After spending the better part of three years debating where artificial intelligence belongs in compliance programs, investment advisers are now moving on to the harder work of governing the technology, according to a new survey.
The 2026 Investment Management Compliance Testing Survey from ACA Group, the Investment Adviser Association, and Yuter Compliance Consulting found that 85% of respondents named AI as the hottest compliance topic of the year, a 28-percentage-point jump from the 2025 survey and the widest margin recorded in the survey's 21-year history. Cybersecurity ranked a distant second at 37%, followed by privacy and Regulation S-P at 35%.
"What makes this year's results particularly meaningful is that firms are no longer just naming AI as a concern; they are allocating compliance resources, standing up governance committees, and increasing testing," said Carlo di Florio, president of ACA. "But the gaps in human oversight, output validation, and third-party AI policies tell us the work is far from done."
Seventy-two percent of firms reported increasing compliance testing specifically tied to AI in the past year – the largest year-over-year increase of any topic tracked in the survey, ahead of both cybersecurity (58%) and privacy and Regulation S-P (58%).
Adoption has moved in step with scrutiny. Eighty percent of firms now use AI tools for internal or external purposes, though 70% restrict that use to internal applications, such as drafting communications or summarizing research. Only 10% permit client-facing or external use cases, while 18% are still exploring the technology and just 2% have banned it outright.
Governance structures have followed close behind. Eighty-six percent of firms have adopted policies and procedures governing employee use of AI, and another 10% are developing them. Fifty-nine percent have stood up formal AI governance committees, and 86% maintain an inventory of approved AI tools.
"Investment advisers are taking the challenge of AI governance seriously, and this survey captures that shift in real time," said Karen Barr, president and chief executive of the Investment Adviser Association.
"At the same time, the consistency we see in SEC examination focus areas – advertising, books and records, conflicts of interest – is a reminder that firms must address emerging technology risks while continuing to deliver on their core compliance obligations."
Despite the progress on policy adoption, the survey identified three areas where firms lag: fewer than half, 48%, have formal policies for human oversight of AI outputs, and just 37% have procedures for testing and validating those outputs before they reach clients. Only 30% have policies addressing third-party use of AI, and a mere 14% have updated their incident response plans to account for AI-related disruptions.
According to industry executives interviewed by InvestmentNews, some firms are already holding onto client data and communications well past the SEC's five-year minimum under Rule 204-2, precisely because that data has new value as training material for AI systems.
The survey also flagged third-party oversight as an emerging pressure point, tied closely to the amended Regulation S-P on client data protection, with compliance deadlines of December 3, 2025, and June 3, 2026 emerging as the bright red-letter dates of note. Eighty-three percent of firms updated privacy policies and procedures to align with the rule, but only 53% formalized incident response plans, and just 34% created a full data map of nonpublic personal information.
The most common implementation hurdle, cited by 67% of respondents, was getting vendors to confirm that they will notify the firm of any breaches within the 72-hour window required by Regulation S-P. Meanwhile, third-party risk management broadly ranked among the year's hottest topics, with 60% of firms making or planning significant changes to their vendor oversight programs.
Compliance leaders, meanwhile, are taking on this expanded workload with limited manpower and budgets behind them. Sixty percent of chief compliance officers in the survey currently hold at least one additional executive role, and 45% of firms report compliance departments of between two and five people, including the CCO. Sixty-one percent of firms spend between $100,001 and $999,999 annually on compliance overall.
The Omaha-based RIA's second Hanover office deepens its US expansion as industry dealmaking hits a record clip in 2026.
The two alternative-investment platforms' new financing – coming from Blue Owl, Carlyle, Franklin Templeton and other big-name backers – signals deepening advisor demand for private-market access.
RIA consolidation deals expand firms in Alabama, Maryland.
Three major platforms roll out AI-driven advisor tools spanning marketing, planning, and behavioral coaching.
New research spanning seven decades links persistent low income to lower cognitive scores by midlife and faster brain atrophy in later life.
Northern Trust’s Ken Lassner shows advisors how to convert volatility into after-tax portfolio gains
Dan Biagini of American Equity says the steady decline of pensions, longer lifespans and a reset in interest rates are rewriting how advisors build retirement income
