Share with your CISO
Investment advisers have crossed from debating AI governance to actually building it, and the numbers in the 2026 Investment Management Compliance Testing Survey from ACA Group and the Investment Adviser Association are striking. Eighty-five percent of firms now name AI their top compliance concern, up 28 points in a single year. Eighty percent use AI tools internally, 86% have governance policies in place, and 72% increased compliance testing tied specifically to AI. The SEC’s examination calendar, combined with amended Regulation S-P deadlines in late 2025 and mid-2026, is the forcing function.
What this means for your business
The gap that deserves attention isn’t adoption or even policy, it’s the validation layer that sits between an AI output and a client outcome. Only 48% of firms have formal human-oversight policies for AI outputs, and just 37% have procedures to test those outputs before they reach clients. Firms that have built governance committees and approved-tool inventories but skipped output validation have constructed a facade. The SEC will look through it. If your firm sits in the majority that has policies but not validation workflows, the exposure is real and examiners are now specifically looking for it.
Third-party risk is where the facade gets expensive. Only 30% of firms have policies addressing how their vendors use AI, and just 34% have completed a full data map of nonpublic personal information, the inventory that tells you where client data actually lives before a breach forces you to find out. Regulation S-P’s 72-hour breach notification requirement makes vendor readiness a hard deadline problem, not a best-practice ambition, yet 67% of firms say they can’t get their vendors to confirm they’ll meet that window. That’s a contract negotiation failure dressed up as a compliance gap.
The survey is produced by ACA Group, which sells compliance advisory and testing services to the firms it surveys, so the framing predictably emphasizes how much work remains rather than how far firms have come. That tilt doesn’t invalidate the data, but it does mean the “gaps” language is doing commercial work. What the numbers actually show is a compliance function under structural strain: 60% of CCOs hold at least one additional executive role, and 45% of firms run compliance on teams of two to five people. The resource constraint is the real story. Firms that add AI governance obligations to underpowered teams without adding headcount or renegotiating vendor contracts will fail the exam they’re currently studying for.
Concept deep-dive: Output validation
Output validation is the process of checking what an AI system produces before that output influences a decision or reaches a client, similar to a quality-control step on a production line. It exists because AI models can generate plausible-sounding but incorrect or biased results with no internal warning signal. In a regulated investment context, an unvalidated AI summary of client suitability or a drafted disclosure could constitute a material misstatement. Only 37% of surveyed firms have formal procedures for it, making it the single most consequential gap in current AI governance programs.
Based on reporting from AI compliance testing surges as SEC steps up scrutiny of advisers, originally published 2026-07-29 10:55:00.
