The SEC's FY2026 exam priorities name AI washing and AI supervision. Sixty-three percent of RIAs now use AI. "We use ChatGPT for meeting notes" is not a supervision policy, and your compliance manual's annual review has to say something better. AboveBoard turns the examiner's questions into forty controls, an independent review and a verified score you can put in front of the exam team, your custodian and your board.
The FY2026 examination priorities (Nov 17, 2025) name "AI washing" and ask whether advisers have policies to monitor and supervise their use of AI across fraud prevention, back office, anti-money-laundering and trading, and whether they supervise the vendors supplying it (Akin, Nov 2025). The compliance-program rule (Rule 206(4)-7) already requires written policies and an annual review; the AI section of that manual is what the exam team will request. State-registered advisers should expect state regulators to follow.
Any statement about AI in a pitch deck, website or ADV brochure is an advertisement under the marketing rule (Rule 206(4)-1) and must be substantiated. The SEC's Delphia and Global Predictions settlements (Mar 2024, $400,000 combined) concerned claims that AI drove the investment process when it did not. The FTC's July 7, 2026 policy statement treats undisclosed steering of AI outputs as deceptive when accuracy is implied, and AI-related cases accounted for 73% of alleged investor losses in H1 2026 securities class actions (Cornerstone Research, Jul 2026).
AI-generated meeting summaries, drafted client emails and portfolio commentary can be records under the books-and-records rule (Rule 204-2). Amended Regulation S-P (2024) requires an incident-response program and customer notification after a breach of customer information, and an AI tool that retains client data is inside that perimeter. For dually registered firms, FINRA Regulatory Notice 24-09 (Jun 2024) set out supervisory expectations for generative AI, and FINRA's annual oversight reports have addressed it since.
S&P 500 companies citing AI risk in their 10-Ks rose from 12% in 2023 to 83% in 2025, while only 2.7% of directors have AI expertise (The Conference Board, Apr 2026). Seventy-eight percent of senior leaders lack full confidence they could pass an independent AI governance audit within 90 days (Grant Thornton, Apr 2026, n=950). Institutional clients, consultants and custodians are adding AI sections to due-diligence questionnaires.
AI note-takers in Zoom and Teams and advisor-specific tools that draft meeting summaries and CRM entries; email drafting in Outlook; client-portal chat. These generate records, and some of them record clients.
AI features inside financial-planning and portfolio platforms, market and manager research assistants, rebalancing and tax-loss automation, proposal generators. The tools most likely to shape advice, and so the tools that most need a human sign-off.
ChatGPT, Claude and Copilot for commentary and content; AI-generated social posts; onboarding document extraction; surveillance and email-review tools. Every "AI-powered" claim in the marketing stack needs an evidence file behind it.
Forty controls, eight per domain, scored on evidence. Here is how they read when your obligations come from the Advisers Act and your reviewer is the exam team.
An AI policy that lives inside the compliance manual, a named owner (usually the CCO or a principal) with authority to halt a tool, an inventory of AI tools and use cases, AI on the quarterly principals' agenda, and the annual compliance review covering AI explicitly.
Evidence examples: the AI section of the compliance manual with its adoption date; the register listing note-takers, planning-tool AI and general assistants with owners; the annual review memo's AI paragraph; principals' meeting minutes.
Client nonpublic personal information classified so staff know what may never enter an unapproved tool, an approved-tool list with enterprise terms that bar training on your data, single sign-on, retention settings that match your books-and-records schedule, and client consent for recorded meetings.
Evidence examples: the classification with adviser-specific examples (account numbers, statements, health information in planning); the vendor terms review log for your note-taker and planning platform; the meeting-recording consent script and the state-consent map behind it.
A registered person reviews AI-drafted client communications and any AI-influenced recommendation before delivery; spot-checks are logged; the incident plan covers an AI tool exposing client data and maps to Regulation S-P notification; vendor model and terms changes are tracked; AI-assisted work is identifiable in the record.
Evidence examples: the pre-send review rule and a sample sign-off; the quarterly sampling log; the incident-plan section referencing Regulation S-P; the CRM field that tags AI-generated summaries.
