Across our client base of SEC-registered private fund advisers, AI agents are already at work in investor reporting, Form ADV and Form PF preparation, and portfolio analysis. That means AI agents are now touching data squarely within SEC oversight: investor communications, fee and carry calculations, trading records, and material nonpublic information about portfolio companies. The Advisers Act recordkeeping and compliance requirements that govern this data don’t distinguish between a human and an agent doing the work. This piece covers what the rules require of AI agent deployments today, where we’re seeing gaps across our clients, and how our compliance group helps firms build a governance posture that holds up under exam.
The SEC’s FY2026 exam priorities name AI compliance policies and disclosures as a focus area, and the agency has already brought “AI washing” enforcement actions against firms that overstated their AI capabilities to investors. The advisers we work with who can produce auditable AI data use and access are walking into exams from a position of strength. Those who can only produce a policy document are not, and that gap is exactly what examiners are trained to find. In addition, examiners are starting to request AI documentation such as model and data-source inventories, disclosures and marketing, governance policies, personnel records, and AI-specific controls.
Rule 204-2, Regulation S-P, and the fiduciary duty framework carry no AI exemption. The moment an agent accesses portfolio data, generates advisory recommendations, or drafts investor communications, it has performed an activity that was already subject to supervisory, recordkeeping, and disclosure obligations — full stop.
Those obligations reach both an agent’s output and the data behind it. Rule 204-2 requires firms to retain records of communications tied to recommendations and client interactions. When an agent produces a client report, both the data it accessed and the output it generated fall within scope, and that access must trace back to an authorized individual. No exceptions for who or what did the work.
The SEC’s exam priorities signal direct scrutiny of AI compliance policies, supervision, and disclosures. Examiners are asking for access logs, delegation records, and audit trails that prove a policy is actually operating, not just written down. And where AI agents touch material nonpublic information, the insider trading exposure is identical to human access. An agent that can reach MNPI without the same access controls and audit trail governing employee access is a supervisory failure, not a technology question.
Investor disclosures about AI use have to reflect real governance. The SEC’s enforcement record makes clear that AI-related disclosures must be verifiable. A firm claiming it “governs AI access to client data” needs to be able to show, specifically, what that governance is. There’s no AI-specific rulebook for investment advisers yet, but the exam priorities, enforcement actions, and guidance already point in one direction.
Rule 204-2 — Books and Records. Firms must maintain records of communications tied to recommendations, advice, and client interactions. When an agent assists with portfolio analysis or drafts marketing materials, that output likely falls in scope, and it has to tie back to the individual controlling the tool. Records need to be retrievable, attributable, and retained. Not eventually. From day one.
Regulation S-P — Safeguarding Client Information. The obligation to protect client records applies equally whether a human or an AI agent is doing the accessing. Access must be limited to authorized workflows, data must be protected, and every access event must be logged. The recent Regulation S-P amendments raise the bar further, adding incident response requirements and extending coverage to more categories of customer information.
Fiduciary Duty and Supervision. An adviser’s fiduciary obligation to act in clients’ best interests doesn’t pause when an AI agent enters the workflow. Wherever an agent generates recommendations or prepares client-facing materials, the firm’s supervisory framework has to extend to it. An agent that accesses data outside its authorized scope, or produces output that can’t be traced back to its data and authorization, is a control failure — the same as it would be for a person.
Establish attribution chains for every agent interaction. Every AI agent touching regulated data should operate under an identity tied to the individual who authorized the workflow, with that link captured in a tamper-evident record for each interaction. If it can’t be attributed, it can’t be defended.
Enforce access scoping at the operation level, not the session level. Access controls should limit each agent to only the data its specific, authorized task requires, evaluated per operation. An agent generating a quarterly review for Investor A has no business having technical access to Investor B’s data. That boundary belongs in the architecture, not in a policy document.
Align investor disclosures with what your governance can actually prove. Before any investor-facing AI disclosure goes out, audit whether the described controls exist in practice. The AI washing enforcement actions make one thing clear: the gap between disclosure and reality is the risk. Disclosures should describe controls you can verify, not controls you intend to build.
Update written supervisory procedures to name AI agent workflows specifically. WSPs should spell out which AI workflows are authorized, what data each can access, how agent actions are monitored, and what supervisory review applies to AI-generated output. An exam of AI compliance policies will include a WSP review, and most firms haven’t made this update yet. The ones who move now won’t be scrambling later.
Petra Funds Group works with private fund advisers to build AI governance frameworks that hold up under SEC exam scrutiny. If your firm is deploying AI agents into regulated workflows, let’s talk about what your current posture can and can’t prove. Contact Petra’s Compliance Team: jesse@petrafundsgroup.com.
The SEC has proposed rescinding its Pay-to-Play Rule, a change that could affect compliance requirements for private fund advisers. Here’s what advisers need to know while the proposal is under consideration.
The SEC’s recent Compliance Outreach webinar made clear that amended Regulation S-P is now an exam priority, with advisers expected to demonstrate that information security and incident response policies are not only documented, but actively implemented, monitored, and aligned with the rule’s enhanced requirements.