AI Governance Is Becoming a Global Examination Priority

Although financial regulators have taken different approaches to AI, a clear pattern is emerging: Existing regulatory frameworks continue to apply when firms use AI, and AI-related controls are receiving greater supervisory attention.

That convergence is significant because firms do not need to wait for AI-specific rules before strengthening their governance. Although the SEC, FINRA, FCA, and DFSA have taken different approaches, each has emphasized that existing regulatory obligations already apply when firms use AI.

AI governance is moving from a future compliance discussion to a present examination priority.

U.S. Regulators Are Embedding AI Governance into Examinations

If you manage a compliance program for an investment adviser or broker-dealer, the SEC’s 2026 Examination Priorities deserve close attention. The Division of Examinations embedded AI oversight across multiple examination categories, including information security, operational resiliency, and emerging financial technology.

The practical implication is that AI governance will be an increasingly important factor in regulatory examinations for all firms, not just for those that are actively marketing AI-powered strategies. FINRA’s 2026 Annual Regulatory Oversight Report went further, introducing a dedicated section on generative AI and calling on member firms to demonstrate testing, supervision, governance, vendor diligence, and recordkeeping practices for AI tools.

The message from both regulators is clear: Existing regulatory obligations apply to AI, even in the absence of AI-specific rules. Examiners will expect firms to demonstrate effective governance.

The FCA Expects Existing Regulatory Frameworks to Apply to AI

In the UK, the FCA has stated that it does not plan to introduce additional AI-specific regulations. Instead, it continues to favor a principles-based, outcomes-focused approach that allows firms to innovate while remaining accountable under existing regulatory frameworks.

Initiatives such as the FCA’s AI Lab, AI Live Testing, and the long-term Mills Review, launched in January 2026, reinforce the expectation that firms should adapt existing governance and risk management arrangements for AI rather than wait for AI-specific regulation.

The DFSA Is Reinforcing AI Governance Expectations

Earlier this year, the DFSA issued a formal circular to the senior executive officers of every authorized firm in the DIFC, setting out expectations for AI risk management. The guidance focuses on four pillars: governance and accountability, risk management, operational risk, and third-party arrangements.

Notably, the UAE’s regulatory approach is not intended to slow AI adoption. Instead, regulators are signaling that innovation and strong governance should develop together. Firms are encouraged to embrace AI where it delivers value, provided they can demonstrate appropriate human oversight, clear accountability, effective risk management, and robust governance arrangements.

Together with developments in the U.S. and the UK, this reinforces an emerging global expectation that AI should be governed within existing regulatory and risk management frameworks.

What “Existing Frameworks Apply” Means in Practice

AI does not create a separate compliance regime. Instead, it changes how firms demonstrate that existing governance, risk management, and compliance frameworks remain effective when AI becomes part of everyday business processes.

In practice, AI governance refers to the policies, controls, oversight arrangements, accountability, and risk management processes that enable firms to use AI safely, transparently, and in line with regulatory expectations.

For compliance teams, the phrase “existing frameworks apply” can sound deceptively simple.

From a governance perspective, the SEC has been direct about its expectation that AI use remains comprehensible and defensible under examination. Regulators in the UK and the UAE reinforce the same expectation: Senior management must have sufficient understanding of AI-related risks to provide meaningful oversight, not simply delegating to technology teams.

CCOs should be prepared to discuss data integrity risks, model limitations, and the compliance implications of desktop AI tools such as Claude and ChatGPT, as well as AI-enabled software applications used across the business.

When it comes to third-party risk, SEC examination priorities and FINRA guidance indicate that firms should consider AI-related risks arising from their use of third-party vendors. An investment adviser that uses AI-powered software remains fully accountable for the outputs and the controls in place, even if the software and models were procured externally. The DFSA and FCA have the same expectation within their existing outsourcing and third-party risk frameworks.

Regarding recordkeeping and disclosure, the SEC and FINRA have flagged the importance of capturing AI-enabled communications within firm books and records and ensuring that representations made to investors about AI tools are accurate and consistent with actual practices.