Asset managers should be aware of the recent GAO report on Artificial Intelligence – Use and Oversight in Financial Services

Summary

In May 2025, the U.S. Government Accountability Office (“GAO”) released a report examining (1) potential benefits and risks of AI; (2) how the SEC and other federal regulators use AI; (3) regulatory oversight of AI use.  The report covers multiple federal regulators—including the SEC, CFTC, Federal Reserve, FDIC, NCUA, OCC, and CFPB—and the entities they oversee. While the report covers a variety of regulators and regulated entities, our summary focuses on lessons for registered investment advisers to consider.

AI usage often raises questions related to privacy and cyber and data security, which have been areas of perennial focus for the SEC. The summary below outlines key considerations for registered investment advisers evaluating the evolving use of AI in their operations and the broader regulatory landscape.

Potential Benefits and Risks of AI Use 

Registered investment advisers’ use of AI can provide significant benefits and risks to its clients. Primarily, it could decrease the cost of investment advisory services and increase the customer experience by making critical areas of the adviser’s operations more efficient—e.g., identifying and countering threats, making investment decisions, and risk management. However, AI use raises certain risks, such as data quality issues, privacy concerns, new cybersecurity threats, and potential conflicts of interest where the AI model could obscure existing conflicts or optimize profits for advisers at the clients’ expense.

Regulators’ use of AI in their supervisory and market oversight activities

The federal financial regulators are increasingly integrating AI into their general agency operations and supervisory and market oversight activities. The regulators incorporate or are developing mechanisms to incorporate AI into processes to identify risks, support research, and detect potential legal violations, reporting errors, or outliers. Most of the regulators then use such outputs to inform staff decision making more efficiently and at a lower cost. The SEC was one of two regulators that reported the most AI-use as of December 2024, using AI for tasks, such as creating and editing presentation materials, answering staff questions, and analyzing industry data for potential violations. It further plans to use AI to extract relevant information from large collections of documents.

All of the federal financial regulators reported to the GAO that their existing policies and procedures for the general use of technology, which cover data protection, IT security, model risk management, and the acquisition or oversight of third-party software, apply to their AI use as well. Some regulators are further developing AI-specific policies and procedures. 

Regulators’ oversight of AI use in the financial services industry

According to the GAO Report, regulated entities use AI for a variety of functions, and as with other critical activities, often rely on third-party risk management as a key tool to manage related risks. The SEC and CFTC officials maintained that their examinations focus on ensuring that the entities they oversee comply with all applicable statutory and regulatory requirements, including third-party oversight, regardless of whether or how the firm is employing AI in its business operations. However, the regulators indicated they are planning to incorporate reviews that specifically focus on a regulated entity’s use of AI into their examinations. Notably, in 2023, the SEC conducted examinations of the AI disclosures and governance of approximately 30 registered investment advisers with the intention of identifying candidates for more intensive examinations and to enhance the SEC’s understanding of the industry’s AI uses and associated risks. In these exams, the SEC observed several deficiencies, including a lack of comprehensive policies and procedures and even misrepresentations concerning the adviser’s use of AI. 

AI use that is not compliant with existing financial regulatory frameworks can result in corrective action, as evidenced by the extensive AI-related actions across the SEC, OCC, CFPB, NCUA, and others since 2020. 

Takeaways

The GAO report offers valuable insight into how regulators are approaching the risks associated with artificial intelligence (AI). While the SEC formally withdrew fourteen outstanding proposals issued by the prior administration on June 12, 2025, including the Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers proposal, registered investment advisers remain subject to their fiduciary obligations and duty to safeguard client data under Regulation S-P. In light of evolving expectations, firms without a comprehensive AI governance program should consider implementing robust policies and procedures to identify, manage, and mitigate AI-related risks. The GAO report may serve as a useful resource in developing or enhancing such frameworks. 

In addition, investment advisers should carefully review their marketing materials to ensure that any references to AI are accurate and consistent with Rule 206(4)-1 (the “Marketing Rule”) under the Investment Advisers Act of 1940. The SEC brought at least eight AI-related enforcement actions in 2023 and 2024, including cases involving false or misleading statements about the use of AI in violation of the federal securities laws. These actions underscore the importance of aligning public disclosures with actual practices.