examination-priorities
https://www.sec.gov/files/2026-exam-priorities.pdf
https://www.reuters.com/legal/government/wall-street-regulator-focus-ai-private-assets-corporate-exams-2026-10-23/