{"article":{"slug":"sec-fy2027-examination-priorities","kind":"rule","source":{"title":"SEC Announces Fiscal Year 2027 Examination Priorities","url":"https://www.sec.gov/newsroom/press-releases/2026-109-sec-announces-fiscal-year-2027-examination-priorities","date":"2026-10-23"},"headline":"SEC examiners are told to look at AI phishing, deepfakes and customer-data safeguards","whatChanged":"On October 23 the SEC's Division of Examinations published its fiscal year 2027 examination priorities (press release 2026-109). The document is a staff statement. Its disclaimer says it is not a rule, has no legal force and creates no new obligations. The division covers more than 34,000 registrants. It uses the term \"super intelligence (SI)\" for the tools it describes and says registrants use \"generative SI tools to support research, drafting, coding, and client communications\" as well as advisory, portfolio management and compliance monitoring. It says it is intensifying its efforts to see whether firms comply with existing, technology-neutral obligations.\n\nExaminers will assess preparation for SI-related cyberattacks, such as SI-generated phishing and deepfake voice and video used for social engineering. They will prioritize policies for monitoring SI in fraud prevention, back-office operations, anti-money laundering, Regulation Best Interest compliance and trading. For automated investment tools they will ask whether representations are fair and accurate.\n\nUnder the SEC's customer-information safeguards rule, examiners will review incident response programs, including customer notification and oversight of service providers. Under its identity theft red-flags rule, they will check whether programs address risks tied to SI and stolen credentials. The division says the list is not exhaustive.","whyItMatters":"Examiners are told to look at how firms use AI and at how attackers use it. For a regulated firm, or a vendor to one, that is a concrete list: AI-written phishing, synthetic voice and video used for social engineering, and safeguards for customer information. The document creates no new duty.\n\nAny organization that holds customer data can use the same list. Find out which AI tools touch that data, who approved them, and whether staff know how to verify an unexpected request that arrives in a familiar voice.","issuer":"SEC Division of Examinations","glance":"SEC examiners' fiscal 2027 priorities, out October 23, cover AI use and AI-enabled attacks; the SEC's wording is \"super intelligence.\"","status":"guidance","action":"List every AI tool that touches customer data and who approved it.","attachments":[{"title":"Fiscal Year 2027 Examination Priorities","url":"https://www.sec.gov/files/2027-exam-priorities.pdf","description":"The full staff document: its no-legal-force disclaimer, the SI passages in the leadership message, the Emerging Financial Technology section, and the sections on customer information, identity theft and systems compliance.","source":{"title":"SEC Announces Fiscal Year 2027 Examination Priorities","url":"https://www.sec.gov/newsroom/press-releases/2026-109-sec-announces-fiscal-year-2027-examination-priorities","date":"2026-10-23"}}],"companyLabel":"Public edition"},"issue":{"id":"2026-10-26","publishedLabel":"Week of October 26, 2026","isLatest":true},"position":{"index":4,"total":4},"next":null,"session":null}