SEC AI Rules: A Compliance Guide for 2026

Your firm's AI tools are probably already subject to SEC examination scrutiny, even if you haven't built a formal compliance program around them. Disclosure accuracy, recordkeeping, supervision, and vendor oversight all reach AI use under rules that have been on the books for years. This guide walks through exactly where those obligations land and what a defensible compliance program looks like in practice.

TLDR:

• The SEC has no dedicated AI rule; compliance runs through existing rules like Rule 204-2, Rule 17a-4, Reg S-P, and Reg BI.
• The SEC settled its first AI-washing cases in March 2024, with $400,000 in combined penalties for false AI marketing claims.
• Your FY2026 exam prep needs written policies, accurate investor disclosures, and WSPs that reflect how AI actually runs.
• Build an AI use-case inventory before your next exam: each entry needs a named oversight owner or model drift goes undetected.
• Greenboard covers archiving, supervision, and marketing review on one 17a-4 compliant system built around these same obligations.

Why there's no single SEC AI rule

The SEC has no dedicated AI statute. There's no single regulation titled "the AI rule" that firms can check off and move on from. Instead, AI compliance runs through a web of existing obligations covering disclosure, marketing, supervision, and recordkeeping.

That became clearer in June 2025, when the SEC formally withdrew its predictive data analytics proposal (S7-12-23), which would have imposed specific conflict-of-interest requirements on broker-dealers and investment advisers using AI to interact with investors. The withdrawal didn't signal less scrutiny. It signaled a different approach: apply existing rules, not new ones.

For compliance teams, that distinction matters. You don't get a checklist. You get a framework built on rules that predate AI by decades, and you have to figure out where your AI use cases fit inside the securities compliance architecture.

How existing SEC rules already govern AI

Several existing rules already reach AI tools directly, without any new rulemaking required.

Rule 204-2 under the Investment Advisers Act requires advisers to retain records of their recommendations and the reasoning behind them. When an AI model generates or influences a client recommendation, that output is a record subject to retention, searchable and retrievable on demand.

Rule 17a-4 applies the same logic to broker-dealers, requiring electronic records stored in a WORM-compliant format and produced promptly to examiners. AI-generated trade alerts, flags, or client communications fall within scope.

Regulation S-P governs how firms protect client data. Any AI tool ingesting client portfolio data, account details, or personal information must be covered by your firm's data protection policies and vendor oversight program.

The fiduciary standard and Regulation Best Interest add another layer. If AI is shaping investment recommendations, firms remain fully responsible for making sure those outputs serve the client's interests. The model doesn't carry the fiduciary duty. You do.

The 2023 predictive data analytics proposal and its 2025 withdrawal

In July 2023, the SEC proposed rules that would have required broker-dealers and investment advisers to identify and neutralize conflicts of interest when using AI and predictive data analytics to interact with investors. The concern was straightforward: if a firm's AI surfaces recommendations that benefit the firm over the client, existing rules may not catch it fast enough.

The proposal never became final. In June 2025, the SEC withdrew it along with 13 other outstanding proposals from the Biden era, signaling a clear priority shift under Chair Paul Atkins toward applying existing authority over writing new rules.

No purpose-built AI conflict rule exists today. But the underlying concern did not disappear. Examiners still look at how your AI use cases in securities compliance interact with clients and whether the outputs serve investor interests. The fiduciary standard and Regulation Best Interest carry that weight now.

What the SEC's 2026 examination priorities say about AI

The SEC Division of Examinations made its expectations concrete in its FY2026 examination priorities. Under Section VII.B (New Financial Technology), the document states that examiners will "review for accuracy registrant representations regarding their AI capabilities" and assess whether firms have "implemented adequate policies and procedures to monitor and/or supervise their use of AI technologies." It also specifies that reviews will include whether "representations are fair and accurate" and whether "operations and controls in place are consistent with disclosures made to investors."

If your firm uses AI in any client-facing or investment process capacity, examiners expect documentation that matches reality. Vague references to "proprietary tech" won't hold up if the underlying tool is making or influencing recommendations.

