A firsthand look at how AI governance, autonomous trading, cybersecurity, and digital-asset fraud are shifting enforcement risk toward the decisions firms make and the records they preserve.
Last week, I joined Ariella Guardi, Robert Musiala and Luke Tenery, with Charu Chandrasekhar moderating, at Securities Enforcement Forum Central in Chicago for a discussion on cybersecurity, artificial intelligence, digital assets and emerging technology enforcement. The discussion reflected a shift in the enforcement landscape. Regulators and market participants are no longer dealing only with whether new technologies fit within existing regulatory categories. Increasingly, the harder questions concern what happens when firms actually deploy those technologies at scale.
That distinction came through clearly in our discussions of AI, cybersecurity and crypto markets. The full panel recording is available here: Cyber and Emerging Technologies: Cybersecurity, AI-Washing, Digital Asset Fraud, and Beyond.
Braeden Anderson joins fellow panelists for the discussion at Securities Enforcement Forum Central, October 1, 2026.
AI-Washing Is Only the Beginning
AI-washing follows a familiar pattern. We have seen similar cycles with ESG, blockchain and other technologies that become sufficiently important that companies want investors, customers and shareholders to know they are participating in the trend.
Artificial intelligence is different in one respect: the underlying technology itself is becoming more complex faster than many organizations can develop stable governance around it. As I noted during the panel, even “the actual builders and researchers at these companies themselves don’t have a complete understanding of exactly how that model is going to perform.”
That creates a different risk than a simple false marketing claim. The question is no longer only whether a company accurately stated that it uses AI. Firms increasingly need to understand what their models are being asked to do, what information is entering those systems, how outputs are being used, how much authority is being delegated to the technology and how changes in the underlying model alter the risk profile of an application that the firm previously reviewed.
A system that was evaluated six months ago may operate differently after the underlying model changes, even if employees continue accessing it through the same interface. That makes AI governance a continuing process rather than a one-time approval exercise.
AI-Powered Trading Raises a Different Set of Questions
We also discussed what happens as AI moves from generating information to taking action. The financial industry is a particularly useful example.
Investment advisers and other market participants are increasingly considering systems capable of generating recommendations, constructing strategies or executing transactions. Those applications raise questions that are considerably more difficult than whether a chatbot produces an accurate answer. Among them are questions about the data used to train and operate the model. Firms may need to consider whether they can adequately understand and audit the information entering a system, including the possibility that material nonpublic information or other restricted data becomes part of an AI-enabled decision process.
There is also a distinction between using conversational technology as a more efficient interface and delegating actual investment discretion. Telling a system to purchase a defined quantity of a security if a predetermined price threshold is reached may simply make an existing order process easier to use. Telling an autonomous trading system to develop and execute an investment strategy based on current information, overnight news and changing market conditions raises substantially different questions.
Those questions can implicate fiduciary duties, Regulation Best Interest, supervision, registration and the allocation of responsibility among the entities and technologies involved. The reduction in friction is itself significant. A process that once required several deliberate steps can increasingly be accomplished through a conversational instruction. A mistaken click may become a mistaken prompt capable of generating dozens of actions almost immediately.
The legal analysis therefore should focus not merely on whether AI is present, but on what authority has actually been delegated to it.
Regulators Will Still Look Backward
Another issue we discussed is the tension between rapid innovation and retrospective regulatory scrutiny. The current policy environment is plainly supportive of American technological innovation. That does not mean regulators will decline to scrutinize decisions after something goes wrong.
As I put it during the discussion, “regulators love to play Monday morning quarterback.” That is particularly important for AI governance.
There is a tendency to frame the discussion at one of two extremes. One view treats frontier AI as presenting existential risks. The other dismisses much of that concern as exaggerated. For boards, executives and regulated firms, neither extreme is particularly useful. The practical issue lies somewhere between them.
There are real risks that firms need to take seriously even where they do not accept the most dramatic predictions concerning the technology. The appropriate response is continuing monitoring, testing and reassessment as models and capabilities change. That includes understanding not only what a particular system could do when it was initially approved, but what it can do now.
