The SEC is actively enforcing AI disclosure accuracy and examining AI compliance policies. The Investor Advisory Committee's 3-pillar framework, combined with the Cyber and Emerging Technologies Unit's enforcement actions, creates a clear evidence obligation -- mapped to 10 SWT3 witness procedures.
Who this is for: Chief Risk Officers, Chief Compliance Officers, model risk management teams at broker-dealers and RIAs, fintech legal counsel, public company disclosure committees, internal audit teams examining AI use, and compliance engineers building AI governance infrastructure.
ACTIVE ENFORCEMENT: The SEC has already penalized advisors $400,000 combined for overstating AI capabilities in marketing materials. The Division of Examinations has made AI compliance policies and investor disclosures an active examination priority for 2026. The Cyber and Emerging Technologies Unit is investigating AI-driven market manipulation and algorithmic trading failures. This is not a future risk -- it is a current enforcement priority.
CRITICAL ASSESSOR NOTICE: SWT3 witness anchors record that a governance event occurred and capture its computational factors. They do not replace assessor judgment. The assessor must independently verify that the substance of each disclosure meets SEC requirements. Anchors provide the evidence trail -- the assessor determines whether that evidence is sufficient.
| Field | Detail |
|---|---|
| Framework | SEC Investor Advisory Committee (IAC) AI Disclosure Recommendations |
| Status | No dedicated AI disclosure rule; existing framework (10-K, 10-Q, 8-K) applies to material AI use |
| Enforcement Unit | Cyber and Emerging Technologies Unit (Division of Enforcement, est. February 2025) |
| Exam Priority | AI compliance policies and investor disclosures -- 2026 Division of Examinations priority |
| Penalty Precedent | $400,000 combined penalties for overstating AI use (advisory firms) |
| IAC Pillar 1 | Define AI using NIST or National AI Initiative Act standards |
| IAC Pillar 2 | Disclose whether board committee holds explicit AI deployment oversight |
| IAC Pillar 3 | Report AI material effects on operations (workforce, reporting, cybersecurity) and consumer-facing products |
| SR 11-7 Connection | Model risk management requirements apply to AI models used in financial decisions |
| SWT3 Procedures | 10 procedures mapped across 8 namespaces |
Public companies and regulated entities should define "artificial intelligence" in their disclosures using NIST or National AI Initiative Act standards rather than marketing language. This prevents the "AI washing" that triggered the first enforcement actions -- firms claiming AI capabilities they did not actually possess.
Companies should disclose whether a board committee holds explicit oversight of AI deployment. This is analogous to cybersecurity oversight disclosures under the SEC's 2023 cybersecurity rules. The question is binary: does the board have AI oversight, or does it not? If it does, what is the committee structure?
Companies should separately report AI's material effects on:
The SEC's enforcement posture on AI is clear and active:
| SEC Obligation | Source | Procedure | Description |
|---|---|---|---|
| AI use disclosure (NIST-aligned) | IAC Pillar 1 | AI-TRANS.1 | Transparency disclosure witnessing |
| Board AI oversight | IAC Pillar 2 | AI-GOV.1 | Governance event witnessing |
| Material effects on operations | IAC Pillar 3(a) | AI-IMPACT.1 | Impact assessment witnessing |
| Consumer-facing AI products | IAC Pillar 3(b) | AI-EXPL.1 | Explainability witnessing |
| AI use claim accuracy | Enforcement | AI-FAIR.1 | Accuracy and fairness witnessing |
| Model risk documentation | Exam Priority | AI-MDL.5 | Model weights/versioning witnessing |
| Model drift monitoring | Exam Priority | AI-DRIFT.1 | Drift detection witnessing |
| AI audit trail | Exam Priority | AI-AUDIT.1 | Audit integrity witnessing |
| Performance measurement | IAC Pillar 3(c) | AI-PERF.1 | Performance metric witnessing |
| Data governance | Exam Priority | AI-DATA.1 | Data provenance witnessing |
SEC requires: If AI use or risk is material to the business or financials, it must be disclosed under existing frameworks (10-K, 10-Q, proxy statements). The IAC recommends using NIST or National AI Initiative Act definitions rather than marketing language. Overstating AI capabilities is already an enforcement priority.
How SWT3 addresses it: witnessTransparency() mints an anchor recording the AI system classification, capability scope, and deployment status. The anchor provides a verifiable record of what the AI system actually does -- a factual baseline that disclosure committees can reference when drafting SEC filings. Any gap between the disclosure language and the anchor evidence would indicate potential disclosure risk.
Cross-reference AI-TRANS.1 anchors with the company's 10-K AI disclosures. The anchor evidence should support (not contradict) the disclosure claims. If the company claims "AI-powered" capabilities, verify that corresponding witness anchors demonstrate actual AI system activity.
SEC requires: The IAC recommends disclosing whether a board committee holds explicit AI deployment oversight. This parallels the cybersecurity oversight disclosure framework. Active board engagement with AI risk is increasingly expected by institutional investors and examiners.
How SWT3 addresses it: witnessGovernance() mints an anchor recording board and committee-level AI governance activity -- oversight meetings, risk reviews, policy approvals, and deployment decisions. The anchor chain proves that board oversight is active and substantive, not merely a checkbox disclosure.
For firms disclosing board AI oversight, verify that AI-GOV.1 anchors demonstrate recurring board engagement (quarterly minimum). A single annual mention does not constitute meaningful oversight. For firms that do not disclose board AI oversight, the absence of governance anchors is consistent -- but should be flagged if the firm's AI use is material.
SEC requires: AI marketing claims must accurately reflect actual capabilities. The SEC has already penalized firms for "AI washing" -- claiming AI capabilities that did not exist. This applies to client-facing materials, RFP responses, prospectuses, and any communications that could influence investment decisions.
How SWT3 addresses it: witnessBiasDetection() and related accuracy methods mint anchors recording actual AI system behavior, performance metrics, and capability boundaries. These anchors create an evidence baseline that marketing teams can reference to ensure claims are supportable. Factor A captures the specific capability tested. Factor B records whether performance meets the claimed threshold.
Compare marketing materials against AI-FAIR.1 anchor evidence. If marketing claims "99% accuracy," verify that anchor performance data supports that claim. Any material gap between claims and evidence is a potential AI washing finding.
SEC requires: Models used in financial decisions must be monitored for performance degradation. Under SR 11-7, model risk management includes ongoing validation and performance monitoring. SEC examiners are now extending this expectation to AI models used in advisory, trading, and compliance functions.
How SWT3 addresses it: witnessDrift() mints an anchor recording drift detection events -- data drift, concept drift, performance degradation -- with severity and remediation actions. The anchor chain provides continuous evidence of model monitoring, which is exactly what SEC examiners look for when evaluating whether AI policies are "implemented and enforced."
For firms using AI in financial decisions, verify that AI-DRIFT.1 anchors show continuous monitoring (not periodic spot checks). Cross-reference with SR 11-7 model validation schedules. Any period without drift monitoring anchors may indicate a gap in model risk management.
SEC AI disclosure requirements intersect heavily with Federal Reserve SR 11-7 model risk management guidance. For financial institutions subject to both SEC and Fed oversight:
For a detailed SR 11-7 mapping, see the SR 11-7 Model Risk Overlay Guide and the Treasury FS AI Risk Management Framework (230 Control Objectives).