AI washing: enforcement actions firms need to study

In March 2024, the SEC brought its first enforcement actions targeting AI-washing, settling charges against Delphia and Global Predictions. Both firms had marketed AI capabilities they weren't actually using.

The practical lesson is that any AI-related claim in your marketing materials, Form ADV, or client-facing content is a disclosure subject to the same accuracy standards as any other material statement. Regulators will compare what you say to what you actually do.

Three things to audit before making any AI claim:

• Does the AI tool you're describing actually exist and function as described?
• Is your Form ADV language specific enough to be accurate, without overpromising?
• Do your marketing materials reflect the current state of your AI use, not an aspirational one?

"AI-powered" has become a default marketing phrase across financial services, a trend covered in detail in this detailed look at LLMs in financial compliance. That's exactly why examiners are paying attention.

How the marketing rule and anti-fraud provisions apply to AI claims

The SEC Marketing Rule (Rule 206(4)-1) prohibits materially misleading statements in an investment adviser's communications with clients and prospective clients. That standard applies whether you're describing a portfolio strategy, a fee structure, or your firm's AI capabilities. The Delphia and Global Predictions cases made this explicit: describing AI that doesn't function as advertised is a Marketing Rule violation.

The anti-fraud provisions run parallel. Section 206 of the Advisers Act and Rule 10b-5 under the Exchange Act both reach materially false statements made in connection with advisory services or securities transactions. A firm claiming its AI model generates superior risk-adjusted returns, without disclosing limited live performance history or material limitations, could trigger anti-fraud liability even if the underlying tool is real.

Accurate disclosure means specificity, which is where marketing compliance software can help. "We use AI to support portfolio analysis" is defensible. "Our AI generates alpha by processing alternative data in real time" requires you to substantiate each part of that claim on demand. Examiners reviewing your Form ADV Part 2 brochure will read AI descriptions with exactly that lens.

If your AI influences how you present backtested results or model-generated projections, the Marketing Rule's conditions on hypothetical performance apply fully, including required disclosures and policies governing who receives that content.

FINRA's parallel guidance on AI for broker-dealers

FINRA published its 2026 Annual Regulatory Oversight Report in December 2025 with a dedicated generative AI section, the first time that topic received standalone treatment in the report. The focus includes agent-based risks and how firms should supervise AI tools under existing rules.

For broker-dealers, three rules do most of the work:

• Rule 3110 requires written supervisory procedures covering how AI tools are reviewed, who owns oversight, and how outputs get escalated.
• Rule 2210 applies to any AI-generated client communication, meaning review, approval, and recordkeeping requirements follow the content wherever it goes.
• Books and records obligations require retaining AI outputs that touch client interactions or trading decisions, in the same formats and timeframes as any other required record.

FINRA's framing mirrors the SEC's: no new AI-specific rules, but existing obligations apply in full, reinforcing the need for a new operating model for securities compliance. Broker-dealers running AI tools for suitability analysis, trade alerts, or client outreach should map each use case to the rule it touches, then confirm their written supervisory procedures actually reflect that.

Books and records obligations for AI-generated content

Any AI output tied to advisory services, a securities transaction, or client interaction is a firm record. The format the AI used to produce it doesn't change that.

The harder question is what "retaining" that record means when content was generated by a model. Neither the SEC nor FINRA has issued a definitive answer on how AI-generated outputs map to existing record categories, which puts the burden on firms to make defensible decisions and document their reasoning.

Rule 17a-4's WORM requirements haven't changed. AI outputs that qualify as electronic records must be stored in a non-rewritable, non-erasable format, indexed, and producible to examiners on demand. That covers AI-generated emails, flagged alerts, summarized call notes, and model-produced research shared with clients, the kind of content a communications archive is built to retain.

Examiners auditing AI-assisted workflows ask two things: does the firm know which AI outputs are records, and can it produce them? Firms that can't answer both clearly tend to receive extended requests and follow-up scrutiny. Mapping AI use cases to specific record categories before an exam is the kind of preparation that makes a material difference.

