Artificial intelligence has moved from a “nice to have” experiment to a core part of how investment advisers, broker-dealers, and PE/VC sponsors operate. Firms are using AI for research, client and investor communications, marketing, due diligence and back-office functions. As adoption grows, so does regulatory attention, and firms that haven’t formalized how they govern AI use are increasingly exposed.

AI Governance Sits on Top of Existing Rules

There is no standalone SEC rule written specifically for AI. That does not mean AI use falls outside the SEC’s reach. Although a proposed rule on the use of predictive data analytics was withdrawn by the SEC last year, that has in many respects only heightened the SEC’s focus during examinations, with examination staff making AI-specific requests.  AI use is governed by the same framework firms already operate under, and that framework leaves little room to treat AI as a special case.

The Compliance Rule. Rule 206(4)-7 requires written policies and procedures reasonably designed to prevent violations of the Advisers Act, and AI use needs to be reflected in that program, with defined approval steps, ownership, and oversight.

The Marketing Rule and anti-fraud provisions. Rule 206(4)-1 prohibits false or misleading statements and claims in advertisements, so the manner in which AI is used to generate advertisements must be done so prudently, and any description of how a firm uses AI in a pitch deck, on a website, in the Form ADV, or in a social post, needs to be accurate and substantiated.

Regulation S-P. AI tools that touch client and investor data, account information, or PII should be mapped against a firm’s existing WISP and incident response plan rather than governed under a separate framework.

Fiduciary duty. Using AI does not change an adviser’s fiduciary obligations, and any AI generated or AI assisted investment recommendation, allocation, or forecast still needs to serve the client’s best interest, and be documented accordingly. 

Record Retention. Rule 204-2 (the “Books and Records Rule”) requires advisers to retain and keep accurate most books and records related to the firm’s advisory business, including many AI generated documents.  Additionally, there may be AI platforms now used that could be deemed the primary depository for such records, elevating that platform to a higher regulatory standard.

The SEC’s Division of Examinations has also identified AI oversight as an area of focus in its published examination priorities, signaling that exam staff will be looking at whether firms have adequate policies and procedures governing AI use, and how firms ensure their adherence to these policies and procedures, not waiting for a dedicated AI rule to do so.

Where Cybersecurity and AI Governance Intersect

For firms building out an AI governance program, cybersecurity can’t be treated as a separate workstream. A few areas deserve particular attention:

Vendor and third-party oversight. Every AI tool a firm adopts, whether it’s a research assistant, a chatbot, or an internal drafting tool, is a new data touchpoint and a new vendor relationship. That means due diligence on how the vendor handles data, where it’s processed and stored, and what its own security posture looks like, feeds directly into a firm’s existing outsourcing and critical vendor review processes.

Data protection under Reg S-P. AI tools that ingest client or investor data, PII, or account information raise the same questions Reg S-P already asks: what data is going in, who can access it, how long it’s retained, and what happens if there’s an unauthorized disclosure. Firms should map their AI tools against their existing WISP and incident response plans rather than building a parallel framework.

AI as an attacker capability, not just a firm tool. AI cuts both ways. The same capabilities that make AI useful for a firm’s operations can also lower the cost and raise the sophistication of attacks a firm might face, from social engineering to automated vulnerability discovery. Governance programs increasingly need to account for AI enabled threats, not just AI enabled tools.

Human oversight as a control, not a courtesy. A recurring theme across the compliance and cybersecurity frameworks that already apply to firms is that a person needs to be reviewing and validating AI output before it reaches a client or investor, a filing, or a decision point. That oversight needs to be documented, not just practiced.

Building a Defensible Program

A workable AI governance program, whatever a firm’s size, tends to include the same core building blocks:

• An AI inventory covering every tool in use, who owns it, and for what it’s used.
• Written policies and procedures defining acceptable use, prohibited use cases, and required human review points.
• Consistent with the controls laid out in the written policies and procedures, ongoing monitoring of the firm’s use of AI platforms to protect against unauthorized “shadow AI” use.
• Testing and validation of AI outputs, particularly for anything client or investor facing or investment related.
• Vendor due diligence that treats AI providers like any other critical technology vendor, with documented review of their data handling and security practices.
• Periodic training so employees understand both the firm’s policy and the underlying risks, including unauthorized “shadow AI” use.
• An audit trail that ties AI use back to existing compliance and cybersecurity documentation, so a governance program isn’t a standalone binder but an extension of what a firm already has in place.

Writing the policy is the easy part. The harder part is keeping an AI inventory current, monitoring usage across a firm, and producing evidence of human review on demand, especially for firms without a dedicated technology team. This is where a platform layer earns its place alongside the advisory work.

Silver’s AI Governance Program, powered by Clarier, is built for exactly this gap. Clarier’s platform gives firms the tooling to inventory approved AI use, monitor usage against policy, and maintain the documentation examiners ask for, while Silver provides the regulatory advisory layer, translating exam priorities, rule requirements and AI best practices into a governance framework calibrated to the firm’s specific business. The combination gives firms a program that is both operational day to day and defensible when an examiner or an investor asks how AI is being overseen.