The SEC will ask about your AI tools. Here's how to make that answer easy.

The SEC's 2027 exam priorities say examiners will ask how your firm uses AI and how you protect clients from AI-driven fraud. This guide breaks that into six areas: your AI tools, client fraud, logins, vendors, incidents and what you tell clients. You'll get ten practical actions to take this week, plus six questions to ask your vendors. We're also running a live session, Get your firm AI exam-ready, to walk through it with you. Date to be announced.

Earlier this year, Jeffrey DeHaan's team at Clearwater Capital Partners received a message from one of their clients. It was an attempt to get at the client's assets. It sounded exactly like him. It wasn't him.

"We have had voice imitation through AI already as an attempt to gain access to client assets," DeHaan told InvestmentNews. The only thing that gave it away was "a very slight mispronunciation" of the client's first name. When they played it to the real client, "he would have said, 'I left you that message.'"¹

One mispronounced name. That was the whole defense.

In October, the SEC published its examination priorities for 2027.² Examiners will now check how firms have prepared for "synthetic or deepfake voice and video used for social engineering." They'll also look at how you use AI yourself: to draft, to talk to clients, and to give advice. The SEC calls it "super intelligence (SI)". In this article we use AI and SI interchangeably. They mean the same tools.

Most firms already know this matters. In this year's compliance testing survey of 411 advisory firms, 85% named AI the hottest compliance topic of 2026. 86% have an acceptable use policy for it. Only 48% have a formal policy, plan or procedure for human oversight of what AI produces.³

That gap is what an examiner will find. Not because advisors are careless, but because nobody has turned the SEC's list into things a small firm can actually do.

So that's what this is. For each thing the SEC says it will look at, I'll cover what examiners are looking for, the minimum to do this week, and what to ask your vendors. None of it needs an IT department. None of it is legal advice either, so check the detail with your compliance consultant.

1. How you use AI

What examiners will look for. The SEC says firms now use AI "to support research, drafting, coding, and client communications, as well as advisory and portfolio management functions." Examiners want to understand "how the technologies influence outcomes" and whether you still meet your existing obligations. Those obligations haven't changed. Your fiduciary duty and your books and records rules apply whether a person or a model wrote the file note.

The hard part is that you're probably using more AI than you think. Lori Weston of STP Investment Services points out that AI is now "continually embedded" in the software firms already pay for, so you have to look beyond the tools you approved.⁴ Your CRM, your email, your planning software and your AI notetaker may all be running it. And when staff use personal AI accounts for client work, you have a recordkeeping problem and a privacy problem at once. In a June survey, 34% of office professionals said they had put customer data into public AI tools.⁵

The minimum this week:

• Write down every AI tool your firm uses and what it's for. Include the AI inside software you already have. One page is enough.
• Pick one firm-approved tool for client data, and put it in writing: no client data in personal AI accounts or consumer chatbots. Tell your team why.

Ask your vendors: can you show me how an AI output was produced? An examiner may ask why a note says what it says. You should be able to answer.

Marloo: every file note and AI output has an audit trail back to the meeting it came from.

2. AI-powered fraud

What examiners will look for. How you've prepared for "SI-generated phishing messaging and synthetic or deepfake voice and video." Under Regulation S-ID, they'll also check whether your identity theft program catches "customer account takeovers and fraudulent transfers," and whether you've updated it "to address emerging risks, such as those related to SI and stolen credentials."

The money is real. Business email compromise cost Americans $3.05 billion last year. The FBI received 22,364 complaints involving AI, with $893 million in losses.⁶ AI has removed the old tells. The spelling is perfect, the tone is right, and the voice sounds like your client.

