The SEC's 2027 Exam Priorities and Super Intelligence: What Investment Advisers Should Have Ready

1. The Short Answer: A New Word, the Same Questions

The SEC's 2027 exam priorities, published by the Division of Examinations on October 23, 2026, use the term super intelligence (SI) where the rest of the industry says AI. The document never defines SI, and examiners will judge SI tools against the rules advisers already follow.

In practice, SI means AI. The document's examples are "generative SI tools" for research, drafting, coding and client communications, and its standard, on page 2, is "whether firms continue to comply with existing, technology-neutral obligations."

The word changed, and the questions did not get easier. Examiners will look at how your policies, disclosures, fraud controls and privacy programs cover the SI your people use. A firm that can't list those tools will struggle to answer.

This guide quotes the priorities with page numbers and labels WorkWise Solutions' recommendations. The guide is operational guidance; your counsel and your CCO own the interpretation.

Learn the new word in five minutes. Spend the next 60 days on the evidence.

2. Why the SEC Now Says Super Intelligence

The priorities don't say. They give no definition of SI, no footnote on the term and no reference to any executive order.

One other document sits beside them. On September 29, 2026, the President signed Executive Order 14434, "Inaugurating the Era of Super Intelligence," published on October 2, 2026 at 91 FR 63129.

• Section 2(a). Agencies "shall use" Super Intelligence and SI "in place of" Artificial Intelligence and AI "in official correspondence, public communications, websites, reports, policy documents, and other non-statutory documents within the executive branch."
• Section 2(b). The switch exempts "previously issued regulations, Presidential actions, contracts, grants, or other historical documents."
• Section 3(a). SI means "the technologies and systems encompassed by the term" artificial intelligence in the existing statutory definition, 15 U.S.C. 9401(3).

The priorities came out 24 days later, use SI throughout and never mention the order. The two facts sit side by side, and this guide draws no line between them.

The order is addressed to agencies and executive-branch documents. It says it does not "create any right or benefit," and it says nothing about private companies. The fair reading is that your firm is not required to change its own wording.

WorkWise Solutions' view: keep the word your clients and staff understand. If your policies say AI, add one sentence saying the term covers what SEC documents now call SI, so an examiner can match the two.

Nor does the new word bring a new rule. The SEC withdrew its 2023 predictive data analytics proposal on June 17, 2025: "The Commission does not intend to issue final rules with respect to these proposals." And the priorities present themselves as "the views of the staff of the Division of Examinations."

The SEC also uses the term for a roundtable on November 9, 2026 "to discuss the use of machine-understandable data and Super Intelligence (SI) and related risks and costs."

Read the priorities as a map of where examiners will look, written in new vocabulary.

3. What the Priorities Say About SI, Quoted

These are the passages an adviser needs, with the page numbers printed in the priorities.

• Uses (p. 2). "Registrants are increasingly incorporating super intelligence (SI) into their businesses." They "are using generative SI tools to support research, drafting, coding, and client communications, as well as advisory and portfolio management functions, and compliance monitoring and surveillance."
• Monitoring (p. 12). "The Division will also prioritize examinations of policies and procedures relating to monitoring SI, including its use in fraud prevention and detection, back-office operations, compliance with AML and Reg BI obligations, and trading functions."
• Threats (p. 12). "potential threats from SI-related cyberattacks that may affect their businesses or customers, such as SI-generated phishing messaging and synthetic or deepfake voice and video used for social engineering."
• Identity theft (p. 13). "Examiners will assess whether firms are updating their Identity Theft Prevention Program to address emerging risks, such as those related to SI and stolen credentials."
• Privacy (pp. 12 to 13). On Regulation S-P: "In accordance with the amended rule, staff will evaluate response program policies and procedures for unauthorized access to or use of customer information, including customer notification procedures and oversight of service providers."

