The SEC Isn’t Coming. That’s the Problem.
After three decades in financial services, I’ve learned to pay close attention to what regulators say. I pay equally close attention to what the industry concludes from it. Right now, a lot of RIA principals have looked at the current SEC and decided they have breathing room on AI. I understand the reasoning. I disagree with the conclusion.
Paul Atkins has made his position towards regulatory overreach explicit. The Biden-era Predictive Data Analytics proposal, the closest the Commission ever came to formal AI rulemaking for investment advisers, was withdrawn in 2025 before it took effect. On December 4, 2025, the SEC’s own Investor Advisory Committee voted to recommend a new AI disclosure framework. Atkins stood up at the same meeting and told the Committee the existing disclosure rules were sufficient. The recommendation is sitting on a shelf.
That conclusion is probably correct. The comfort that follows from it is where firms get into trouble.
The Five-Year Gap Is Real. Here’s the Math.
The argument that new AI-specific rules for RIAs are not coming anytime soon is not wishful thinking. It is a mechanical exercise. Walk through it once, and the five-year window is not a prediction. It is what you get when you add up numbers that already exist.
Start with the Commission itself. The SEC operates at full capacity with five commissioners, no more than three of whom may belong to the same political party. As of early 2026, the Commission has three sitting members: Chair Paul Atkins and Commissioners Hester Peirce and Mark Uyeda, all Republicans. Commissioner Caroline Crenshaw, the agency’s last Democrat, departed on January 2, 2026, after the Senate Banking Committee canceled her renomination vote in December 2024. That leaves two seats vacant. Both must go to Democrats by law, and as of today there are no nominations in progress and no indication from the White House that filling those seats is a priority. The Trump administration has shown a consistent preference for leaving Democratic commissioner slots unfilled at independent regulatory agencies, and the SEC is no exception.
Now add the chair’s timeline. Atkins is serving out the remainder of Gary Gensler’s term, which expires in June 2026. He would need to be renominated and confirmed by the Senate to continue beyond that date. Assuming that process proceeds, Atkins runs this Commission through at least 2031 under a full five-year term. His public record leaves no ambiguity. When the Investor Advisory Committee voted on December 4, 2025 to recommend AI-specific disclosure guidance, Atkins responded from the same podium by urging the Commission to resist what he called the temptation to adopt prescriptive disclosure requirements for every new thing that affects a business.
Then add the mechanics of federal rulemaking. Even if the Commission were philosophically inclined to act, the Administrative Procedure Act governs the timeline. New rules require a Notice of Proposed Rulemaking, a public comment period of 60 to 90 days, Commission review, a final rule, and then a compliance window of 6 to 12 months. Under favorable conditions, that entire process takes 18 to 30 months from the decision to proceed. The 2024 Regulation S-P amendments, widely considered a relatively uncontroversial update, took more than two years from proposal to compliance deadline.
Finally, layer in electoral dynamics. The 2026 midterms are months away. Even a scenario where Democrats gain Senate seats does not produce a friendlier Commission quickly. Senate confirmation of new SEC commissioners now operates in a more politicized environment. Crenshaw’s renomination was killed by the Senate Banking Committee after cryptocurrency industry lobbying, without ever reaching a floor vote.1
Add it up. A Commission philosophically opposed to new AI rulemaking. Two vacant seats with no nominations in progress. A chair navigating his own renomination inside a confirmation environment shaped by the 2026 midterms. An APA process requiring 18 to 30 months of clean runway even after a decision to proceed. This is not a 2027 event. It is not a 2028 event. The firms waiting for formal AI rules before building their governance programs are not going to get them before 2029 at the earliest, and that estimate requires ideal conditions. None of the current conditions are remotely ideal.
This is not an opinion about what should happen. It is arithmetic about what the institutional calendar makes possible.
