SEC adds AI and cyberattacks to 2027 exams

The SEC has added financial firms’ preparedness for AI-linked cyberattacks to its fiscal 2027 exam priorities, including AI-generated phishing and synthetic voice or video used in social engineering, according to an unconfirmed secondary source. The material also says reviews will look at controls for identity theft, fraudulent transfers, stolen credentials and other emerging risks.

What do these exam priorities cover?

The SEC’s fiscal 2027 exam priorities are not exhaustive and may change during the year in response to emerging risks, market events and investor concerns, according to Troutman Pepper’s analysis. The same analysis says this is not a new rule, a proposed regulation or an enforcement action.

Troutman Pepper adds that exams will focus on compliance with Regulation S-P and Regulation S-ID. In that context, the SEC will look at account takeover risks, fraudulent transfers, stolen credentials and emerging identity theft risks linked to AI.

What should examined firms be able to show?

Firms should be able to demonstrate an inventory of their AI uses, governance and monitoring controls, and incident response and identity theft prevention programs that account for AI-generated attacks and stolen credentials, according to Sidley’s analysis. The firm also places AI use in investment analysis, client management and code development under review.

Norton Rose Fulbright agrees that the SEC will evaluate policies and procedures tied to AI threats. Those include AI-generated phishing, social engineering through deepfake voice or video and ransomware, along with a broader scope for Regulation SCI.

What changes appear in Regulation SCI?

Regulation SCI will include emerging areas such as AI, securities tokenization, extended trading hours and quantum computing, according to Norton Rose Fulbright. The analysis places those topics within the SEC’s expanding focus on technology, cybersecurity and investor protection.

In parallel, material from Bethesda Magazine says Maryland’s law on AI and deepfake representations defines a deepfake representation as a photograph, film, video, audio recording, digital image or computer-generated image that is indistinguishable from a real, identifiable human being.

What did Norton Rose Fulbright say about data breaches and ransomware?

Norton Rose Fulbright included ransomware among the threats the SEC will assess in its exams, alongside AI-generated phishing, social engineering through deepfake voice or video and other cybersecurity risks. The central point is that the review is not limited to one attack technique, but expands to threats that can lead to data breaches and operational compromise.

The analysis places those risks within the SEC’s broader focus on technology, cybersecurity and investor protection. It also ties them to the fiscal 2027 exam priorities, which cover stolen credentials, fraudulent transfers, identity theft and controls against AI-assisted attacks.