Supervision and written supervisory procedures for AI tools

Updating your written supervisory procedures for AI tools requires more than adding a paragraph about "new tech." Regulators want to see that your WSPs reflect how AI actually operates inside your firm.

Under Rule 206(4)-7, investment advisers must maintain written policies reasonably designed to prevent violations. If AI influences any advisory function, your compliance program must cover it directly: which tools are in use, what decisions they inform, who reviews their outputs, and how errors get escalated and corrected.

Broker-dealers face the same pressure through FINRA Rule 3110. WSPs must identify a responsible principal for each supervised activity. If your firm uses a model to flag suitability concerns or generate client outreach, someone owns oversight of that system, and your WSPs need to name them.

Practically, updating WSPs for AI means working through four things:

• Identifying every AI use case currently in production
• Assigning a designated supervisor for each one
• Building a review cadence that accounts for model updates and output drift
• Documenting how and when model changes get reviewed before going live

That last point is where firms tend to be weakest. A model update can change output behavior without anyone in compliance knowing it happened. WSPs should require that any material change to an AI tool triggers a review before deployment, not after.

Building an AI use-case inventory

Before you can update a WSP, review a disclosure, or answer an examiner's question about AI oversight, you need to know what's actually running. That's the inventory's job.

A well-built AI use-case inventory is a structured record of every AI tool your firm uses, mapped to the regulatory obligations it touches. For example, a single entry might read: Tool: chatbot for client FAQs; Owner: Head of Compliance; Rule: Reg BI; Data inputs: account details; Vendor: third-party SaaS; Last reviewed: Q1 2025. It's a living document that feeds your supervision program, your vendor oversight process, and your Form ADV review cycle.

Each entry should capture:

• The tool's function and what decision or output it produces
• Data inputs, including client data, market data, and internal records
• Regulatory touchpoints based on that function
• Vendor information covering third-party or in-house build, contract terms, and access controls
• Oversight owner, meaning the named individual responsible for supervising that tool

That last field matters most. Without a designated owner, model updates slip through without compliance review, output drift goes undetected, and your WSPs reference a supervision structure that no longer matches what's actually happening.

The inventory also makes exam preparation concrete. When an examiner asks which AI tools your firm uses and how they're supervised, you hand them a document instead of assembling an answer in real time.

Marketing and disclosure controls for firms using AI

Form ADV Part 2 and your marketing materials need to describe the same firm that actually exists. If your AI capabilities have changed since your last brochure update, that gap is a disclosure problem, not a backlog item.

Three controls worth building now:

• A pre-publication review step for any content that describes AI capabilities, with sign-off from compliance before it goes live
• A change log tied to your AI tools so that when a model is updated or replaced, your disclosure review cycle gets triggered automatically
• A defined update cadence for Form ADV Part 2 brochures that includes AI capability language as a standing review item, not a field that gets revisited only after an exam

The Delphia and Global Predictions settlements targeted firms making unsupported AI claims. The fix isn't complicated. Marketing materials need to reflect what's true, and someone needs to own the process of keeping them current.

Vendor oversight and third-party AI risk

Buying a third-party AI tool doesn't transfer the regulatory obligation that comes with using it, which is why third party compliance programs matter. Your vendor built the model. You own the compliance risk.

The SEC expects firms to understand what data flows into any third-party AI system touching client interactions, investment decisions, or firm records. "We use a vendor for that" is not a sufficient answer during an examination. Examiners want to see that your firm conducted due diligence before deploying the tool, has contractual access to audit logs and model documentation, and monitors the vendor on an ongoing basis.

Due diligence for AI vendors should cover:

• What data the tool ingests and where it's stored
• Whether the vendor's security posture meets your Reg S-P obligations, a question tied closely to why cybersecurity has become a core compliance risk
• How the model is updated and whether you're notified of material changes
• What audit logs are available and whether they're producible in an exam

Contracts matter here. Firms that can't produce documentation of a vendor's AI model behavior, or whose vendor agreements don't include audit rights and data handling terms, are exposed if an examiner asks how the tool works. Build those terms in before deployment, not after.