The Governance Gap Is Not a Safe Harbor
Here is the distinction the industry is getting wrong. The absence of new AI-specific rules is not the same as the absence of AI-related regulatory risk. These are different things, and conflating them is the most consequential mistake I see wealth management leaders making right now.
The SEC released its 2026 Examination Priorities on November 17, 2025. They name AI technologies, automated advisory services, AI governance policies, vendor oversight documentation, and supervision procedures for AI-generated outputs as explicit examination targets.2 No new rule required. Examiners are already asking for written AI Acceptable Use Policies, documentation of how AI-influenced recommendations are reviewed, and evidence of vendor oversight. The existing framework covers it, and they know it.
Two enforcement actions have already been brought against RIAs under the existing Marketing Rule for overstating their AI capabilities.3 AI-washing is an active enforcement area today, not a future risk category. The fiduciary duty that governs every recommendation you make does not have an AI exemption. And FINRA, which does not need to follow the APA’s notice-and-comment process, is on a faster clock than the SEC on every technology supervision gap it has ever encountered. Broker-dealers are not waiting on 2029.
State legislatures are not waiting either. California, Colorado, and New York have introduced and, in some cases, enacted AI and privacy legislation that applies to wealth management firms operating in those jurisdictions today. The five-year SEC window is not a national moratorium. It is a federal vacuum that other enforcement actors are already filling.
Regulation S-P Is Already Live
One rule that requires no waiting is already in effect. The 2024 amendments to Regulation S-P impose specific vendor oversight and incident response obligations on registered investment advisers. Larger firms had until December 3, 2025 to comply. Smaller firms have until June 3, 2026.4
The amendments require written incident response programs, customer notification obligations when sensitive information has been or is likely to have been accessed without authorization, and formal oversight programs for third-party service providers who handle client data. AI vendors are service providers. If your firm uses AI tools that touch client data, and most do, your Reg S-P obligations extend to those vendor relationships right now. If you have not mapped that exposure, the compliance date on the calendar is closer than you think.
The Case for Building Now
I want to be precise about why the next three to four years represent an opportunity, not a pause.
Firms that build AI governance programs during this window do so on their own terms. They choose the frameworks. They set the timelines. They design programs that fit their business model rather than programs that fit a regulator’s template. Firms that wait will build in response to an examiner’s finding, a FINRA deficiency letter, or rulemaking produced by an administration with different priorities. That is a very different experience.
Every documented AI policy, vendor review, supervisory procedure update, and staff training record created today is compliance credit against whatever formal requirements arrive in 2029. The firm with two years of governance documentation when the rules land is in a fundamentally different posture than the firm starting from zero the day the rules are published.
There is also a competitive dimension that has nothing to do with regulation. Sophisticated clients and institutional prospects are already asking wealth management firms about AI governance. The firms with coherent answers are winning trust their competitors cannot buy back quickly. Documentation is not a defensive posture. It is a capability signal.
Subscribe to the Peaks Perspective Newsletter.
Join our newsletter to get topics like this delivered straight to your inbox every month!
Subscribe Now
Endnotes
1 Levine, Matt. “SEC Commissioner Fights.” Bloomberg Opinion, Bloomberg, 19 Dec. 2024, www.bloomberg.com/opinion/articles/2024-12-19/sec-commissioner-fights. Accessed 23 Mar. 2026.
2 United States Securities and Exchange Commission, Division of Examinations. “2026 Examination Priorities.” SEC.gov, 17 Nov. 2025, www.sec.gov/files/2026-exam-priorities.pdf. Accessed 23 Mar. 2026.
3 United States Securities and Exchange Commission. “SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence.” SEC.gov, 18 Mar. 2024, www.sec.gov/news/press-release/2024-36. Accessed 23 Mar. 2026.
4 United States Securities and Exchange Commission. “Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information.” SEC.gov, 16 May 2024, www.sec.gov/rules-regulations/2024/05/ia-6604. Accessed 23 Mar. 2026.
