Image: Pexels.
If you run compliance at a small RIA or broker-dealer, or sell AI tools to one, there is no new deadline here. The SEC published where its examiners will look in fiscal 2027, and the AI section moved. Last year it promised to check what firms say about their AI. This year it asks how firms defend against AI-made phishing and deepfake calls, and how they monitor the AI they already use.
Event date: October 23, 2026, SEC press release 2026-109. First coverage we read: InvestmentNews at 15:21 UTC the same day, then Decrypt and Wealth Management before 19:00 UTC.
What happened
The Division of Examinations released its Fiscal Year 2027 examination priorities, a 20-page document. Per the press release, the priorities cover "more than 34,000 registrants," from investment advisers and broker-dealers to funding portals and transfer agents. One of its eight headline areas is "Emerging technologies, including super intelligence and other advanced technologies that may affect market operations, compliance, fraud prevention, and investor protection."
Super intelligence (SI) is the federal executive branch's term for AI under Executive Order 14434, and the SEC uses it throughout the document. Wherever you see SI, read AI.
"The markets we oversee continue to evolve rapidly, and the examination program must evolve with them," said Keith Cassidy, the division's director. Chairman Paul S. Atkins called exams "one of the Commission's most important tools for promoting compliance."
Video: U.S. Securities and Exchange Commission, "SEC Announces Fiscal Year 2027 Examination Priorities," October 23, 2026 (2 min 30 s).
What the report says about AI
In its leadership message, the division writes that registrants use "generative SI tools to support research, drafting, coding, and client communications," as well as advisory, portfolio management and compliance monitoring work. It is "intensifying its efforts to understand how the technologies influence outcomes and whether firms continue to comply with existing, technology-neutral obligations."
Screenshot: SEC Division of Examinations, Examination Priorities: Fiscal Year 2027, leadership message, page 2. Captured October 24, 2026.
That last phrase is the one to hold onto. The document creates no AI rule. It tells you which existing rules examiners will test your AI use against. Section VII.A.2, "Emerging Financial Technology," has three parts:
- AI-driven attacks. Exams will look at "registrants' assessment and preparation for potential threats from SI-related cyberattacks," such as "SI-generated phishing messaging and synthetic or deepfake voice and video used for social engineering."
- Your own AI use. Exams will look at "policies and procedures relating to monitoring SI," including fraud detection, back-office operations, "compliance with AML and Reg BI obligations," and trading.
- Automated advice. For robo-advice and similar tools, examiners will ask whether representations are fair and accurate, whether operations match disclosures, and whether algorithms produce advice that fits investors' profiles.
Screenshot: SEC, Examination Priorities: Fiscal Year 2027, section VII.A, page 12. Captured October 24, 2026.
Two other sections pick it up. Under Regulation S-ID, examiners will check whether firms are "updating their Identity Theft Prevention Program to address emerging risks, such as those related to SI and stolen credentials." Under Regulation SCI, the list of emerging trends for SCI entities includes SI, tokenization of securities and quantum computing.
What changed from fiscal 2026
We read the FY2026 edition (published November 17, 2025) next to the new one. Here is what moved in the AI language:
| Topic | FY2026 report | FY2027 report |
|---|---|---|
| Term used | "artificial intelligence (AI)" | "super intelligence (SI)" |
| Checking firms' AI claims | Separate sentence: review "for accuracy registrant representations regarding their AI capabilities" | No separate sentence; "(1) representations are fair and accurate" stays in the automated-advice test |
| Automated-advice test | Four items, including controls to confirm automated advice meets obligations to retail and older investors | Three items; the fourth is gone |
| Monitoring firms' own AI | Fraud, back office, AML, trading | Same list plus Reg BI |
| AI as a threat | Training and controls for new risks from "artificial intelligence (AI) and polymorphic malware attacks" | SI-generated phishing and deepfake voice and video, plus SI in identity theft programs |
Screenshot: SEC, Examination Priorities: Fiscal Year 2026, page 13, the paragraph the FY2027 report no longer has. Captured October 24, 2026.
Our take: don't read the dropped sentence as permission to oversell. Marketing claims about AI still fall under "representations are fair and accurate," and InvestmentNews read the new edition the same way: examiners "will ask whether marketing claims are accurate." The real shift is in emphasis. Last year the question was mostly "is your AI what you say it is?" This year it's "can a cloned voice of your client move money, and would your procedures catch it?" That's a question a five-person RIA can answer in writing this quarter.
Who this applies to
SEC-registered investment advisers, broker-dealers, funds and the other registrant types it covers. The division will also keep prioritizing advisers that have never been examined, "with particular emphasis on recently registered advisers." If you registered in the last couple of years, assume your first exam will ask about this list.
It applies indirectly if you sell to these firms. Examiners will focus on advisers "using third parties to access clients' accounts, where existing controls may be insufficient to protect client assets and data." An AI notetaker, CRM assistant or account aggregation tool is a third party in that sentence. Expect more due diligence questionnaires from RIA clients.
What to do now
- Write down your deepfake call procedure. The report names synthetic voice and video by name. A rule that no transfer or address change goes through on a voice or video request alone, with a callback to a number already on file, is the plain answer. Our Fideuram deepfake CEO fraud checklist has a version you can adapt.
- Update your Identity Theft Prevention Program. Add AI-generated phishing, cloned voices and stolen credentials to the red flags. The S-ID line names "SI and stolen credentials" as the emerging risks to cover.
- List the AI tools staff use, including personal accounts. Lori Weston, head of compliance at STP Investment Services, told Wealth Management that employees using personal AI accounts for business raise recordkeeping and Regulation S-P concerns.
- Check your Reg S-P incident response program is live, not drafted. The SEC gave smaller entities 24 months from Federal Register publication on June 3, 2024 to comply, which ran out on June 3, 2026. Per Wealth Management, Robert Baker of ACA Group said examiners will now check whether firms have developed, implemented and maintained the procedures, where before they assessed preparation.
- Re-read your AI marketing lines. Every "AI-powered" claim on your site or in your ADV brochure should match what the tool does.
What people said
Not everyone reads the new term as neutral. On Hacker News, dfxm12 wrote that it gives "the administration an out when they get hard questions about AI." For an exam, the term doesn't matter: the report's own phrase is "technology-neutral obligations," and the tests are the ones you already know.
What we could not confirm
The priorities don't give a number for exams that will cover AI topics, and they are not an exhaustive list: examiners will cover areas beyond them. Reuters also covered the release; we saw only its headline, not the story. Whether the SEC, an independent agency, adopted "super intelligence" because of Executive Order 14434 is Wealth Management's reading; the document gives no reason for the new term. For the questions examiners asked about AI before this edition, see our SEC AI governance guide for investment advisers.
