SEC Enforcement Actions Signal Enhanced Scrutiny Around “AI Washing”

Over the past few years, the use of Artificial Intelligence (“AI”) has exploded across multiple industries and many financial services institutions have come to rely on AI—or claim to rely on AI—to generate, assist, and complete business objectives.  So, too, has the regulatory scrutiny around “AI washing,” or firms’ overstating or misrepresenting their use of AI to attract investors.  Similar to "greenwashing," where regulators have scrutinized public claims by companies that they are more environmentally friendly than they actually are, the concept of AI washing has come into sharp focus for the Securities and Exchange Commission (“SEC”), evidenced by multiple public warnings and two recent enforcement actions.

The SEC’s Recent Focus on “AI Washing”

In late 2023, SEC Chair Gary Gensler first signaled the SEC’s concerns about AI washing, cautioning companies against the practice in blunt terms: “[d]on’t do it . . . I don't know how else to say it.”  On the heels of this speech, in January 2024, the SEC issued an investor alert flagging investment fraud schemes that involved the purported use of AI and other emerging technologies, including companies that falsely claimed they were AI-focused in order to attract investments.

Last month, the Director of the SEC’s Division of Enforcement, Gurbir Grewal, similarly warned companies to ensure that “representations regarding your use of AI are not materially false or misleading.”  In discussing the SEC’s concerns about AI washing, Director Grewal highlighted two recent enforcement actions from March 2024 – discussed below – and also noted that this issue presents risks to public companies as well.

Recent SEC AI Enforcement Actions

On March 18, 2024, the SEC announced separate settlements with two investment advisers, Delphia (USA) Inc. (“Delphia”) and Global Predictions, Inc. (“Global Predictions”) for multiple violations of the Investment Advisers Act of 1940 (the “Advisers Act”) and associated rules, arising from false and misleading statements regarding each firm’s use of AI.  As part of these settlements, Delphia agreed to pay a $225,000 civil money penalty and Global Predictions agreed to pay a $175,000 civil money penalty.

The Delphia Settlement

According to the Delphia settlement order, Delphia ran a robo-adviser business that developed algorithms to manage retail client portfolios based on various investment objectives and risk profiles.  The stated intent was to use AI and machine learning to collect data from Delphia clients as inputs into these algorithms.  Delphia disclosed on its Form ADV brochures from 2019 through 2021, among other things, that its advice was “‘powered by the insights it makes when individuals . . . connect their social media, banking, and other accounts . . . or respond to Delphia’s questionnaires’ which make its investment decisions ‘more robust and accurate[.]’” (alterations in original).  Delphia made similar claims about its use of machine learning and AI in press release statements in December 2019 and on its website from November 2020 through August 2023.

During an examination by the SEC’s Division of Examinations, Delphia admitted in July 2021 that it had not used any of its clients’ data nor created an algorithm to use client data to manage portfolios.  In August 2021, Delphia updated its Form ADV Part 2A to reflect that Delphia was not using client data to make investment decisions, but did not identify these new disclosures in its summary of material changes section in the Form ADV, even though such changes related to a “core part” of Delphia’s retail advisory program. 

Despite these Form ADV changes following the SEC’s examination, Delphia continued to make claims about its use of client data, including in emails to investors that joined Delphia in 2021 and 2022, about how their data was “‘helping [Delphia] train [its] algorithm for pursuing ever better returns,’ and that Delphia ‘will pool your data with everyone else’s to power our algorithm.’” (alterations in original).  Delphia made similar claims on social media about the use of client data for selecting stocks for its investors.

The SEC determined that these public statements were not only misleading, but also material because Delphia represented to current and prospective clients that its use of investing algorithms was a key differentiating characteristic from other advisers.  Further, the SEC found that Delphia failed to adopt and implement policies and procedures reasonably designed to prevent violations of the Advisers Act and the rules thereunder.  Specifically, Delphia lacked policies to ensure advertisements published by Delphia were accurate and did not contain untrue statements, in particular in connection with social media. 

