A new DeepVest framework turns two federal AI directives into nine questions every RIA should ask vendors now.
Regulators sharpen their focus The timing is not incidental. On October 23, 2026, the SEC's Division of Examinations released its examination priorities for fiscal year 2027, with one priority involving an assessment of whether firms' use of AI is consistent with their obligations under federal securities laws and their existing fiduciary duty, compliance and supervisory frameworks. The document stops short of creating new rules, but it signals where examiners will be looking. According to the 2026 Investment Management Compliance Testing Survey, AI has emerged as the top compliance priority for SEC-registered investment adviser firms - a 28-percentage-point increase from 2025, and the most dominant single response in the survey's 21-year history. Approximately 72% of firms reported increasing their compliance testing around AI, the single largest year-over-year increase of any topic tracked. DeepVest argues that adoption has outpaced accountability. In a fiduciary business, an AI tool's output can flow directly into client advice - and if no one has verified that output for accuracy or consistency, the firm has no defensible answer when an examiner asks how the tool is supervised. A nine-question benchmark The white paper organizes its benchmark around three headings. Under "explain it," advisors are asked whether a tool can account for its recommendations, whether the vendor has published a written description of the methodology, and whether the tool distinguishes between what it knows, what it infers, and what it is guessing. Under "verify it," the questions turn to consistency: does the tool return the same answer to the same question across sessions, does its accuracy hold across different client types and market conditions, and is the error rate disclosed anywhere? Under "supervise it," the focus shifts to governance: does the vendor confirm in writing whether client data trains the model, is there an independent security audit such as a SOC 2 Type II or ISO 27001 certification, and does the platform maintain a complete, exportable audit trail? The framework also scales to risk. For meeting transcription - the lowest-risk use case - the paper recommends only moderate supervision controls. For client proposals and portfolio recommendations - the highest-risk category - it calls for the full three-part check on a regular schedule. General-purpose tools under scrutiny DeepVest's interest in the subject is not purely academic. The company's previous research found that general-purpose AI tools fell short on approximately 85% of real investment tasks - producing incorrect calculations, hallucinated data, or no usable results at all. A separate study found that several tools gave different answers to identical prompts from one session to the next. Compliance experts have noted that AI notetakers and similar tools "quietly create business records and client communications that are ripe for SEC scrutiny," according to Leila Shaver, founder of My RIA Lawyer. "The SEC has already come out and said anything you create with AI needs to be reviewed by a human being." "Advisors rushing to adopt general-purpose AI tools to save time are heading into a period of more focused examiner attention," said Toby Wade, CEO of DeepVest. "The SEC and Treasury have made it clear what they expect regarding AI risk management, but until now, busy fiduciaries lacked a simplified checklist for practical application. We built this benchmark to give advisors a clear view of the big-picture requirements so they can adopt AI confidently, based on evidence, rather than taking vendor marketing claims on faith." What firms should do now DeepVest recommends four immediate steps for advisory practices: catalog every AI tool in use - including those individual staff members adopted independently - sort each tool by how it is actually used in the practice, gather compliance evidence beginning with the highest-risk applications, and obtain vendor commitments on data handling, security protocols, and audit logging in writing. Legal experts reviewing the FY2027 priorities have echoed the message, advising firms to monitor and govern AI use across vendor products, adopt written supervision and data-retention policies, and align any AI disclosures with actual practice. As regulators and examiners increasingly use their own AI tools to identify inconsistencies in firm disclosures - a development the FY2027 priorities explicitly acknowledge - the asymmetry between sophisticated examiners and unprepared advisors may widen quickly. DeepVest's white paper is available. InvestmentNews has previously reported on the growing compliance risks posed by AI meeting notetakers and on how the RIA industry is weighing AI tool adoption more broadly. The publication has also explored why some firms are now retaining client records longer than the SEC's five-year minimum to support AI-driven compliance review.
Regulators sharpen their focus
The timing is not incidental. On October 23, 2026, the SEC's Division of Examinations released its examination priorities for fiscal year 2027, with one priority involving an assessment of whether firms' use of AI is consistent with their obligations under federal securities laws and their existing fiduciary duty, compliance and supervisory frameworks. The document stops short of creating new rules, but it signals where examiners will be looking. According to the 2026 Investment Management Compliance Testing Survey, AI has emerged as the top compliance priority for SEC-registered investment adviser firms - a 28-percentage-point increase from 2025, and the most dominant single response in the survey's 21-year history. Approximately 72% of firms reported increasing their compliance testing around AI, the single largest year-over-year increase of any topic tracked. DeepVest argues that adoption has outpaced accountability. In a fiduciary business, an AI tool's output can flow directly into client advice - and if no one has verified that output for accuracy or consistency, the firm has no defensible answer when an examiner asks how the tool is supervised.
A nine-question benchmark
The white paper organizes its benchmark around three headings. Under "explain it," advisors are asked whether a tool can account for its recommendations, whether the vendor has published a written description of the methodology, and whether the tool distinguishes between what it knows, what it infers, and what it is guessing. Under "verify it," the questions turn to consistency: does the tool return the same answer to the same question across sessions, does its accuracy hold across different client types and market conditions, and is the error rate disclosed anywhere? Under "supervise it," the focus shifts to governance: does the vendor confirm in writing whether client data trains the model, is there an independent security audit such as a SOC 2 Type II or ISO 27001 certification, and does the platform maintain a complete, exportable audit trail? The framework also scales to risk. For meeting transcription - the lowest-risk use case - the paper recommends only moderate supervision controls. For client proposals and portfolio recommendations - the highest-risk category - it calls for the full three-part check on a regular schedule.
General-purpose tools under scrutiny
DeepVest's interest in the subject is not purely academic. The company's previous research found that general-purpose AI tools fell short on approximately 85% of real investment tasks - producing incorrect calculations, hallucinated data, or no usable results at all. A separate study found that several tools gave different answers to identical prompts from one session to the next. Compliance experts have noted that AI notetakers and similar tools "quietly create business records and client communications that are ripe for SEC scrutiny," according to Leila Shaver, founder of My RIA Lawyer. "The SEC has already come out and said anything you create with AI needs to be reviewed by a human being." "Advisors rushing to adopt general-purpose AI tools to save time are heading into a period of more focused examiner attention," said Toby Wade, CEO of DeepVest. "The SEC and Treasury have made it clear what they expect regarding AI risk management, but until now, busy fiduciaries lacked a simplified checklist for practical application. We built this benchmark to give advisors a clear view of the big-picture requirements so they can adopt AI confidently, based on evidence, rather than taking vendor marketing claims on faith."
What firms should do now
DeepVest recommends four immediate steps for advisory practices: catalog every AI tool in use - including those individual staff members adopted independently - sort each tool by how it is actually used in the practice, gather compliance evidence beginning with the highest-risk applications, and obtain vendor commitments on data handling, security protocols, and audit logging in writing. Legal experts reviewing the FY2027 priorities have echoed the message, advising firms to monitor and govern AI use across vendor products, adopt written supervision and data-retention policies, and align any AI disclosures with actual practice. As regulators and examiners increasingly use their own AI tools to identify inconsistencies in firm disclosures - a development the FY2027 priorities explicitly acknowledge - the asymmetry between sophisticated examiners and unprepared advisors may widen quickly. DeepVest's white paper is available. InvestmentNews has previously reported on the growing compliance risks posed by AI meeting notetakers and on how the RIA industry is weighing AI tool adoption more broadly. The publication has also explored why some firms are now retaining client records longer than the SEC's five-year minimum to support AI-driven compliance review.
