Inside the 2025–26 exam cycle: what regulators are asking about AI
The SEC made AI and emerging technology a named examination priority for 2025, and the Division of Examinations is publishing risk alerts that read like a roadmap. Here's what the exam-priority data signals — and how to read it as a firm.
The data: The SEC Division of Examinations named artificial intelligence and emerging technology an examination priority for 2025 — and it remained a focus into 2026, sitting alongside the Marketing Rule, Reg BI, and cybersecurity. (SEC 2025 Exam Priorities) The published priorities and risk alerts are, in effect, a roadmap. This piece reads them as one.
The useful frame for "how to prepare" isn't a checklist — it's the exam-priority data itself, because it tells you exactly where the Division is allocating attention.
What the priorities actually say
The Division of Examinations releases its priorities annually, and the through-line for the current cycle is clear:
| Priority area | What it signals for AI users |
|---|---|
| AI & emerging technology / digital engagement practices | Are representations fair? Do controls match disclosures? Is AI-influenced advice consistent with client profiles? |
| Marketing Rule (206(4)-1) | Risk alert issued Dec 16, 2025 on testimonials, endorsements, third-party ratings |
| Reg BI & Form CRS | Repeat top priority; active enforcement |
| Cybersecurity & data | Heightened scrutiny of data handling, including data fed to AI |
For firms using digital engagement practices, the Division has said it will review "whether representations are fair and accurate, operations and controls are consistent with disclosures, the advice produced is consistent with investors' investment profiles, and firms have employed appropriate controls." That sentence is the exam, paraphrased.
The Division publishes where it's looking before it looks. For AI in 2025–26, it told everyone in advance.
The three questions to be ready for
Translate the priorities into what a firm is actually asked. Based on the published priorities and the AI governance emphasis in regulatory oversight reporting, expect three:
- Inventory and awareness — Does the firm know what AI tools its registered persons use?
- Written procedures — Do the WSPs specifically address AI use in the advisory and communications functions?
- Verification controls — Is there a process ensuring AI-generated output is verified before client use?
A firm that can answer all three with documented evidence is in a strong position. A firm that adopted AI bottom-up — the majority, per the adoption data — usually cannot, because the procedures and logs were never created.
Why this is a documentation problem, not a technology problem
Examiners aren't evaluating whether your AI is good. They're evaluating whether you can show what it is, how it's supervised, and that its output is checked. Those are records. If the records don't exist, the quality of the tool is irrelevant to the finding.
What "ready" looks like
Readiness is a small set of artifacts that should already exist as a byproduct of operating, not something assembled the week the exam letter arrives:
- A maintained inventory of AI tools, owners, and use cases
- WSP language addressing AI in research, communications, and recommendations
- A verification record showing AI output is checked against sources before client use
- Retained query logs (what was asked, retrieved, answered, when)
- Evidence of training on approved uses and prohibited uses
Where AdvisorIQ fits the data
AdvisorIQ produces several of these artifacts automatically. Every research query and brief is generated against cited sources and logged with what was asked, what was retrieved, and what was produced — so the inventory and recordkeeping evidence exists without a separate effort, and the verification step has citations to check against. When the exam priority is "show us your AI controls," the firm's answer is a producible record rather than a scramble.
Related
- The AI governance gap: adoption is racing ahead of supervision
- The Marketing Rule meets AI content: what the risk alerts reveal
- Glossary: audit trail, Reg BI
Sources
- SEC — Division of Examinations 2025 Examination Priorities
- FINRA — Artificial Intelligence key topics hub
This article is general market commentary, not legal or compliance advice. Consult your compliance counsel on examination preparedness.
- Is AI an SEC examination priority?
- Yes. The SEC Division of Examinations named the use of artificial intelligence and other emerging technologies — including digital engagement practices — as a focus area in its 2025 examination priorities, alongside cybersecurity, the Marketing Rule, and Reg BI. AI has remained a stated focus into the 2026 cycle.
- What are examiners actually checking on AI?
- For firms using AI or digital engagement practices, examiners review whether representations about the technology are fair and accurate, whether controls match disclosures, whether AI-influenced advice is consistent with client profiles, and whether the firm has appropriate oversight. In practice that means inventory of tools, supervisory procedures, and verification of AI output before client use.
Keep reading
All blog →The Marketing Rule meets AI content: what the latest risk alert reveals
The SEC's December 2025 Marketing Rule risk alert documents widespread non-compliance on testimonials, endorsements, and third-party ratings. As advisors start generating client-facing content with AI, that enforcement pattern is the map for what gets scrutinized.
Reg BI in the exam data: why AI raises the documentation bar
Reg BI and Form CRS are repeat top examination priorities, and enforcement is active. As AI starts informing recommendations, the documentation burden the rule already imposes only gets heavier. Here's what the exam data implies.
The AI governance gap: adoption is racing ahead of supervision
63% of RIAs now use AI, but only about one in ten have integrated it at the firm level. That gap between bottom-up adoption and top-down supervision is the defining governance story of 2026 — and the one regulators are built to find.