Cybersecurity Remains an Evidence Problem as Much as a Technology Problem
The panel also examined how cybersecurity risk is changing alongside AI adoption. Luke Tenery discussed the continuing threat from credential compromise, data exfiltration, ransomware and other familiar attack methods, as well as the additional complexity created as organizations rapidly expand their technology environments.
One theme was evidence. Organizations increasingly need to be able to reconstruct what happened across traditional security systems and AI systems at the same time. Conventional security logs, endpoint data and incident records may now need to be considered alongside prompts, outputs, model interactions and other AI-related records. FINRA’s 2026 report also addresses cybersecurity and cyber-enabled fraud, including GenAI-enabled threats.
The practical challenge is substantial. These records can be extraordinarily voluminous, and not every interaction presents the same regulatory risk. A defensible approach therefore requires prioritization. Firms need to understand which applications, data, systems and decisions matter most, and preserve sufficient information to explain what occurred if an incident later becomes the subject of litigation, an examination or an enforcement investigation.
Crypto Regulation Is Becoming Clearer, but Fraud Has Not Disappeared
The crypto discussion focused on four SEC developments during 2026: the Commission’s March interpretation regarding crypto assets and investment contracts, the Division of Trading and Markets’ April staff statement concerning certain user interfaces, the Commission’s proposed Regulation Crypto Assets in August, and its September temporary, conditional Innovation Exemption for certain tokenized-securities activity. The April statement presents staff views as an interim step; it is not a Commission rule.
I focused principally on proposed Regulation Crypto Assets. The proposal would establish tailored pathways for certain offerings involving crypto assets. Among other provisions, it includes a startup exemption for offerings of up to $5 million over a four-year period, a larger exemption permitting offerings of up to $75 million during a twelve-month period, and a conditional safe harbor addressing circumstances in which a crypto asset would no longer be treated as subject to an investment contract. These are proposed provisions, not an adopted rule.
The broader policy shift is significant. Market participants are increasingly receiving more defined regulatory pathways rather than being required to reason entirely from general securities-law principles developed for very different markets.
But clearer treatment of the asset does not eliminate the difficult factual questions surrounding the people who create, promote and trade it. During the panel, I described what I think of as the “whale problem.”
The person with the strongest financial incentive to promote a token does not necessarily have to be the person who originally created it or the person who controls its underlying technology. An anonymous actor can create a token, accumulate a substantial position across numerous wallets and then enlist a prominent individual to promote it. The public-facing promoter may receive creator fees or another economic incentive while lacking visibility into the creator’s holdings, wallet network or broader strategy.
That creates difficult questions. Who is actually promoting the asset? Who is directing the activity? Who possesses the relevant information? Does the person publicly associated with the token understand the economic arrangements operating behind the scenes? Is an individual unknowingly participating in a pump-and-dump scheme created by someone else?
Those questions illustrate why regulatory classification is only one part of digital-asset enforcement. As I emphasized during the panel, antifraud, disclosure and market-manipulation issues remain “very, very real.” Greater regulatory clarity may change the perimeter of some securities-law questions. It does not eliminate fraud.
The Enforcement Record Is Being Created Now
The panel concluded by asking each participant for one practical recommendation for boards and regulated firms confronting emerging technology risk. My answer was documentation.
Attendees gather for the Securities Enforcement Forum Central program in Chicago.
Organizations should be continuously testing new technology and monitoring for new risks. But identifying a problem is only half of the process. The record also needs to show what the organization did about it.
That means documenting remediation, mitigation, escalation, control changes and follow-up testing. A file containing repeated identification of the same issue without evidence of a response can look very different in hindsight from a record showing that the issue was identified, assessed, assigned and addressed. My closing point was simple: as firms test new technologies and identify potential issues, they should also be “documenting what we’re doing about it and the steps that we’re taking to mitigate those issues.”
That principle cuts across AI, cybersecurity and digital assets. The underlying technologies will continue to change. The questions asked later by examiners, regulators, plaintiffs and enforcement attorneys will be much more familiar: What did the organization know? What did it do? Who was responsible? Was the response reasonable? And what contemporaneous evidence exists to prove it?
For companies moving quickly into emerging technologies, the answer to those questions is being created now.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
——————————————————-
Click Here For The Original Source.
