SEC Division of Examinations priorities released October 23, 2026; fiscal 2027 began October 1, 2026
SEC Examiners Will Probe AI Cyberattack Readiness in Fiscal 2027, Alongside Private Fund Valuations
The Securities and Exchange Commission's Division of Examinations released its priorities for fiscal 2027, which began October 1, and examiners will step up scrutiny of private fund fees, expenses, and valuations while also examining how firms prepare for AI-related cyberattacks. AI has appeared in prior priority lists, but Bloomberg's reporting on this year's release says the agency went into further detail to reflect rapid technological change, including cybersecurity: examiners will focus on how AI-fueled attacks may affect firms and their customers, naming phishing messages and deepfake voice and video used for social engineering as examples. Reuters reports the same release also covers private assets and tokenized securities, as the administration moves to expand retail access to private markets. The priorities apply across investment advisers, broker-dealers, clearing agencies, and other registrants; examination staff can escalate findings to the enforcement division, the priorities added the Public Company Accounting Oversight Board as an examination target, and a new section describes coordination with the Commodity Futures Trading Commission on firms subject to both regulators.
Executives
An examination priority is a published agenda: firms now know the questions before the examiners arrive. The AI portion is not about whether you use AI. It is about whether you can show preparation for AI-enabled attacks against your firm and your clients, including deepfake impersonation of executives and advisers. Treat the release as the outline for your next board cyber briefing.
CIO / CISO
Build the examination file now: documented controls for AI-augmented phishing, a verification procedure for voice and video payment or instruction requests that does not rely on recognizing a familiar voice, client-facing warnings that match the tactics examiners named, and an AI inventory that shows where models are used in operations, compliance, and fraud prevention. Existing data protection and business continuity duties apply regardless of whether a rule mentions AI by name.
Engineers
Test the specific scenarios: deepfake audio approval attempts against finance and operations staff, AI-written phishing that references real client and fund details, and account recovery flows an automated agent could abuse at volume. Log and review authentication anomalies with those patterns in mind, and confirm out-of-band verification works when the request arrives through a normal channel.
Everyone (non-IT)
If you invest through an adviser or broker, expect more questions and more verification steps this year, including callbacks when instructions sound unusual. Regulators have told firms to prepare for faked voices and videos of people you trust, so a firm that slows down to verify is following the agenda, not being difficult.