AI compliance for private equity sponsors and asset managers

Which AI rules apply to private equity sponsors and asset managers in 2026?

For the firm itself, the rules that apply to AI in October 2026 are the existing ones: the Advisers Act antifraud provisions and Marketing Rule, the securities fraud statutes, the amended Regulation S-P, and, for broker-dealer affiliates, FINRA’s supervision and communications rules. For portfolio companies, the exposure comes from state AI and hiring laws, antitrust law on shared pricing tools, the EU AI Act, and the same fraud statutes when a company raises capital on AI claims.

The two halves call for different work. The firm’s own AI use is an examination question. Portfolio AI use is a diligence, contract, and board oversight question.

AI rules for private equity, private credit, hedge funds, and registered advisers, as of October 2026

Rule	Who enforces	Applies when	Status and key date
Advisers Act antifraud provisions and Marketing Rule	SEC	An adviser describes its use of AI to clients, investors, or prospects	Enforced; predictive data analytics proposal withdrawn June 12, 2025
Securities Act Section 17(a) and Exchange Act Section 10(b)	SEC; DOJ in parallel criminal cases	A company or founder makes AI claims to investors while raising capital, including in private rounds	Enforced; Nate founder charged April 9, 2025
Regulation S-P amendments	SEC	A registered adviser, broker-dealer, or investment company holds customer information, including through AI vendors	Compliance required since December 3, 2025 (larger entities) and June 3, 2026 (smaller entities)
SEC FY2026 examination priorities	SEC Division of Examinations	A registered adviser is examined	Released November 17, 2025; AI representations and AI supervision named
FINRA Rules 3110 and 2210; Regulatory Notice 24-09	FINRA	A broker-dealer affiliate, such as a placement agent, uses AI	Notice in effect since June 27, 2024; creates no new requirements
Colorado SB 26-189	Colorado Attorney General	A portfolio company uses automated decision-making technology in consequential decisions, such as lending, insurance, housing, or employment	Applies from January 1, 2027; court order in X.AI LLC v. Weiser bars enforcement for violations on or before 14 days after a preliminary injunction ruling (no motion filed as of October 21, 2026)
State and city hiring rules (California, Illinois, NYC)	California Civil Rights Department; Illinois Department of Human Rights; NYC DCWP	The firm or a portfolio company uses AI in hiring or other employment decisions	California from October 1, 2025; Illinois from January 1, 2026; NYC enforced since July 5, 2023
Sherman Act Section 1 and California AB 325	DOJ; California Attorney General; private plaintiffs	A portfolio company uses a pricing tool that also serves its competitors	AB 325 effective January 1, 2026; DOJ’s RealPage settlement filed November 24, 2025
EU AI Act	EU AI Office and national authorities	A portfolio company places AI on the EU market, or its system’s output is used in the EU	Prohibitions since February 2, 2025; stand-alone high-risk duties from December 2, 2027
DOJ Evaluation of Corporate Compliance Programs	DOJ Criminal Division prosecutors	Prosecutors evaluate a company’s compliance program in a criminal matter	Updated September 2024 to add questions on AI

What has the SEC charged as AI washing?

The SEC has charged advisers, a public company, and a startup founder for claiming AI capabilities they did not have. Every case used existing law.

• Delphia and Global Predictions (March 18, 2024): The SEC found that Delphia claimed AI and machine learning capabilities it did not have, and that Global Predictions falsely called itself the “first regulated AI financial advisor.” Both orders found violations of the Advisers Act antifraud provision (Section 206(2)), the Marketing Rule, and the Compliance Rule. The firms were censured and paid $225,000 and $175,000 without admitting or denying the findings.
• Rimar Capital (October 10, 2024): In a settled order, the SEC found that Rimar’s owner and CEO, with help from a board member, raised nearly $4 million from 45 investors while falsely describing an AI-driven automated trading platform. The parties paid $310,000 in total civil penalties without admitting or denying the findings. The owner also received an associational bar.
• Presto Automation (January 14, 2025): A public company settled charges that it described third-party speech recognition technology as its own and overstated how much its product reduced human involvement. The SEC imposed no penalty; the order cites the company’s financial condition, remedial acts, and cooperation.
• Nate, Inc. (April 9, 2025): The SEC sued the founder, alleging he raised over $42 million in private rounds by telling investors the app used AI to complete purchases, when it relied largely on contract workers. The Justice Department brought a parallel criminal case. These are allegations, not findings; the criminal docket showed no resolution as of October 21, 2026.

