The SEC's 2027 Examination Priorities: Artificial Intelligence and Cyber Risk

On October 23, 2026, the Securities and Exchange Commission (“SEC”) Division of Examinations (“Division”) released its examination priorities for the 2027 fiscal year (“Examination Priorities”). Although the core examination themes are largely unchanged, the Examination Priorities do place a heightened focus on artificial intelligence and cybersecurity risk. While these are not the SEC’s only examination priorities in the year ahead, their inclusion is notable because, as Chairman Paul Atkins stated, “[e]xaminations provide critical insight into emerging risks, evolving business practices, and market developments across our financial system,” setting the stage for future developments in enforcement and private litigation.

AI Disclosure and Governance

Consistent with Executive Order 14434, the SEC now uses the term “Super Intelligence” or “SI” in lieu of “Artificial Intelligence” and “AI.” While federal terminology has changed, the underlying legal standards have not, and AI continues to be an area of interest for the SEC.

One Examination Priority will involve assessing whether firms’ use of AI is consistent with their obligations under the federal securities laws and their existing fiduciary duty, compliance and supervisory frameworks. The Division will also assess whether firms’ use of AI aligns with their public disclosures, specifically, whether: “(1) representations are fair and accurate; (2) operations and controls are consistent with disclosures made to investors; and (3) algorithms lead to advice or recommendations consistent with investors’ investment profiles or stated strategies.” The lesson for registrants is that disclosures about AI, whether in Form ADV brochures, marketing materials, or client communications, must continue to match how automated tools operate.

Cybersecurity Continues to Be an Area of Focus

Cybersecurity likewise remains a critical area of risk. While this focus is not new, the emphasis on AI-enabled cyberthreats is. The Division will examine how firms prepare for AI-generated phishing messages and synthetic voice and video used for social engineering. More broadly, the Division stated that it is prioritizing examination of “information security and operational resiliency, with particular emphasis on cybersecurity,” which will include reviewing “policies and procedures regarding governance practices, data loss prevention, access controls, account management, and the response and recovery protocols for cyber-related incidents, including ransomware attacks.” The Division will also review how firms supervise their own use of AI in fraud detection and will assess risks from third-party service providers and shared technologies—an area that grows harder to police as AI becomes embedded in vendors’ software.

Regulation S-P and S-ID Move from Preparation to Testing

Consistent with these concerns, the 2027 Examination Priorities also focus on compliance with Regulation S-ID and Regulation S-P, assessing whether firms have developed, implemented, and maintained policies and procedures to protect customer information and mitigate the risk of identity theft. Examinations related to Regulation S-P will evaluate firms’ response policies and procedures for unauthorized access to, or use of, customer information, including notifications and oversight of service providers, while examinations related to Regulation S-ID will evaluate firms’ identification and detection of identity theft red flags in the context of customer account takeovers and fraudulent transfers.

Other Notable Areas of Focus

AI and cybersecurity are not the only areas on the agenda. Indeed, the 2027 Examination Priorities retain and sharpen several of last year’s stated priorities. For example, adviser reviews now expressly target economic conflicts like fee rebates, cash management, and fee and expense calculations, and will examine advisers’ reliance on proxy advisory firms. Compliance program reviews will focus on firms that have grown through mergers or acquisitions or that operate geographically dispersed branch offices. And broker-dealer anti-money laundering is now a standalone priority, with attention paid to foreign omnibus accounts and so-called cross-border “pump-and-dump” and “ramp-and-dump” schemes.

The Examination Priorities also break new ground in market infrastructure. For the first time, the Public Company Accounting Oversight Board receives a dedicated section, with the Division using data collection and outreach to identify areas for inspection and potential recommendations to address deficiencies. Examiners will also begin reviewing compliance with the expanded Treasury clearing requirements, which require certain secondary market Treasury transactions to be centrally cleared. Finally, tokenization is identified as an area of interest, with clearinghouses and key market systems expected to face scrutiny over how they handle tokenized securities.

Takeaways

Although there are many takeaways from the SEC’s 2027 Examination Priorities, its focus on AI and cybersecurity highlights the risk technology poses to registrants. Given this risk, registrants should be proactive rather than reactive by, among other things, continuing to:

• Monitor and govern AI use. Identify where AI and automation are used across the firm, including within vendor products, and adopt written policies covering supervision, testing, and data retention. Having policies on paper is not enough; to be sufficient, they must evolve with technology and the concomitant risks.
• Align AI disclosures with actual practice. Confirm that Form ADV, marketing materials, websites and client communications accurately describe how AI tools work, verify that every capability claim can be substantiated, and ensure that automated advice stays consistent with clients’ stated strategies.
• Refresh cybersecurity programs for AI-enabled threats. As cybercrime evolves, so too should firms’ responses. This includes, among other things, updating incident response plans, training employees on AI-generated phishing and deepfake impersonation, and adding verification steps for fund transfers and account changes.
• Treat examination materials as potential evidence. Documents produced in an examination, along with deficiency letters and remediation commitments, may later be used in enforcement actions or private litigation. Accordingly, where appropriate, registrants should consult with counsel on AI and cyber risk assessments, incident post-mortems, and remediation analyses, and keep business documentation separate from legal analysis to preserve any applicable privileges.

Conclusion

The 2027 Examination Priorities do not rewrite the rules for AI and cybersecurity, but they do make the SEC’s expectations clear. Firms that can demonstrate accurate disclosures, disciplined recordkeeping, and controls that keep pace with AI-enabled threats will be best positioned not only in the examination context, but also in any enforcement action or lawsuit that follows.