SEC AI Governance Guidance

Applies To

Overview

The US Securities and Exchange Commission's (SEC) AI governance posture comprises several distinct but interconnected instruments rather than a single unified framework. The most significant is the August 2023 proposed rule on 'Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers' (Release Nos. 34-97990; IA-6353), which would have required registrants to eliminate conflicts of interest when AI tools put the firm's interests ahead of investors'. The SEC withdrew that proposal on 12 June 2025, along with 13 other pending rules. The proposal reflects the Commission's concern that AI systems may be designed, intentionally or as an unintended side effect, to favor firm revenue over investor outcomes, a structural conflict that existing suitability and fiduciary frameworks may not fully capture. In parallel, the SEC's Division of Corporation Finance has issued guidance and Staff Bulletins addressing AI-related disclosures in annual reports, prospectuses, and proxy statements. Public companies are expected to disclose material risks arising from AI use, AI-related cybersecurity exposures, and the governance structures in place to oversee AI systems. The Commission has also scrutinized 'AI washing' (instances where companies overstate AI capabilities in investor communications), bringing enforcement actions grounded in anti-fraud provisions of the Securities Act of 1933 and the Securities Exchange Act of 1934. The SEC's Office of Compliance Inspections and Examinations (OCIE, now reconstituted as the Division of Examinations) has included AI and algorithmic systems among its examination priorities, directing examiners to assess whether registrants have adequate policies and procedures governing AI model development, validation, deployment, and monitoring. AI policies and procedures became an explicit examination focus in the priorities for 2024 and 2025. Separately, the SEC's 2023 cybersecurity disclosure rule, effective 5 September 2023 with compliance from December 2023, indirectly captures AI-related cyber risks by requiring timely disclosure of material cybersecurity incidents and annual disclosure of cybersecurity risk management practices, which must encompass AI systems that process material data or support critical operations. Registrants should also monitor the interplay between SEC guidance and the Financial Industry Regulatory Authority's (FINRA) ongoing work on algorithmic supervision and AI use in member firm operations.

Key Requirements

• •Manage conflicts of interest from AI tools under existing fiduciary and best-interest duties (the 2023 proposal on predictive data analytics was withdrawn in June 2025)
• •Disclose material AI-related risks in annual reports (Form 10-K), registration statements, and proxy materials, including risks from AI model failure, bias, and third-party AI dependencies
• •Refrain from making materially misleading statements about AI capabilities in investor communications, marketing materials, or SEC filings (anti-fraud provisions)
• •Maintain written policies and procedures governing AI model development, validation, change management, and ongoing monitoring as part of the adviser or broker-dealer compliance program under the Investment Advisers Act or Exchange Act
• •Include AI systems that process material nonpublic information or support critical operations within the scope of cybersecurity risk management programs disclosed under the 2023 Cybersecurity Disclosure Rule
• •Ensure AI-driven trading, order routing, or portfolio construction systems are subject to governance controls that examiners can review during SEC inspections
• •Document how AI-generated investment recommendations are supervised and reviewed to satisfy best interest and fiduciary obligations
• •Assess third-party AI vendor arrangements for outsourcing risk and ensure vendor due diligence is documented and periodically updated

What Your Organization Must Do

• →Review AI tool conflicts against existing fiduciary and best interest duties, since the 2023 predictive analytics proposal was withdrawn.
• →Require Legal and Compliance sign-off before publishing any claim about your firm's AI capabilities.
• →Disclose material AI risks in annual reports, registration statements, and proxy materials, including model failure and vendor dependence.
• →Write and maintain procedures for AI model development, validation, change management, and ongoing monitoring that examiners can review.
• →Bring AI systems handling material nonpublic information inside the cybersecurity program described under the 2023 disclosure rule.
• →Document initial and periodic due diligence on third party AI vendors and report results to the Chief Compliance Officer.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

Does the SEC predictive data analytics proposed rule apply to robo-advisers and quantitative hedge funds, or only traditional broker-dealers?

It no longer applies to anyone, because the SEC withdrew the proposal on 12 June 2025. As proposed, it would have covered all registered investment advisers and broker-dealers, including robo-advisers.

What is the current status of the SEC predictive data analytics conflict-of-interest rule and when is a final rule expected?

The SEC withdrew the proposal on 12 June 2025 and said it does not intend to issue a final rule. Any future rule would need a new proposal. Conflicts from AI tools are still covered by existing fiduciary and best-interest duties.

What counts as AI washing under SEC anti-fraud provisions and what enforcement risk does it create?

AI washing refers to materially overstating AI capabilities in investor communications, SEC filings, or marketing materials. The SEC has brought enforcement actions under Securities Act Section 17(a) and Exchange Act Section 10(b), treating these misstatements as fraud. Firms should require Legal and Compliance sign-off before any AI capability claim is published externally.

How does the SEC's 2023 cybersecurity disclosure rule intersect with AI governance obligations for public companies?

The rule took effect on 5 September 2023. Form 8-K incident reporting applied from 18 December 2023, and annual disclosures from fiscal years ending on or after 15 December 2023. AI systems handling material data belong in the cybersecurity program the company describes.

What specific AI-related items does the SEC Division of Examinations look for during inspections of investment advisers and broker-dealers?

Examiners look at written policies on AI development, validation, and monitoring, and at conflicts in AI-driven recommendations. AI became an explicit examination priority in the 2024 and 2025 priorities, not in 2022 or 2023.

What due diligence obligations apply when a registered investment adviser or broker-dealer uses a third-party AI vendor?

While no single rule prescribes a specific third-party AI vendor framework, SEC examination expectations and existing outsourcing guidance require documented initial and periodic due diligence covering model transparency, data handling, and conflict-of-interest exposure. Contractual audit rights and annual review cycles are best practice, with results reported to the Chief Compliance Officer.