Training completed by 90%+ of advisers and staff, role-specific modules for advisers, operations and supervisors, reviewer training on verifying AI output, signed acknowledgments, and principals who have completed a governance module. The annual compliance meeting is a natural home.
Evidence examples: the completion report; the acknowledgment file; the annual compliance meeting agenda showing the AI module.
Disclosure of material AI use in client agreements and, where relevant, Form ADV; every AI claim in marketing reviewed under the marketing rule with an evidence file; a standard answer bank for institutional and custodian questionnaires; a complaints path that covers AI.
Evidence examples: the client-agreement clause and any ADV language; the marketing-review log entry for the "AI-enabled planning" claim on your website; the last three due-diligence questionnaires, consistent with each other.
No firm is listed at any level with a zero on G1 (written policy), D3 (vendor terms reviewed) or O1 (human review before client-facing output). For an adviser, these are the first three document requests in an exam.
Read the full rubricThe AI document request list (policy, inventory, vendor terms, supervision records, training) is the evidence file the reviewer already verified. Hand it over on day one.
Institutional clients, consultants and custodians get consistent answers and a registry link. Marketing gets a substantiated, dated statement it can use.
A plain-English report by domain, with gaps and fixes, and a year-stamped badge that shows the work is current. Coverage decisions remain the carrier's.
AboveBoardAI issues a score and a verification under a private, voluntary standard; it is not an SEC, FINRA or state approval, not legal or compliance advice, and not a guarantee of exam results. It verifies that your AI governance practices exist and are evidenced on the review date. See What is an AI audit?
Take the free Snapshot. List every AI feature switched on in your CRM, planning, portfolio, meeting and marketing tools, plus the general assistants advisers use. That is your register.
Adopt the AI policy as a section of the compliance manual (our template maps to it). Approve specific tools on managed accounts with enterprise terms. Decide how recorded meetings are consented and stored.
Require pre-send review of AI-drafted client communications. Run every AI claim in current marketing through the marketing-review process. Roll out Academy Foundations and collect acknowledgments.
Update client-agreement language and, where material, ADV disclosure with counsel. Start the full assessment; Snapshot answers carry over.
Growth Firm (50–249) $18,000; Established Firm (250–999) $42,000; Enterprise (1,000+) from $75,000. Every tier includes the assessment, independent review, score, badge, registry listing, board report and Academy Foundations. Enterprise AI governance platforms, by comparison, run roughly $50,000 a year and are quote-only (SecurePrivacy, Jun 2026).
There is no standalone SEC AI rule for advisers. But the Division of Examinations' FY2026 priorities (Nov 2025) name AI washing and whether firms have policies to monitor and supervise their use of AI, and the compliance-program rule already requires written policies reasonably designed to prevent violations, reviewed annually. Examiners are asking for the AI section of that program. If it does not exist, that is the finding.
Claiming AI capabilities you do not have, or overstating the ones you do. In March 2024 the SEC settled with two advisers, Delphia and Global Predictions, for a combined $400,000 in civil penalties over false AI claims (Harvard CorpGov, Apr 2024). The FY2026 exam priorities name AI washing directly, and the FTC issued a policy statement on deceptive AI accuracy claims on July 7, 2026.
They can be. AI-generated meeting summaries and transcripts that document advice or client instructions may be records the firm must keep, and recording client calls requires consent in many states. Firms that pass review decide which tools are approved, where the output is stored, how long it is retained, and how clients are told, and they write those decisions down.
No. AboveBoardAI issues a score and a verification under a private, voluntary standard. No regulator endorses it. It is designed so that the evidence it verifies is the same evidence an SEC or state examiner would ask for: the policy, the inventory, vendor terms, supervision and review records, training and disclosure.
AboveBoardAI is priced annually by headcount: $7,500 for firms of 1 to 49 people, $18,000 for 50 to 249, $42,000 for 250 to 999 and from $75,000 for 1,000 or more. Every tier includes the assessment, independent review, score, badge, registry listing, board report and Academy training for all staff. See pricing.