For SEC- and state-registered advisers
Your team is using AI. The SEC made it an exam finding — not a rule.
The SEC withdrew its AI rule in June 2025. It did not stop looking. It made AI an examination subject instead — and the exam request list already asks for an AI inventory, an acceptable-use policy, vendor diligence files, and evidence of human review. If AI is in your firm and nobody has mapped it, you can’t produce any of that, and that’s a deficiency waiting to be written up. We fix it by mapping your AI usage and giving you those exact artifacts within 30 days (max).
The duty you already have
No AI rule doesn’t mean no AI scrutiny. It means the opposite.
The SEC’s one AI proposal — the 2023 predictive data analytics rule — was withdrawn in June 2025 under Chair Paul Atkins, and the pipeline behind it is empty. Advisers who read that as a reprieve drew the wrong conclusion. AI became an examination subject without ever becoming a rule, and the existing framework — the Compliance Rule, fiduciary duty, the Marketing Rule, Form ADV — already reaches every AI use in the firm. Nobody had to add a rule to make the questions bite.
AI is squarely in the exam program
The Division of Examinations' FY2026 priorities commit staff to reviewing the accuracy of AI representations and the adequacy of the policies and procedures supervising AI use. This is not hypothetical scrutiny. It's on the request list.
SEC Exam Priorities, FY2026AI is the thing nobody inventoried
It arrives inside software the firm already licenses — the research platform, the CRM, the meeting-notes tool — and inside copilots individual staff switch on. Nobody logged it, nobody approved it, in the worst case nobody has asked. It's exactly what the exam request list is built to surface.
Shadow AIAnd the mismatch is already enforceable
In March 2024 the SEC brought its first "AI washing" cases, charging two advisers a combined $400,000 for misstating how they used AI. The principle established is simple and it cuts both ways: the gap between what you say about AI and what is actually true is actionable.
SEC AI-washing settlements, March 2024What you’re already on record for
The representations are already filed. AI is what makes them hard to stand behind.
These aren’t new obligations. They’re the disclosures, policies and marketing you already have on record — and every one gets more uncomfortable once you accept that AI is in the firm and nobody has mapped where.
Form ADV
Your brochure describes your process and the conflicts it creates, and you certify it's accurate.
Does it account for how AI features in that process — or is there a material fact you haven't mapped because you haven't looked?
Compliance Rule · 206(4)-7
Your written policies must be reasonably designed to prevent violations, and you review them at least annually.
Can a policy be reasonably designed against a tool it never mentions? Can the annual review have considered AI if nobody mapped it?
Marketing Rule · 206(4)-1
Does any client-facing material mention AI, "proprietary models," or data-driven insight?
You must be able to substantiate it. Overstating AI is exactly what the SEC's first AI cases were about.
Fiduciary duty · care and loyalty
If AI shapes research or recommendations, have you identified and disclosed the conflicts it introduces?
The duty of loyalty doesn't pause for a tool nobody registered — and it's a perennial exam priority.
Vendor and third-party oversight
The model inside your CRM or research stack is a vendor making or shaping decisions. Is it in your diligence file?
Exam staff ask for that file by name.
Books and records · human review
Can you evidence that AI-assisted work received human review?
The request list asks for exactly this. "We review it" isn't the same as being able to show it.
Phase one
AI Exposure Review
The exam prep, done before the exam lands. Know exactly where AI lives in the firm, what’s yours to govern, where the gaps are, and what closing them will involve. Two to four weeks. Fixed price. You keep the artifacts whether or not you go further — and they map directly to what examiners request.
AI footprint map
The inventory, evidenced
One map per function — investment, research, operations, client service, marketing — consolidated into a single firm-wide view: where AI is used, in which processes, by whom, against which data and which clients. Including the tools nobody flagged.
AI systems inventory
The document the exam asks for
The operational inventory of every AI system in the firm, with a named owner against each. The document your CCO points to, and the authorized-tools list your acceptable-use policy refers back to.
Gap list against SEC exam and Advisers Act expectations
What's missing, and what it exposes
Where the firm falls short on documented oversight, disclosure, vendor diligence and the representations already on record — prioritized, with the exposure named plainly and mapped to Form ADV, the Compliance Rule and fiduciary duty.
