AI dominates compliance priorities by historic margin

Artificial intelligence has overtaken every other concern for investment adviser firms, becoming the single most dominant compliance priority in the 21-year history of a major industry survey. The 2026 Investment Management Compliance Testing (IMCT) Survey found that 85% of respondents identified AI as the hottest compliance topic for the year. That figure represents a 28-percentage-point jump from 2025, marking the largest separation between a top priority and other topics ever recorded in the benchmark report.

Cybersecurity, Privacy/Regulation S-P, and Advertising and Marketing trailed significantly behind. The survey, which serves as a primary benchmark for compliance testing practices, indicates that the industry has moved beyond general awareness into active implementation. 72% of firms reported increasing their compliance testing around AI, the single largest year-over-year increase for any topic tracked.

Firms Move From Awareness to Action

The shift is evident in policy adoption rates. 80% of firms have now formally adopted AI tools. Acceptable use policies are also standard, held by 86% of firms, up from approximately 64% in a comparable survey conducted in fall 2025. Nearly the same percentage, 86%, maintain an inventory of AI tools used by their firm. Additionally, 59% of firms have established a formal AI governance committee.

Related: Abnormal AI Expands Security Platform

This rapid transition suggests that the industry has moved past theoretical discussions about potential risks and is now grappling with the practical realities of managing live tools. Regulators are clearly watching, forcing firms to prove they can control the algorithms they deploy rather than simply banning them.

Despite this progress, gaps remain in governance frameworks. Only 48% of firms have a formal policy, plan, or procedure for human-in-the-loop oversight of AI outputs. Even fewer, 37%, have policies and procedures governing the testing and validation of AI outputs. Less than a third have policies addressing third-party AI use, and just 14% have updated their incident response plans to account for AI-related disruptions.

SEC Exams and Staffing Levels

While AI consumes attention, the Securities and Exchange Commission’s examination focus has not shifted dramatically. Advertising and Marketing remain the top area, appearing in 57% of recent exams. Books and Records and Conflicts of Interest followed closely at 53% each. Fee Calculation and Billing appeared in 48% of exams. This consistency persists despite a new administration at the SEC, suggesting that core obligations remain the primary focus for regulators.

Related: OP and Qutwo Launch Quantum Computing Venture

Compliance program structures have remained steady from 2025. 45% of firms have between two and five staff in their compliance program. The data reflects a pattern of doing more with less: approximately 60% of Chief Compliance Officers hold multiple responsibilities. Common dual roles include CCO/CFO (19%) and CCO/General Counsel (17%). Compliance budgets have likewise remained broadly consistent year over year, though the range is wide, with an equal number of firms reporting budgets below $100,000 and above $2 million.

Third-Party Risk Management Gaps

Third-party risk management is evolving in response to regulatory scrutiny. 39% of respondents have made significant changes to their third-party risk management programs in response to increased regulatory focus on Regulation S-P requirements. Another 22% plan to make changes. These updates most commonly include revised policies and procedures (69%), updated vendor risk-tiering (58%), and expanded due diligence requirements (54%).

Fourth-party risk remains a significant blind spot. Only 7% of firms have a formal process to assess risks posed by fourth parties used by key service providers. This gap highlights a vulnerability in the supply chain that may draw scrutiny as firms rely more heavily on external vendors for AI and tech services.

Related: Supply Chains Drain Corporate Cash

“In 21 years of this survey, we have never seen a single topic command this kind of separation from everything else on the agenda,” said Carlo di Florio, President of ACA Group. “What makes this year’s results particularly meaningful is that firms are no longer just naming AI as a concern; they are allocating compliance resources, standing up governance committees, and increasing testing. But the gaps in human oversight, output validation, and third-party AI policies tell us the work is far from done.”

“Investment advisers are taking the challenge of AI governance seriously, and this survey captures that shift in real time,” said Karen Barr, President & CEO of the Investment Adviser Association. “At the same time, the consistency we see in SEC examination focus areas – advertising, books and records, conflicts of interest – is a reminder that firms must address emerging technology risks while continuing to deliver on their core compliance obligations.”