An AI exam priority is a prompt to assemble evidence, not a finding

What the priority says

The US Securities and Exchange Commission published its fiscal-year 2027 examination priorities on 23 October. The Division of Examinations says the programme covers more than 34,000 registrants. Emerging technologies and super intelligence appear in a list of issues that can affect operations, compliance, fraud prevention and investor protection, alongside operational resilience and cybersecurity.

The wording is a planning signal, not a verdict. The SEC says the priorities are not exhaustive and may change. Reuters explains that examinations can identify deficiencies or lead to referrals, but the priority document itself does not allege a violation. It also does not create a new rule merely by naming AI.

The proportionate response

A regulated firm does not need to translate this signal into a speculative compliance programme. It does need to be able to show how material AI uses connect to existing obligations and representations. A compact evidence pack can do that. For each use, it should record the business purpose, customer or investor claim, model and data owner, change history, approval basis, access boundary, testing method, monitoring result, incident route and current limitations.

The pack should be versioned because the relevant question may concern what the firm knew at a particular time. A screenshot of a current dashboard cannot reconstruct an earlier control state. Evidence should point to durable artefacts: model inventories, test results, committee decisions, vendor terms, data-lineage records, alerts and remediation tickets. The owner should be able to trace any public claim about speed, accuracy or protection to the test and population that support it.

Boundaries and failure modes

The priority language is broad, and its term super intelligence does not define a separate examination standard in the release. Teams should not invent requirements or assume that every experimental assistant is equally material. A triage layer should consider decision impact, customer exposure, ability to move money or records, use of sensitive data and the reversibility of errors.

Evidence assembly can also become theatre. A large folder is not useful if controls exist only on paper, test populations exclude the relevant users or incident records are split across teams. Sampling should therefore begin from a claim or transaction and follow it through the real system. Where a vendor provides the model, the firm still needs enough evidence to govern its own use and escalation path.

The pack also needs a negative-evidence section. It should say which requested facts are unavailable, which vendor assurances cannot be independently tested and which monitoring windows are too short to support a trend. Recording absence prevents reviewers from mistaking a polished inventory for complete assurance. It also gives procurement and engineering teams a prioritised list of evidence gaps rather than an undefined request to improve governance.

Finally, retrieval should be exercised under realistic conditions. A central compliance team may know that an artefact exists while the accountable product owner cannot find the approved version. Tabletop sampling across compliance, security, data, product and vendor management tests the handoffs. The output is not only a folder; it is a measured time-to-evidence and a list of broken ownership links. Repeat the exercise after a material model or policy change to confirm that the evidence trail follows the deployed version.

Decision rule

Before the next examination request, select the ten most material AI uses and attempt a two-hour evidence retrieval for each. If the owner cannot produce the claim basis, control history, latest test and incident route within that window, create a remediation item with a date. This is a readiness exercise, not an admission of breach. It extends the earlier financial AI ownership matrix by testing whether named ownership produces retrievable evidence.