Costed plan for closing the gaps
Makes the next decision concrete
A fixed-price, evidence-based scope for the governance build, so the bigger decision is a known quantity rather than open-ended counsel fees.
- Duration
- Two to four weeks
- Price
- Fixed, scaled to firm size and AUM
- Guarantee
- Exam-ready artifacts delivered before your next annual compliance review, or you don’t pay
- If you proceed
- Fee credited against the build
Phase two · optional
Then: the build, and the training.
Phase one tells you what’s actually there. Phase two puts the governance in place — aligned with ISO/IEC 42001, without the weight or cost of a certification program — so the answer you give an examiner is backed by something real.
AI Governance Build
The policies, controls, records and evidence that let your CCO answer an examiner — and let you stand behind what’s already on your Form ADV and in your marketing.
- Acceptable-use policy and authorized-tools list
- AI integrated into your 206(4)-7 policies and the annual review
- Documented human-oversight and review controls, with a named owner
- Vendor-diligence file for the AI tools already in the firm
- Disclosure review for Form ADV and marketing, against the AI-washing standard
Adviser and operations training
Practical and role-level, not a compliance lecture — because the risk is a portfolio manager pasting client data into a public model at nine in the evening.
- What the approved tools are, and how to use them
- Confidentiality, MNPI and what never leaves the firm
- AI-assisted research and the duty not to mislead clients
- Attendance records you can produce in an exam
Honest fit
Who this is for — and who it isn’t.
A good fit if
- You’re an SEC- or state-registered adviser or asset manager, roughly up to 50 staff
- You have no dedicated compliance or risk function doing this actively
- Your team is using AI — with or without a policy
- Nobody has formally mapped where, or written it down
- An exam, an annual review, or a Form ADV update is on the horizon
Not a good fit if
- You have a mature compliance function already running this
- You’ve already inventoried and documented your AI use
- You want full ISO 42001 certification now — different engagement
- You want a policy document with nothing behind it
Who you’d be working with
We don’t sell paperwork.
A policy that claims a control you don’t run is worse than none. In front of an examiner — or in a Form ADV — that isn’t a documentation problem. It’s the exact mismatch the SEC’s AI cases were built on. Everything we build is real, evidenced, and defensible.
Standards
Committee member, BSI & ISO technical committees
Delivery
Regulated, sensitive-data environments
Questions
What compliance officers ask us.
The SEC withdrew the AI rule. Why does this matter now?
Because the scrutiny didn’t go with it. The Division of Examinations put AI in its FY2026 priorities and its request lists already ask for an AI inventory, an acceptable-use policy, vendor diligence and evidence of human review. "No rule" means the existing framework applies in full — Form ADV, the Compliance Rule, fiduciary duty, the Marketing Rule — with nothing new to soften the edges.
We don’t market ourselves as an "AI firm."
Then you're less exposed on AI washing — but that's only one side. The other is the AI you use internally that never made it into your policies, your disclosures or your vendor file. That's what the exam surfaces, and marketing claims aren't required for it to be a finding.
We already have an AI policy.
Then you're ahead of most firms. The harder question is whether the policy matches what your people actually do, and whether your annual 206(4)-7 review can show it was considered. A policy that doesn't reflect real usage is a written statement you can be measured against.
We handle this in-house.
Plenty of firms can, and if your CCO's function is actively doing it, you don't need us. Where we earn our place is doing the initial inventory and build quickly, in the form examiners expect, so your people stay on investment and client work.
Does this make us ISO 42001 certified?
No. This is a lightweight, ISO/IEC 42001-aligned governance baseline without the weight or cost of a certification program. It's the right foundation if you certify later — but the point is to let you answer an examiner now.
Will this slow the team down?
The opposite is the intention. Most firms are stuck between a blanket ban nobody follows and a free-for-all nobody can evidence. Approved tools, clear rules and a review trail are what let people use AI properly rather than quietly.
Before the next exam letter
Could you produce the AI inventory an examiner asks for — today?
A 20-minute call. We’ll walk the documents the SEC’s exam staff already request, and you’ll leave knowing whether you could produce them. Whether or not you work with us.
Book a 20-minute call