A related paragraph on page 12 never uses the term. It covers "automated investment tools and trading algorithms or platforms," and examiners will review whether "(1) representations are fair and accurate; (2) operations and controls are consistent with disclosures made to investors". In WorkWise Solutions' reading, any SI tool that shapes advice or trading belongs under that test.

Then the gaps. The priorities say nothing SI-specific about vendors, supervision or recordkeeping, and page 5 warns that the listed areas "are not the only areas the Division will address in examinations." Silence on a topic is no promise examiners will skip it.

Where the document is silent, the page 2 standard still applies: existing obligations, applied to new tools.

4. Who Is in Scope

The SI passages speak of "registrants" and "firms". Among advisers, four groups should read them closely:

• Wealth managers and other RIAs. Regulation S-ID covers SEC-registered advisers with covered accounts, and page 13 asks whether identity theft programs now address SI.
• Private fund advisers. The press release lists "Private funds, private credit, and other complex investment strategies" as a key area, and page 6 lists private fund topics. Credit managers have their own guide to the 2027 priorities for private credit.
• Dual registrants. The page 12 monitoring sentence names AML and Reg BI obligations and trading functions, so a firm with a brokerage side reads it for both businesses.
• Advisers to registered funds. Page 7 covers RICs "holding complex products, less liquid or illiquid investments, including private credit".

If your firm is registered with the SEC and uses SI anywhere, plan as if every SI page applies to you.

5. What Examiners May Ask, and the Document That Answers It

The table follows the document's SI items. Where the priorities say nothing SI-specific, the middle column says so; the last column is WorkWise Solutions' recommendation.

Your firm already keeps some of these. The work is making each one name the SI tools in use, and dating it.

6. Representations About SI: Brochures, Websites, DDQs and Decks

The SEC has charged advisers over AI claims before. On March 18, 2024, it announced cases against Delphia (USA) and Global Predictions for false and misleading statements about their use of AI, including in Form ADV Part 2A brochures, under the Marketing Rule and the compliance rule. The amounts were $225,000 and $175,000, $400,000 in total.

An SEC order of October 10, 2024 involved "an adviser that purported to use artificial intelligence to perform automated trading for advisory client accounts," as the SEC's April 30, 2026 distribution-plan order in the Rimar Capital matter describes it.

The page 12 test cuts both ways. In WorkWise Solutions' view, a brochure silent about SI in portfolio management, while the team uses it there, invites questions under the test's second half.

SEC staff already read brochures in bulk. For the economic analysis of its custody proposal, issued October 1, 2026, staff had a large language model, Anthropic's Sonnet 5, review brochures from 15,964 advisers and identified 1,498 that advise on crypto assets, with a false positive rate below 3%. The model classified crypto advice rather than AI use.

WorkWise Solutions' view: write one approved description of the firm's SI use, back each claim with evidence, and reuse it everywhere, so a change happens in one place. See disclosing AI in Form ADV Part 2A for the brochure and AI washing in LP materials for decks and DDQs.

Describe what the firm does, exactly. Overselling SI and leaving it out both put your documents at odds with your business.

7. Third-Party SI Tools and Vendors

Unless your firm builds its own models, its SI comes from vendors: the chat assistant, the note-taker in client meetings, the research platform, the add-on inside the CRM.

The priorities say nothing SI-specific about vendor tools. Two general passages still reach them: page 6 on "advisers using third parties to access clients' accounts, where existing controls may be insufficient to protect client assets and data," and the Regulation S-P passage on "oversight of service providers."

WorkWise Solutions recommends three records for each tool:

1. An inventory line. The tool, owner, users, data it touches, plan and settings. Include tools on personal accounts, which is how shadow AI starts.
2. A due-diligence file. The vendor's data terms, whether it trains models on your data, retention settings, security reports and who approved it. For Claude, the documents to request are in Claude vendor due diligence for RIAs.
3. The contract terms that matter. Who owns the outputs, how the vendor tells you about an incident that touches customer information, and what happens to your data when the contract ends.

