Key Takeaways
- SEC Division of Enforcement Director David Woodcock said that AI-related fraud often takes a familiar form, including false claims about the use or profitability of a new technology. He added that the agency will assess whether public companies are accurately disclosing material AI-related information and that “enforcement will be present” when such disclosures fall short.
- Beyond public companies, Woodcock also noted that AI has “lowered the cost of committing fraud” and enabled more realistic, targeted scams, particularly through social media and cryptocurrency markets.
- The Division of Examinations will assess whether registrants, such as broker-dealers, registered investment advisers and others, use AI in a manner consistent with their obligations under the federal securities laws, their fiduciary duties and their public disclosures.
- The SEC communicated that exams will assess AI-related cybersecurity risks, including how firms prepare for AI-generated phishing, deepfake impersonation and synthetic voice and video used for social engineering.
- Documents produced during an examination, including deficiency letters and remediation commitments, may later surface in enforcement actions or private litigation.
The SEC recently said that it is taking a broad approach across the agency to closely track how AI may be contributing to violations of federal securities laws and regulations, intensifying its focus on how publicly traded companies and SEC registrants disclose and govern their use of AI. Since Oct. 23, 2026, the SEC’s Division of Enforcement communicated that it is actively monitoring corporate AI disclosures for accuracy, the Division of Examinations released its fiscal year 2027 examination priorities with a heightened emphasis on AI and cybersecurity at SEC-registered investment advisers and broker-dealers, and agency leadership publicly warned that enforcement action will follow when companies fail to give investors the full picture. These developments do not create new legal obligations, but they offer a timely signal that AI use and related claims carry risks the SEC is actively scrutinizing — and companies that treat AI disclosures and governance as afterthoughts face growing enforcement and litigation risk.
SEC Enforcement Is Monitoring AI Disclosures in Real Time
In an interview published by Reuters on Oct. 30, 2026, SEC Division of Enforcement Director Woodcock emphasized that AI disclosure accuracy is squarely on the agency’s radar. Woodcock stated that the agency’s “principal concern is that people are making accurate disclosures about material information so that investors know what they’re getting into,” and that “[e]nforcement is a very necessary piece of making sure people are doing that.” When disclosure falls short, Woodcock warned, “enforcement will be present.”
This scrutiny comes amid growing investor unease over AI infrastructure spending, rising interest rates and concerns about the sustainability of AI investment. Big Tech stocks sold off recently as companies disclosed that they are burning through cash to fuel AI expansion, raising questions about potential circular financing and revenue arrangements between AI startups, cloud computing companies, chip manufacturers, and AI infrastructure firms and the possibility of an AI “bubble.” The SEC’s enforcement posture indicates that companies overstating AI capabilities — or understating the material risks and costs associated with their AI strategies — face potential liability under existing securities fraud frameworks.
Woodcock also highlighted two specific categories of AI-related fraud the Division is monitoring: schemes that use AI to create more convincing social media investment scams, and cases where companies fail to properly disclose their use of AI in fundamental parts of their business. He noted that the agency has already brought cases in which private companies “overstated their capabilities both with respect to robotics and to artificial intelligence.” In his view, while AI is new, companies overstating the effectiveness or profitability of a tool or technology is a familiar fraud. He predicted that “we will continue to see those kinds of investigations and cases because it’s so pervasive.” The DOJ and FTC also expressed similar sentiments, each pursuing companies and executives that overstate what AI can deliver.[1]
The 2027 Examination Priorities: AI and Cybersecurity in the Spotlight
On Oct. 23, 2026, the SEC’s Division of Examinations released its fiscal year 2027 examination priorities, which place a heightened focus on artificial intelligence and cybersecurity risks. As SEC Chairman Paul Atkins stated, “[e]xaminations provide critical insight into emerging risks, evolving business practices, and market developments across our financial system.”
AI Disclosure and Governance
The Division will assess whether firms’ use of AI aligns with their public disclosures — specifically, whether “(1) representations are fair and accurate; (2) operations and controls are consistent with disclosures made to investors; and (3) algorithms lead to advice or recommendations consistent with investors’ investment profiles or stated strategies.”[2] Disclosures about AI — whether in Form ADV brochures, marketing materials or client communications — must match how automated tools actually operate.
