AI is in nearly every 2026 SEC exam. The question is whether you have a file.

On November 17, 2025, the SEC's Division of Examinations released its fiscal year 2026 examination priorities, the first under Chairman Paul Atkins. The perennial themes are all present: fiduciary duty, compliance program effectiveness, custody, never-examined advisers. What changed is where artificial intelligence sits in the document. It is no longer a single line item. As Goodwin's analysis put it, the Division integrated AI into multiple priority categories, signaling that AI oversight will be a component of virtually all examinations.

Two threads in the priorities matter most for a mid-sized RIA. First, examiners will assess whether firms have adequate policies and procedures to monitor and supervise their use of AI technologies. Second, and less discussed, examiners will review registrant representations about AI for accuracy. The Division is not only asking whether you use AI responsibly. It is asking whether what is said about your capabilities matches reality, and whether you can substantiate it.

The gap in most firms' answer

Most compliance programs can now produce an AI policy. Fewer can produce evidence. And the oversight question has a dimension most policies never mention: AI is not only a tool your firm might use internally. It is a channel that describes your firm externally, to prospects, clients, and anyone who asks, in words your firm never wrote and cannot see. When a consumer AI platform states your fee schedule, your custody arrangement, or your disciplinary history, that is a representation about your firm circulating in the market. If it is wrong, your existing obligations, not new ones, are what make it a problem: the Marketing Rule's substantiation requirement and the fiduciary standards the Division continues to prioritize were written long before any chatbot.

What a defensible oversight file contains

A dated statement of your official facts. The foundation of any oversight program is knowing what the correct answer is. A signed declaration of your registration, fees, custody, minimums, and disciplinary history, anchored with independent third-party timestamps, turns "what we say about ourselves" from scattered web copy into a versioned record with effective dates.

A capture log for the AI channel. Asking the major platforms the questions prospects actually ask, on a schedule, and preserving every response verbatim with the platform, model, and date, is what makes oversight demonstrable rather than asserted. Most captures will match. The ones that do not become dated findings.

A documented response trail. No firm controls what an AI platform says. What a firm controls is whether discrepancies were found, logged, and followed up. A documented review request, with the signed declaration attached and the outcome recorded, is the difference between exposure and diligence when the oversight question comes.

The 2026 priorities describe a Division extending existing expectations to technology that did not exist when those expectations were written. Firms that treat the AI question as a policy-drafting exercise will have a paragraph. Firms that treat it as a records question will have a file. Only one of those ends the conversation.