In February 2025 the SEC replaced its crypto and cyber unit with the Cyber and Emerging Technologies Unit, whose stated priorities include fraud committed using emerging technologies, such as AI and machine learning.

The withdrawal of the predictive data analytics proposal removed a rule that was never adopted. It did not remove the adviser’s existing fiduciary duty or the antifraud provisions, and enforcement against false AI claims never depended on the proposal.

For a sponsor, the exposure sits in fundraising documents. A pitch book, due diligence questionnaire response, or LP letter that says the firm uses “proprietary AI” to source or underwrite deals is a statement to investors under the antifraud provisions, including Rule 206(4)-8 for advisers to private funds. For a registered adviser, it is also an advertisement under the Marketing Rule when it goes to more than one person and offers the adviser’s services. A one-on-one response that contains no hypothetical performance generally is not. The firm should be able to show what the tool does, who built it, and how much of the decision it actually makes.

What will SEC examiners ask about the firm’s AI use?

Examiners will ask whether what the firm says about AI matches what it does, and whether the firm supervises the AI it uses. The FY2026 priorities say the Division will review “for accuracy” registrant representations about AI capabilities. They also say it will assess policies and procedures to monitor or supervise AI used for fraud prevention and detection, back-office operations, anti-money laundering, and trading functions, as applicable.

For automated investment tools and AI technologies, the priorities list four assessments: whether representations are fair and accurate; whether operations and controls are consistent with disclosures; whether algorithms produce advice consistent with investors’ profiles or stated strategies; and whether controls confirm that automated advice meets regulatory obligations.

The priorities do not publish a document request list. Based on the areas they name, a firm should be ready to produce:

• An inventory of AI tools in use, including generative AI used by deal and investor relations teams
• Written policies on approved tools and prohibited inputs, such as material nonpublic information
• Evidence that AI claims in marketing were reviewed and substantiated before use
• Records showing how AI-assisted investment or allocation decisions were supervised

What does amended Regulation S-P require for AI vendors?

Amended Regulation S-P requires covered firms to maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of their service providers. An AI vendor can be one. The rule defines a service provider broadly: any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to the covered institution.

The SEC adopted the amendments on May 16, 2024. A covered adviser must:

• Maintain written policies and procedures that include an incident response program to assess, contain, and control unauthorized access to or use of customer information
• Notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. The firm must give notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The U.S. Attorney General can request a delay on national security or public safety grounds. Notice is not required if the firm determines after a reasonable investigation that the information has not been and is not reasonably likely to be used in a manner that would result in substantial harm or inconvenience.
• Maintain policies reasonably designed to require oversight of service providers, including through due diligence and monitoring. The policies must also be reasonably designed to ensure that providers take appropriate measures to protect customer information and to notify the firm as soon as possible, but no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system they maintain. The firm remains responsible for notifying affected individuals.

The SEC dropped a proposed written-contract requirement. The adopting release says a contract is not required, though firms should generally consider whether one is appropriate. It names independent certifications and attestations as tools firms may use, and it warns that relying solely on a provider’s assurances may be insufficient.

For a private fund adviser, law firm guidance generally treats individual limited partners in the funds it advises as customers whose information is covered. In practice, an AI meeting note-taker, investor portal chatbot, or document-review tool that touches individual investors’ records should be on the vendor list, with breach notice terms that meet the 72-hour standard. The FY2026 priorities say examiners will check whether firms have implemented the new provisions after the compliance dates.

What should AI diligence on a portfolio company ask?

