The SEC's FY2027 examination priorities do not create a new AI rule. They put existing obligations next to the places AI now works: investment analysis, customer management, code development, and the systems an RIA inherits when it buys another firm.
For a CCO or COO, the useful question is not whether the firm bought an approved chatbot. It is whether the compliance program follows client information and business activity into every AI-enabled workflow.
Quick Answer
SEC 2027 exam priorities identify AI-related technology risks, customer-information safeguards, and compliance programs at growing or geographically dispersed advisers as examination focus areas. RIA leaders should inventory AI use across CRM, vendors, personal accounts, development tools, and acquired offices, then map each workflow to applicable controls. Vantage Point helps implement the CRM permissions, integration lineage, and migration processes needed to make that oversight practical. This is operational guidance, not legal advice.
Key Takeaways (TL;DR)
- The source: the SEC announced its FY2027 priorities on October 23, 2026; the report is a staff statement, not a new rule.
- The AI issue: existing, technology-neutral obligations still apply when firms use AI in business processes.
- The acquisition issue: growth and dispersed branches can leave different tools, permissions, and records under one compliance policy.
- The next step: trace one workflow from source data through AI output, review, retention, and incident response before expanding access.
Status as of October 26, 2026. Based on the SEC's FY2027 report and the sources below; confirm your firm's applicable requirements with counsel.
What do the SEC 2027 exam priorities actually say?
The SEC's October 23 announcement links the fiscal-year 2027 report. Its disclaimer says the staff statement has no legal force or effect and creates no new or additional obligations.
The report uses the term “super intelligence (SI)”. Its leadership message describes generative tools supporting research, drafting, coding, client communications, portfolio management, and compliance monitoring. It says the Division is examining whether firms continue to meet existing, technology-neutral obligations as these tools become embedded in daily work.
Section VII.A.2 names investment analysis, customer management, and code development. It addresses preparation for AI-enabled phishing and deepfake social engineering, monitoring policies, and consistency between operations, controls, and disclosures. These are not reasons to ban useful AI. They are reasons to connect approval to a defined use, data scope, accountable owner, and review process.
Section I.B separately prioritizes advisers that have grown through mergers or acquisitions or operate across geographically dispersed branches. Staff will assess whether compliance programs have adapted to those changes and related conflicts. Connecting that language to inherited CRM and AI workflows is an implementation recommendation—not a separate SEC acquisition-lineage mandate.
Where should an RIA look for unapproved AI?
Start with five inspection points. This is a practical inventory derived from the report and attributed industry commentary, not a five-part checklist published by the SEC. A tool is not automatically unapproved because it appears here; compare actual use with the firm's approved scope.
| Inspection point | What to investigate | Evidence to request |
|---|---|---|
| Vendor software | AI added to an already approved product after the original review. | Feature changes, data destinations, subcontractors, and current settings. |
| Personal AI accounts | Business information entered outside centrally managed accounts. | Employee attestations, approved-use boundaries, and escalation procedures. |
| CRM and connected workflows | Summaries, drafted replies, recommendations, or agents accessing client records. | Permissions, connector scopes, approval gates, and retrievable outputs. |
| Development and automation | Coding assistants or scripts accessing exports, credentials, or production systems. | Repository access, test-data handling, code review, and deployment approval. |
| Acquisitions and branches | Inherited AI subscriptions, local workflows, and legacy CRM integrations. | System inventory, migration mappings, local exceptions, and accountable owners. |
The distinction between sources matters. In WealthManagement's October 23 report, syndicated by Yahoo Finance, Lori Weston, head of compliance at STP Investment Services, recommends ongoing review of third-party software and employees' personal AI accounts used for business. Those personal-account observations are Weston's commentary, not a quoted requirement in the SEC priorities.
Vendor approval alone is therefore a weak inventory boundary. Record the product, the feature, the account type, the workflow, and the information it can access. Salesforce and HubSpot configurations both need that review; platform choice does not determine whether an activity is permissible.
What should acquisition lineage make visible?
Acquisition lineage is the traceable history of where data came from, how it changed, and which controls governed it. In an RIA roll-up, a household record may combine notes from one legacy CRM, account information from another system, and an AI-generated summary created after closing.
A consolidated dashboard does not establish that the underlying permissions, source history, or retention treatment are consistent. Preserve source-system identifiers, migration batch references, relationship mappings, and exceptions. Keep the original material needed under applicable obligations, rather than treating an AI summary as a substitute.