As a result of its conduct, the SEC found Delphia to have violated the Advisers Act rules governing marketing and compliance policies and procedures (specifically, Sections 206(2) and 206(4) of the Advisers Act as well as Advisers Act Rules 206(4)-1 and 206(4)-7).

The Global Predictions Settlement

In the Global Predictions settlement order, the SEC alleged that Global Predictions, a San Francisco-based investment adviser, misled clients to believe that the company used “expert AI-driven forecasts,” when in fact it did not, and also inaccurately claimed, without substantiation, to be the “first regulated AI financial advisor.” 

Apart from its AI claims, Global Predictions also published on its public website hypothetical performance data without disclosing that such data was not based on actual client data and that it was for illustrative purposes only.  Global Prediction also posted testimonials without describing conflicts of interest with persons providing such testimonials; one individual had been an independent contractor for Global Predictions, and the other was a close family member of the Global Predictions CEO.

Separately, Global Predictions’ advisory contract with its retail clients contained representations inconsistent with its Form ADV Part 2A brochure, for example, stating in its contract that Global Predictions does not “give financial or investment advice,” when its Form ADV said it provided investment advice, including through its interactive online platform, PortfolioPilot. 

Similar to Delphia, the SEC charged Global Predictions with compliance failures for failing to implement policies and procedures that required review and approval of marketing materials prior to dissemination, failing to maintain a log of such approvals, and prohibitions on employees’ personal use of social media to promote Global Predictions, without approval.

Like Delphia, the SEC also found Global Predictions to have violated sections 206(2) and 206(4) of the Advisers Act, as well as Advisers Act Rules 206(4)-1(a), 206(4)-1(b), 206(4)-1(d) and 206(4)-7.  As part of its remedial measures, Global Predictions retained a compliance consultant to review its marketing materials. 

Takeaways

In light of the increased regulatory scrutiny around disclosures and representations regarding the use of AI, financial services firms and publicly-traded companies should consider taking the following steps:

• Understand the risks associated with the use of AI as they relate to the company’s business.  Companies should consider whether to create board oversight over AI risks and expertise, as the SEC currently requires with respect to cybersecurity risks.  Companies should consider raising awareness and expertise within the company around AI risks, particularly at the senior executive and board level, including retaining advisors with AI expertise to counsel on such issues.  For example, the use of AI may create conflicts of interest for investment advisers (such as placing its interests ahead of investors in investment decisions), or create so-called “AI hallucinations” (e.g., inaccurate AI predictions) for investment recommendations.  Another risk that Chair Gensler has identified is the potential for market “flash crashes” based on firms relying on the same sets of AI models to trade.
• Conduct a risk assessment including a survey of AI programs and services (both offered for sale and used internally at the company). Using the results of this assessment, companies should evaluate existing policies and procedures related to advertising and marketing to account for these risks in making accurate disclosures.  For investment advisers, such policies should account for Rule 206(4)-7, which requires investment advisers to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and associated rules.  In light of the Delphia and Global Predictions settlements, in-house compliance and legal departments should understand what statements are being made on websites or other materials outside of Form ADVs, particularly in connection with the use of AI technology.
• Ensure disclosures accurately represent and account for the capabilities and limitations of any AI technology used by the company to provide products and services to clients, including risks to customers, potential financial incentives created by AI, and how AI may impact firm activities.
• In particular for investment firms such as venture capital and private equity firms, consider retaining outside experts and counsel to conduct appropriate diligence into claims by potential targets or portfolio companies about the use of AI and how AI may improve business operations or profitability.
• Finally, given the SEC’s recent focus on cybersecurity, including disclosure requirements for public companies, consider what disclosure controls the company has around AI and potential cybersecurity incidents, including an appropriate incident response plan that considers retaining outside counsel and forensic experts, as necessary.