An examiner can't assess a tool your firm can't name. Start with the inventory.

8. SI-Enabled Phishing, Deepfakes and Identity Theft

Page 12 names the attack, and other agencies have described the same pattern since 2024:

• The FBI warned on December 3, 2024: "Criminals obtain access to bank accounts using AI-generated audio clips of individuals and impersonating them."
• FINRA warns that "fraudsters need only three seconds of audio of someone speaking to create a credible-sounding imitation".
• The FBI's April 6, 2026 release on the 2025 IC3 report said its AI section "accounts for 22,364 complaints, costing Americans nearly $893 million."

At an advisory firm, the attack sounds like a cloned client requesting a wire or a cloned principal instructing staff. WorkWise Solutions' view: a request by voice, video or email changes nothing on its own. Staff call back on the number on file, a second person approves, and every step is logged. The full set is in deepfake and AI fraud controls for investment advisers.

Train for the call that sounds exactly right.

9. Regulation S-P and S-ID, as the Document Frames Them

The priorities tie SI risk to two rules advisers already follow, and they give no compliance dates. The dates come from the rules.

Regulation S-P

The amended rule, adopted May 16, 2024, requires an incident response program "reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information," and customer notice "as soon as practicable, but not later than 30 days" after a firm becomes aware of an incident. Larger entities, including advisers with $1.5 billion or more in assets under management, had to comply by December 3, 2025, and smaller ones by June 3, 2026 (SEC small entity compliance guide).

WorkWise Solutions' view: list each SI tool that holds customer information inside the program, name who calls the vendor when something goes wrong, and rehearse the 30-day notice with an incident that starts at a vendor.

Regulation S-ID

Regulation S-ID requires a written Identity Theft Prevention Program for covered accounts. The priorities point examiners to "red flags intended to prevent and mitigate against identity theft, particularly during customer account takeovers and fraudulent transfers."

WorkWise Solutions' view on the SI update: add red flags such as a voice or video request to move money or change account details, and contact details changed shortly before a transfer request. At onboarding, borrow two red flags from FinCEN's deepfake alert of November 13, 2024: "A customer uses a third-party webcam plugin during a live verification check" and "A customer declines to use multifactor authentication to verify their identity." Then write the response to each.

Page 13 asks whether firms are updating the program, so the date of the update is part of the answer.

10. A 60-Day Plan Before Your Next Exam

WorkWise Solutions' plan runs one step a week, and each step finishes one document from the table.

1. Week 1: Inventory. List every SI tool in use, approved or not, on firm or personal accounts, with owner, users, data and plan.
2. Week 2: Map. For each tool, name the existing policy that governs it, and note the gaps.
3. Week 3: Policy and monitoring. Write or update the SI use policy, and assign who reviews what, how often, and where the evidence goes.
4. Week 4: Representations. Match every SI statement in the brochure, website, decks and DDQ answers to evidence, and fix the ones that don't match.
5. Week 5: Vendors. Build the due-diligence file for each tool that touches client data, and check the contract terms.
6. Week 6: Fraud controls. Write the callback and second-approver procedure, train staff, and run one test call.
7. Week 7: Privacy rules. Add SI red flags to the identity theft program and SI vendors to the Regulation S-P response program, then run a vendor-incident tabletop.
8. Week 8: Mock exam. Have someone outside the work play examiner, walk the table row by row with the CCO, and fix what fails.

Use the last few days to date, sign and file everything in the table's order. Sixty days is enough when every week ends with a finished document.

11. Where to Start

Start this week, before any letter arrives:

1. Read pages 2, 3, 6, 12 and 13 of the priorities yourself.
2. Ask every team which SI tools they use, for what, and on which account.
3. Highlight every SI claim in your brochure, website and latest DDQ.
4. Ask your CCO to name the policy that covers each tool.
5. Book the mock exam for week eight.

How an exam runs, from the request letter to the interviews, is covered in AI governance for an SEC exam.