For one anonymized multi-acquisition RIA, Vantage Point supported growth from $1B to $14B+ across 17+ acquisitions using a six-phase migration protocol for each legacy CRM. The approved client result was 30% faster onboarding. That is an operational migration result—not evidence of SEC approval, a guaranteed examination outcome, or a measured AI-compliance improvement.
The implementation lesson is repeatability. A new acquisition should enter a defined intake and reconciliation process, with local tools identified before they become invisible dependencies.
How does Regulation S-P affect this review?
The FY2027 report says staff will assess customer-information safeguards and incident-response policies, including customer notification and service-provider oversight. An AI connector that handles customer information belongs in that operational review, alongside the systems it connects.
The SEC's Regulation S-P compliance guide lists tiered compliance dates for the 2024 amendments. For SEC-registered investment advisers, the adopting release, section II.F, classifies advisers with $1.5 billion or more in AUM as larger entities for this transition.
- Larger covered entities: December 3, 2025.
- Smaller covered entities: June 3, 2026.
Those dates precede this article's status date. They are the dates for these amendments, not a claim that every regulatory deadline has passed. Other covered institution types have their own size definitions; do not apply the adviser AUM threshold to a broker-dealer or transfer agent.
Test whether the incident process can identify which customer information a vendor or connector handled, who investigates unauthorized access, and how notification decisions are documented. Do not reduce the rule to a universal notification timer: triggers, exceptions, and permitted delays matter.
What should a CCO and COO do next?
- Choose one business workflow. Start with a client-meeting summary, service request, or communication draft—not a firmwide AI transformation.
- Map the actual route. Identify source systems, user or service identities, vendor processing, human review, and downstream CRM changes.
- Assign controls by activity. Determine applicable privacy, supervision, disclosure, and recordkeeping obligations with compliance and counsel.
- Test retrieval and response. Retrieve a completed example and investigate a simulated unauthorized-access scenario. Record gaps and owners.
- Repeat at each acquisition. Make inherited AI tools and local branch exceptions part of integration intake, then track remediation.
Not every AI interaction automatically becomes a required record. The activity and content determine the applicable obligations. An inventory should support that analysis without indiscriminately copying sensitive prompts into another uncontrolled repository. For Salesforce-specific archive and retrieval design, see the RIA Salesforce recordkeeping guide.
How Vantage Point Helps
Vantage Point connects compliance requirements to working CRM controls through compliance and security solutions and system integration and data migration. That work can include access design, legacy-source mappings, exception workflows, and evidence-retrieval tests across Salesforce, HubSpot, and connected systems.
Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver. Legal interpretations remain with the firm's compliance leaders and counsel; the implementation work makes approved requirements executable.
Trace one AI workflow before expanding access
Bring a CRM workflow or an acquisition-integration backlog. Vantage Point can help identify the data path, accountable owners, and implementation gaps.
Frequently Asked Questions
Do the SEC 2027 exam priorities create a new AI rule?
No. The report expressly states that it is a staff statement with no legal force or effect and creates no new obligations. It describes examination focus under applicable existing requirements.
Does the SEC report use the term super intelligence?
Yes. The FY2027 report uses “super intelligence (SI)” and discusses uses including investment analysis, customer management, and code development. This article uses AI as a practical shorthand without asserting a new regulatory classification.
Must every employee AI prompt be retained?
No blanket retention requirement for every AI prompt follows from this priorities report. Firms should assess the activity, content, and applicable recordkeeping rules, then configure capture and retrieval accordingly.
Why do acquisitions matter to examination readiness?
The report prioritizes advisers that have grown through mergers or acquisitions and those with dispersed branches. A practical response is to document inherited systems, permissions, source data, and exceptions so the compliance program reflects actual operations.
What are the Regulation S-P amendment compliance dates?
The SEC guide gives December 3, 2025 for larger covered entities and June 3, 2026 for smaller ones. For SEC-registered advisers, the adopting release uses $1.5 billion in AUM as the larger-entity threshold; other entity types have different definitions.
Can Vantage Point certify that an RIA will pass an exam?
No. Vantage Point helps implement CRM permissions, integrations, migration controls, and evidence workflows. Compliance accountability and legal interpretation remain with the RIA and its advisers.
Sources
- SEC FY2027 Examination Priorities: disclaimer, leadership message, section I.B, and sections VII.A.2–3.
- SEC October 23, 2026 announcement; WealthManagement reporting via Yahoo Finance; Regulation S-P compliance guide and adopting release, linked above.
About Vantage Point: a boutique, senior-led Salesforce and HubSpot consulting partner helping teams connect CRM operations, data, and governance.
