Why AI has eclipsed cyberattacks as firms’ top compliance problem

For the people tasked with keeping wealth management firms secure, the biggest threat is coming from within.

Processing Content

New data shows that AI compliance is the top concern for compliance professionals, far eclipsing cybersecurity risks.  

It comes at a time in which AI is a big draw for advisors and their firms. Morgan Stanley, for example, recently found that AI might allow advisors to triple the number of clients they serve, while JPMorgan suggested AI investing agents could get better returns than a standard 60-40 portfolio. 

But with all the advantages, there are concerns.

According to a survey of compliance professionals at 411 investment advisor firms, AI was a top concern for 85%, with cybersecurity a top issue for only 37%. Privacy and the U.S. Securities and Exchange Commission’s Regulation S-P made up the third-highest concern, for 35% of respondents, followed by advertising and marketing at 19% and prediction markets at 14%.

Firms must comply with Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, a consumer privacy rule adopted in 2024 that required investment advisors, brokers and others to tell clients about data security lapses within 30 days. Larger entities had to comply by December 2025, while smaller ones had until June 2026.

While 86% of firms say they have acceptable use policies related to AI, up from 64% in the fall of 2025, only 59% of firms have created a formal AI governance committee.

The survey was sent to ACA Group clients, Yuter Compliance Consulting clients and Investment Adviser Association members, and the organizations released the results on July 29. ACA Group is a compliance and technology provider for financial services firms, Yuter is a boutique compliance consulting firm, and the IAA is a not-for-profit organization representing fiduciary investment advisor firms.

Small registered investment advisors or other firms that don’t have their own compliance departments might use compliance technology from a company such as the ACA Group.

“Make sure that your vendor isn’t using your information in a way that you wouldn’t want them to, and usually you lay that out in the contract, ‘Here’s what you can and can’t do with our data that we provide to you or use inside of your systems,'” ACA Group President Carlo di Florio said in an interview. “Then have some monitoring and testing oversight around those vendors.”

To cope with AI-related compliance, di Florio recommended a five-pronged approach:

• Have an authorized use policy, including knowing who is responsible for governance and control
• Take an inventory of who in the firm is using AI and for what purposes
• See what kind of model testing is done, including whether sensitive client information is going into the models and how they’re testing for biases, errors and hallucinations
• Consider cybersecurity impacts
• Manage vendor oversight.

“If their policy isn’t clear, employees there might think it’s OK for them to use their own personal ChatGPT or Claude or whatever it is that they’re using, and there’s much fewer controls around those kind of personal commercial applications,” di Florio said.
After three years of tracking AI use in this survey, AI has gone from being experimental to “very broad” this year, di Florio said.

There is overlap between AI and cybersecurity concerns since some compliance issues related to AI are related to cybersecurity.

For example, firms should also consider what controls they put in place, di Florio said.

“Who is doing a cyber risk assessment around your use of AI? That’s a really good exercise for a firm to do,” he said.