and What Firms Should Be Ready to Produce
Overview
Listen
Across our client base and in conversations we’ve had in the industry, we’re hearing a consistent pattern: the SEC’s Division of Examinations is requesting information about how firms are integrating artificial intelligence into their operations. Request letters are targeting AI-driven portfolio management, algorithmic trading models, and marketing claims — with particular scrutiny on whether firms’ AI representations hold up, a practice regulators have labeled “AI washing.” In this Red Oak chat, you’ll learn what regulators are asking for.
Critical Questions Powered by Red Oak
Transcript
Read the Blog Post
The SEC’s Division of Examinations has been issuing requests for information about how firms are integrating AI into their operations. Across our client base and in conversations with compliance and legal teams throughout the industry, patterns are surfacing around what firms are finding challenging, where the gray areas are, and where to start.
When we ask compliance professionals whether they’ve received an AI-related request in an exam, the majority say no. Or at least not yet. The SEC’s requests have been issued in a pattern consistent with past examination waves: a concentrated group of firms receives requests early, word spreads, and firms in adjacent categories begin preparing as the scope broadens. Firms are using this time to understand what regulators have started asking and building toward it now. Here’s what we’re hearing.
Taking Inventory
Whether the topic is AI claims in marketing materials or AI tools in use across the firm, the same challenge surfaces: most firms don’t have a complete inventory, and building one is harder than it looks.
On the disclosure side, the SEC is asking for all materials where AI use is mentioned, including written, audio, and video. For many firms, that’s a wide and poorly mapped surface area. Consider a common scenario: marketing makes a claim about AI, and that claim appears in ADV Part 2, on the website, in pitch materials, and in video content. Does the compliance team know whether those claims are consistent, accurate, and substantiated across all of those channels? Request letters are targeting marketing claims as one of the key topics, with particular scrutiny on whether firms’ AI representations hold up – overstated claims that regulators have labeled “AI washing.” Firms should be prepared to produce documentation that supports any AI-related claim they’ve made, in any format, across any channel.
On the systems side, getting to a complete inventory typically requires pulling together IT, cybersecurity, legal, and marketing. Several firms described finding groups within their organizations using AI tools that compliance had no visibility into. AI adoption has been decentralized, and governance programs are catching up.
Vendor management compounds this. Firms are recognizing that a third-party vendor using AI in a product they’ve purchased creates exposure they need to document and understand. Not just at onboarding, but on an ongoing basis. Several compliance teams described revisiting their due diligence processes specifically to build in AI-related questions, because a DDQ from six months ago may already be incomplete.
Where Guidance is Still Forming
There’s a significant amount of gray area that’s generating candid conversations in the market.
On prompt retention: what we’re hearing is that firms are not retaining AI prompts and responses for tasks analogous to a Google search. However, that expectation is evolving, particularly for higher-risk use cases, like client communications, where the documentation bar is already higher. Some archiving platform providers are building AI capture capabilities now, anticipating that this will become a standard requirement.
On ADV disclosure: there’s no dedicated field for AI use in the ADV today, but the conversation about whether and how to disclose is happening inside firms. Some are starting to include it proactively within existing technology disclosure fields. Others are waiting for clearer guidance. The regulatory expectation isn’t defined yet, and firms are making judgment calls in the meantime.
On AI-generated marketing content: whether using AI to draft marketing materials requires disclosure came up as an open question. In most of these conversations, firms are leaning toward documenting and retaining more rather than less, given the direction of regulatory attention. But the line isn’t drawn anywhere officially.
The common thread: the SEC hasn’t specified expectations clearly in many of these areas, and firms are operating in a period where careful documentation is the most defensible posture available, even without formal requirements to point to.
The Governance Gap
Roughly two-thirds of the compliance and legal professionals we’ve spoken with report having some form of AI governance committee or working group. In many firms, day-to-day ownership of AI systems has landed with IT by default because they manage the tools. What compliance, legal, and audit are still working out is how to verify that what IT says the AI is doing is what it’s actually doing, and how to document that oversight in a way that would survive an examination. That requires ongoing review, meeting records, and evidence of AI-specific training. The SEC requests that we have seen call out all of these specifically.
Where to Start
When looking at what the SEC is asking, there are a few practical places to start to ensure your firm is ready. Inventory every public AI claim your firm has made and verify it’s accurate and substantiated. List every AI tool in operational use and check whether your existing written policies specifically address it. And assign clear ownership of AI governance, so there’s someone accountable for the documentation, training records, and committee structure regulators are asking for.
These may be challenging, particularly in firms where departments have adopted AI independently and at different speeds. But this is what SEC requests are asking for, and what firms will need to defend in an exam.
Contributor
Mike Lubansky serves as the Senior Vice President of Strategy at Red Oak. Connect with Mike on LinkedIn.