Loeb & Loeb’s April 2025 deal guidance recommends requesting a list of all AI the target developed or licensed, its AI policies and contracts, the data used to train its models and the rights to that data, its security safeguards, any complaints about its AI use, and whether its AI use complies with applicable regulatory requirements. For a sponsor, that last item needs to be broken out law by law, and nothing on the list tests whether the target’s AI claims are true. Add these questions:

• EU reach: Does the target sell AI into the EU, or is its system’s output used there? A US company can be covered without an EU presence. A target that puts its own name on a vendor’s high-risk AI system, substantially modifies one, or changes a system’s intended purpose so that it becomes high-risk may have become a provider under Article 25.
• Consequential decisions: Does the target use automated decision-making technology that materially influences decisions about Colorado consumers’ access to education, employment, housing, financial or lending services, insurance, health care, or essential government services? From January 1, 2027, SB 26-189 requires a deployer to give notice before use and a plain-language description of the technology’s role within 30 days after an adverse decision. After an adverse outcome, it gives consumers the right to request correction of inaccurate personal data and human review and reconsideration, the latter to the extent commercially reasonable. Enforcement is limited by the court order in X.AI LLC v. Weiser described above.
• Hiring: Does the target screen candidates with AI? California’s rules treat a vendor acting for the employer as the employer’s agent. Illinois bars using AI in employment decisions in a way that has the effect of discriminating on a protected basis, and requires notice. New York City bars using an automated employment decision tool unless it had an independent bias audit within the past year, a summary is posted, and candidates get notice.
• Pricing: Does the target use a pricing tool that pools competitors’ nonpublic data or pushes users toward a recommended price? The RealPage settlement and AB 325 set the current markers.
• AI claims: Do the target’s sales materials, investor decks, and revenue model depend on AI capabilities that a technical review can confirm? The Nate complaint turned on that gap.

Portfolio companies in regulated sectors carry their own sector rules. See the health care, insurance, and financial services guides.

What AI reps and warranties belong in the purchase agreement?

The purchase agreement should turn the diligence findings into specific seller statements. Standard IP, privacy, and IT representations cover part of AI risk, but they may not address training data rights or compliance with AI-specific laws unless drafted to do so.

Loeb & Loeb’s guidance lists representations on ownership of algorithms, models, and data sets; licenses and permissions for training data; adequate licenses for third-party AI, including commercial use of outputs; security of the AI and its data; data quality, bias, and output reliability; and use of AI in accordance with applicable laws. It advises drafting them to cover anticipated regulation as well as current law.

Effective dates are the drafting problem. For a deal signed in 2026, a compliance representation limited to obligations that apply at signing would not reach Colorado’s duties (from January 1, 2027) or the EU high-risk duties (from December 2, 2027), although both laws were already enacted. The representation should name the laws and the dates their duties apply. Separately, a representation that the target’s public statements about its AI are accurate addresses the AI washing risk directly.

Why does the DOJ’s compliance guidance matter to portfolio boards?

The Justice Department’s Evaluation of Corporate Compliance Programs is the guidance prosecutors use to judge a company’s compliance program when deciding whether to bring charges and how to resolve a criminal matter. The September 2024 update asks how a company assesses the impact of new technologies, such as AI, on its ability to comply with criminal laws, whether AI risk is integrated into enterprise risk management, and whether controls ensure AI is trustworthy, reliable, and used in compliance with applicable law.

The same document says a well-designed program includes comprehensive due diligence of acquisition targets and timely integration of the acquired entity into existing compliance structures. It asks who conducted the risk review and whether post-acquisition audits are conducted. It is guidance for prosecutors, not a regulation, but it publishes in advance sample questions they may ask about what the company, its board, and its management did before something went wrong. The Department says the questions form neither a checklist nor a formula.

A sponsor with board seats should treat those questions as the agenda for an annual AI review at each portfolio company.

What should the firm do in the first 90 days?

• Inventory every AI tool the firm uses, including those used by deal, investor relations, and back-office teams
• Review pitch books, DDQ responses, websites, and Form ADV for AI claims, and keep substantiation for each
• Write an AI use policy that bars material nonpublic information and investor data from unapproved tools
• Add AI vendors with access to customer information to the Regulation S-P service provider list and confirm 72-hour breach notice terms
• Test the incident response program against an AI vendor breach scenario
• Add AI questions to the diligence request list: EU reach, Colorado consequential decisions, hiring tools, shared pricing tools, and AI claims
• Add AI-specific representations to the purchase agreement template, including accuracy of public AI statements
• Put an AI risk review on each portfolio board’s annual agenda, using the DOJ’s AI and M&A questions

Where to read more

The financial services guide covers the SEC, FINRA, and NYDFS in more depth. The pricing and competition guide covers RealPage and AB 325. The state law guide and the EU AI Act guide cover the portfolio-level statutes.

This page is general information as of October 2026, not legal advice. Confirm requirements with counsel or the relevant regulator.