Ongoing monitoring means checking that vendor performance hasn't drifted from what you approved. A model that flags suitability concerns accurately at deployment may behave differently six months later after retraining. Your vendor oversight program should have a cadence for reviewing that.

How Greenboard supports SEC AI compliance

Greenboard was built around the same compliance obligations this article has been describing. The architecture is designed around SEC AI compliance requirements, not retrofitted to them.

Communications archiving runs on WORM-based, 17a-4 compliant infrastructure with SOC 2 Type 2 certification, covering the books and records obligations that apply to AI-generated outputs across email, Slack, Teams, iMessage, and other channels. AI supervision replaces random sampling, catching more issues with fewer false positives across every captured channel.

Marketing review is where firms often feel the most immediate pressure, often becoming the clearest example of why compliance becomes a bottleneck in financial firms. Our AI pre-checks content against the SEC Marketing Rule and FINRA Rule 2210 before anything goes out, with reword suggestions for flagged passages. Customers using that workflow consistently move through individual reviews in seconds.

Over 600 financial firms run their firm compliance programs on Greenboard, with over 99% customer retention. Having archiving, supervision, employee compliance, and marketing review on one defensible system is easier to explain to an examiner than a stack of disconnected point solutions, each with its own audit trail and its own gaps.

Final thoughts on building a defensible AI compliance program

There's no single AI rule to check off, but there's plenty of existing regulation that already applies to what your firm is doing. The firms that stay ahead of this keep a current inventory, own their vendor relationships, and write disclosures that match their tools.

FAQ

What does SEC AI regulation actually require from investment advisers and broker-dealers right now?

There's no single AI statute to comply with. The SEC applies existing rules to AI use cases: Rule 204-2 and Rule 17a-4 govern records of AI-generated outputs, Regulation S-P covers client data flowing through AI tools, and Regulation Best Interest holds firms accountable for AI-influenced recommendations. The SEC's FY2026 examination priorities made clear that examiners want to see written policies, accurate disclosures, and supervisory procedures that reflect how AI actually operates inside your firm.

Can a broker-dealer use third-party AI tools without taking on the compliance risk?

No. Buying a third-party AI tool transfers the capability, not the obligation. The SEC expects firms to conduct due diligence before deployment, maintain contractual audit rights and data handling terms, and monitor vendor performance on an ongoing basis. "We use a vendor for that" is not a sufficient answer during an examination.

SEC artificial intelligence guidance vs. a dedicated AI rule: what's the actual difference for compliance teams?

A dedicated rule gives you a checklist. Guidance applied through existing rules gives you a framework you have to map yourself. The SEC withdrew its predictive data analytics proposal in June 2025 and signaled it will apply existing authority instead of writing new AI-specific rules, which means your compliance program has to connect each AI use case to the specific existing rule it touches: books and records, supervision, fiduciary duty, or marketing.

How do I build written supervisory procedures that actually cover AI tools under FINRA Rule 3110 and SEC Rule 206(4)-7?

Start with an inventory of every AI tool in production, then assign a named supervisor to each one. Your WSPs need to specify which tools are in use, what decisions they inform, how outputs get reviewed and escalated, and what triggers a compliance review when a model is updated. The most common gap is model updates: a change in output behavior that happens without compliance review before deployment is exactly what examiners will ask about.

What did the SEC's AI-washing enforcement actions against Delphia and Global Predictions mean for how firms should write Form ADV disclosures?

The $400,000 in combined civil penalties from March 2024 confirmed that AI claims in Form ADV, marketing materials, and client communications are subject to the same accuracy standard as any other material statement. Vague language like "AI-powered" requires the underlying reality to match. Firms should build a pre-publication review step for any content describing AI capabilities, tie their disclosure review cycle to a change log for AI tools, and treat Form ADV Part 2 AI language as a standing review item instead of something revisited only after an exam.