Cybersecurity and AI-Enabled Threats
Cybersecurity remains a critical area of risk, but the emphasis on AI-enabled cyberthreats is new. Examiners will review how firms prepare for AI-generated phishing messages and synthetic voice and video used for social engineering.[3] The Division will also review how firms supervise their own use of AI in fraud detection and will assess risks from third-party service providers and shared technologies.[4]
What This Means for Companies Using AI
These public statements send a clear signal that while the SEC has not adopted new AI-specific rules, it is prioritizing scrutiny of AI-related conduct using existing frameworks. As Woodcock emphasized, AI-related enforcement cases are “really just fraud cases for the most part.” The SEC is applying existing disclosure, fraud, compliance and supervisory rules to AI with increasing vigor.
For public companies, the enforcement signals are particularly important. Companies should carefully review forward-looking statements about AI capabilities, AI-driven revenue or AI integration into core business functions and ensure those statements are accurate, substantiated and updated as circumstances change. Private litigation is already emerging in this space, with investors alleging that companies overstated AI capabilities or failed to disclose material AI-related risks.
For registered investment advisers, broker-dealers and other SEC registrants, the examination priorities make clear that the Division of Examinations will be testing whether AI disclosures match actual practice and that cybersecurity programs must account for AI-enabled threats, among other AI-related topics.
Practical Steps
- The SEC said that it will treat AI-related fraud like other types of disclosure violations, which means it is likely to scrutinize not only SEC filings, press releases, earnings call transcripts, Form ADV brochures and investor presentations, but also potentially less formal communications, including marketing materials and website content. Documenting the support for material AI-related claims before they are made can make any future regulatory questions easier to resolve.
- For registrants, experts recommend identifying where AI and automated tools are being used, including within vendor products, and adopting or updating written policies covering supervision, testing and data retention.
- The SEC indicated that regulation best interest and suitability considerations do not vary based on technology, which registrants should consider as their use of AI in making investment recommendations evolves.
- The Division of Examinations was explicit that registrants should expect questions regarding their compliance with rules relating to preparations for AI-related cybersecurity threats, including AI-generated “phishing messaging and synthetic or deepfake voice and video used for social engineering.” Updating compliance documentation to reflect AI-related cyber threat policies and procedures now can reduce the chances of a more difficult exam in the future.
The SEC’s recent statements and examination priorities underscore a clear message: The agency is applying existing enforcement tools to AI with increasing focus and sophistication. Companies face enforcement risk and examination scrutiny under existing regulations. Firms that can demonstrate accurate disclosures, disciplined recordkeeping and reasonable controls that keep pace with AI-enabled threats will be best positioned — not only in the examination context, but also in any enforcement action or lawsuit that follows. The organizations that invest now in AI governance, disclosure accuracy and cybersecurity preparedness will be far better positioned than those that treat these AI competencies as aspirational.
For questions about this alert or for assistance developing or updating policies and procedures with respect to specific AI disclosures, controls and related issues, contact the authors or your McGuireWoods contact.
[1] For example, the U.S. Attorney’s Office for the Eastern District of New York recently announced fraud charges against the former executives of a technology company that pitched itself as a way to “revolutionize training and education through AI,” alleging that the “defendants exploited investor excitement over the AI boom and presented a rosy financial outlook to investors and lenders that was built on lies.” Press Release, U.S. Att’y’s Off., E.D.N.Y., Former Chief Executive Officer and Chief Financial Officer of Nasdaq-Listed Company Charged With Operating a Continuing Financial Crimes Enterprise in Multi-Year Scheme to Defraud Investors and Lenders (Apr. 17, 2026). Similarly, the FTC “has already brought a number of recent enforcement actions to combat deceptive claims in connection with AI-powered scams, as well as material misrepresentations about the performance, efficacy, and characteristics of AI products.” Fed. Trade Comm’n, Proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems at 5 (July 1, 2026).
[2] SEC Division of Examinations, 2027 Examination Priorities at 12 (Nov. 17, 2025)
[3] Id.
[4] Id.