The Securities and Exchange Commission (SEC) has released its examination priorities for fiscal year 2027, and among the familiar discussions of fiduciary duties, investor protection, and regulatory compliance is a term that may catch some readers by surprise: "super intelligence."
No, the SEC is not preparing for a science fiction-style showdown with machines that have become smarter than their creators. The terminology comes courtesy of President Trump's September 29, 2026, Executive Order, Inaugurating the Era of Super Intelligence, which directs federal agencies to replace references to "artificial intelligence" (AI) with "super intelligence" (SI) in official communications. For now, the order defines SI by reference to the existing statutory definition of AI. In other words, the name has changed, but the technology under discussion remains familiar.
The SEC's concerns are also very real. Its latest priorities make clear that examiners will be looking closely at both sides of the AI equation: how financial firms are using AI in their businesses and how cybercriminals are using AI against them.
For investment advisers, broker-dealers, and other SEC-regulated entities, the message is straightforward. AI is no longer just an emerging technology to monitor; it is an operational, cybersecurity, and compliance risk that firms must be prepared to manage.
When the Voice on the Phone Isn't Who You Think It Is
Cybersecurity remains a central examination priority, but the SEC is paying particular attention to how AI is changing the threat landscape.
The agency specifically identified AI-generated phishing messages and synthetic or "deepfake" voice and video as threats that firms should be prepared to address. These technologies allow attackers to create convincing communications, impersonate executives or customers, and to manipulate employees into disclosing information, transferring funds, or granting access to sensitive systems.
Imagine an employee receiving an urgent phone call from someone who sounds exactly like a longtime customer requesting a transfer, or a help desk technician receiving a convincing video call from an apparent executive requesting a password reset. Traditional verification procedures may not be sufficient when the voice, face, and message all appear legitimate.
The SEC recognizes that threat actors are using AI to automate and accelerate cyberattacks, making them more efficient and difficult to detect. Examiners will therefore assess firms' compliance with applicable requirements concerning their evaluation of and preparation for these emerging threats.
The practical question is whether firms have adapted their security controls to account for AI-powered attacks. Employee training, multifactor authentication, identity verification, transaction approval procedures, and incident response plans should reflect the reality that seeing – or hearing – is no longer necessarily believing.
AI-Powered Investment Advice Is Also Under the Microscope
The SEC is not just concerned about AI in the hands of criminals; it is also interested in how firms are deploying AI themselves, particularly when those technologies influence investment decisions or customer recommendations.
The 2027 priorities identify automated investment advisory services, recommendations, trading algorithms, and related tools as areas of examination focus. The SEC will also examine policies and procedures for monitoring AI used in fraud prevention, back-office operations, anti-money laundering compliance, Regulation Best Interest (Reg BI) obligations, and trading functions.
For firms using AI to provide investment advice or recommendations, examiners will generally assess three critical issues:
- Accuracy of representations: Are statements about the firm's AI capabilities, investment tools, and services fair and accurate?
- Consistency with disclosures: Do the firm's actual operations and controls align with what it tells investors about its use of technology?
- Appropriateness of recommendations: Do algorithms produce advice or recommendations consistent with investors' investment profiles, objectives, risk tolerances, or stated strategies?
These are not merely technical questions. They implicate existing fiduciary duties, disclosure requirements, supervisory obligations, and investor protection rules.
An algorithm that generates investment recommendations does not relieve a firm of responsibility for those recommendations. Likewise, adopting an AI-powered compliance or fraud detection tool does not eliminate the need to understand its capabilities, limitations, and performance.
Firms should be prepared to explain where AI is being used, how its outputs are evaluated, who is responsible for its oversight, and how the firm ensures that its use remains consistent with applicable regulatory obligations. Simply having an AI policy on the shelf is unlikely to be enough.
Cybersecurity, Vendor Risk, and Regulation S-P Remain Priorities
Despite the attention surrounding AI or SI, the SEC has not forgotten more traditional cybersecurity concerns. The SEC will continue reviewing cybersecurity governance, data loss prevention, access controls, account management, and incident response and recovery capabilities, including ransomware preparedness.
Third-party risk also remains fully in the spotlight. The SEC specifically identifies firms' increased reliance on service providers and shared technologies as an area of concern. This is particularly relevant as vendors incorporate AI capabilities into existing products, potentially introducing new risks involving customer information, system access, and data security.
The amended Regulation S-P requirements will also receive examination attention. Examiners will evaluate firms' safeguards for customer information, incident response programs, customer notification procedures, and oversight of service providers. With the compliance dates for both large and small covered institutions now behind us, firms should be prepared to demonstrate implementation rather than merely describe future plans.
The SEC also identifies Regulation S-ID as a priority, including whether firms are updating identity theft prevention programs to address account takeovers, fraudulent transfers, stolen credentials, and AI-related threats.
Taken together, these priorities reinforce a familiar but important principle: cybersecurity compliance requires more than written policies. Firms need controls that are reasonably designed for the risks they actually face – and evidence that those controls are operating as intended.
What Should Firms Do Now?
The SEC's priorities offer a useful roadmap for financial firms looking to get ahead of potential examination findings. Among the steps worth considering:
- Revisit cybersecurity risk assessments. Evaluate exposure to AI-powered phishing, deepfake impersonation, account takeovers, and other emerging threats. Consider whether identity verification and transaction authorization controls remain effective.
- Take inventory of AI use. Identify approved and unauthorized AI tools, including AI capabilities embedded in third-party platforms, and assess their access to customer information and regulated business processes.
- Review AI governance and investment advice practices. Confirm that AI-related disclosures are accurate, algorithmic recommendations are appropriately supervised, and controls address applicable fiduciary, Reg BI, and other regulatory obligations.
- Test incident response and vendor oversight. Update incident response plans, conduct tabletop exercises involving AI-enabled attacks or third-party incidents, and verify compliance with amended Regulation S-P requirements.
The Bottom Line
The intelligence may be artificial – or super – but the regulatory scrutiny and cybersecurity risks are very real.
To be sure, there is a certain irony in the SEC's latest priorities. The same technology promising to help financial firms operate more efficiently, identify fraud, and better serve customers is also helping criminals become more effective at targeting those firms. The SEC intends to examine both sides of that equation. Although the 2027 examination priorities do not create new legal obligations, they provide a clear indication of where regulators will be looking. Firms that have not revisited their cybersecurity, AI governance, and compliance programs in light of these developments would be well served to do so now.
Our Privacy, Cybersecurity, and Technology team assists financial institutions and other organizations with cybersecurity and AI risk assessments, governance and compliance programs, Regulation S-P implementation, third-party risk management, tabletop exercises, and incident response. If you have questions regarding any of these areas, any other cybersecurity- or data protection-related matters, or any other broker-dealer or investment advisor-related issues, please contact the authors Matt White and Lori Patterson, or any member of Baker Donelson's Data Protection: Financial Services Team or Broker-Dealer/Investment Adviser Team.