The minimum this week:

• A call-back rule. Any request to move money, change bank details or change contact details gets a call back on the number already on file. Never the number in the message.
• A client code word. Agree a word with each client that only the two of you know, and ask for it whenever a request feels unusual.
• Tell clients what you'll never ask. We will never ask you to send money to a new account by email, text or voicemail. Put it in your next client email. In Schwab's 2026 benchmarking study, 97% of firms train their staff on cybersecurity, but only 60% educate their clients, the lowest of the controls Schwab lists.⁷

3. Who can get in

What examiners will look for. Your "governance practices, data loss prevention, access controls, account management, and the response and recovery protocols for cyber-related incidents." In plain English: who can log in to what, and what happens when a password leaks.

The minimum this week:

• Turn on multi-factor authentication for email, your custodian and your CRM, in that order. Email comes first because it can reset everything else. Microsoft's research found MFA cuts the risk of an account being compromised by 99.22%.⁸
• Give the whole team a password manager. Every account gets its own password, and nobody has to remember them.
• Review access and offboard properly. When someone leaves, their access goes the same day. Once a quarter, check who can get in to what.

Ask your vendors: do you enforce multi-factor authentication, and can I see who at my firm accessed what?

Marloo: multi-factor authentication is enforced on every login, and each firm's data is walled off from every other firm's at the database level.

4. Your vendors: every place your data goes

What examiners will look for. The "risks associated with registrants' increased use of third-party service providers and shared technologies," and, under Regulation S-P, your "oversight of service providers."

The first question most advisors ask a vendor is "where is my data stored?" It's the default question because it has an easy answer. It's not the whole answer. Follow one client meeting through a typical AI tool and count the places it goes.

Then there's the question everyone asks: does it train on my data? Get a no in writing, but don't stop there. Most AI vendors send your data to someone else's model, so what matters is where it goes and who sees it on the way.

Ask your vendors these six questions:

A good vendor answers all six in writing, quickly. Vendors that have had to answer them for UK and European regulators, under GDPR's strict security and auditability rules, usually have the answers ready.

Then ask for proof. A SOC 2 report tells you how a vendor's controls performed over the last audit period. It looks backwards. Independent penetration testing tells you how hard it is to break in now. Marloo holds SOC 2 Type 2 and runs independent penetration tests every six months. The detail is on our Trust Center.

5. When something goes wrong

What examiners will look for. Your "response program policies and procedures for unauthorized access to or use of customer information, including customer notification procedures and oversight of service providers." This is the amended Regulation S-P. If your firm manages under $1.5 billion, it applied from June 3, 2026. Examiners are no longer asking whether you're preparing. They're asking whether it's done.

The rule has two clocks. If sensitive client information was, or was reasonably likely to have been, accessed without authorization, you notify the affected clients as soon as practicable and within 30 days. Your service providers must tell you within 72 hours of finding a breach on their side.⁹

The minimum this week: a one-page incident response plan.

• Who's in charge when something goes wrong, and who's their backup.
• Who to call: your IT support, your custodian, your compliance consultant and your cyber insurer.
• How to lock accounts and reset passwords fast.
• How and when you tell clients, inside 30 days.
• Where you record what happened and what you did.

Ask your vendors: will your contract commit to telling me about a breach within 72 hours?

Marloo: we commit to notifying affected customers no later than 72 hours after we become aware of a breach.

6. Say what you do

What examiners will look for. Whether what you tell clients is "fair and accurate," and whether your "operations and controls are consistent with disclosures made to investors."

The minimum this week: read your ADV Part 2A, your privacy notice and your client agreement side by side with the AI list from section 1. Do they mention AI? Do they match how you work today? If you record client meetings, do your clients know, and did they agree? If the answer to any of these is no, fix the document, not the story.

Get the AI exam-ready checklist

We've turned this article into the AI exam-ready checklist: one page covering what an examiner may ask for, and what to have ready. You'll get it when you sign up for our live session, Get your firm AI exam-ready. Sacha Lala, our Security & Compliance Lead, Liam McGuire, our GTM & Ops Lead, and a US compliance consultant will walk through it and answer your questions. Date to be announced.