The SEC’s New AI Disclosure Rules and How They Affect Your Firm

TL;DR

SEC’s 2026 AI disclosure rules require professional services firms to disclose material AI use in client work, with penalties for misleading AI claims.
Applies to accounting, law, consulting, and financial advisory firms that use AI in client-facing deliverables.
Three key requirements: disclose AI use in material client work, avoid overstating AI capabilities, and maintain documentation of AI outputs.
Firms that ignore these rules face SEC enforcement actions, client lawsuits, and reputational damage.
Action steps: audit your AI use, update engagement letters, train staff on disclosure requirements, and implement documentation protocols.

I talked to a managing partner at a mid-sized accounting firm a few weeks ago. He told me his team uses AI to draft client reports, summarize tax code changes, and generate preliminary audit notes. When I asked if they had disclosed any of this to clients or documented how the AI was being used, he looked at me like I had asked him to file his taxes in Latin.

He is not alone. Most professional services firms are using AI right now. Most of them have no idea the SEC just changed the rules.

I have watched this pattern before. When Bitcoin started going mainstream in 2020, the regulatory framework took about 18 months to catch up. Firms that ignored the early signals got caught flat-footed. The same thing is happening now with AI. The SEC released its AI disclosure guidance in early 2026, and most professional services firms have not adjusted their practices. That is a problem, and it is about to become an expensive one.

What the SEC Actually Said

The SEC’s new rules center on a straightforward concept: if you use AI in a way that could materially affect a client’s decision or the outcome of your work, you need to disclose it. Material means anything a reasonable client would want to know before relying on your work product.

The guidance has three practical components. First, you must disclose the use of AI in client-facing work where the AI output influences the final deliverable. Second, you cannot make misleading claims about what your AI tools can do. If your AI system drafts tax memos but still needs human review for accuracy, you cannot imply it produces final-grade work independently. Third, you need to maintain documentation of your AI use, including what tools you used, how you validated the outputs, and what human oversight was applied.

The SEC is not banning AI use. They are requiring transparency. That is a different thing entirely, and it is a reasonable standard.

Who This Applies To

The SEC’s jurisdiction extends further than most people realize. Registered investment advisers are the most obvious group, but the rules also apply to accounting firms through the PCAOB, law firms through SEC practice rules, and consultants who work with SEC regulated entities. If your firm touches anything that could end up in an SEC filing, you are in scope.

I have been tracking this closely. I read the full guidance document, something most firm partners have not done. The language is clear. The SEC defines AI broadly to include generative AI, machine learning models, natural language processing tools, and automated decision systems. If you use ChatGPT to draft client communications, you are using AI. If you use a specialized tool that summarizes case law or tax regulations, you are using AI. If you use a document analysis platform that flags anomalies in financial statements, you are using AI.

The scope is wide, and it is intentional.

The Three Biggest Risks

After reading the guidance and talking to compliance professionals, I see three risks that matter most for professional services firms.

Overclaiming AI capabilities. This is the easiest trap to fall into. A firm says their AI system does something it does not actually do reliably. Maybe your marketing materials say your AI generates audit ready reports when in reality a human still reviews every page. That is a misrepresentation. The SEC will treat it as such.

Underdisclosing AI use. This is the more common problem. Your firm uses AI in client work but does not tell the client. You might think it does not matter because the AI output is reviewed by a human. The SEC disagrees. If the AI influences the work, the client has a right to know.

Not documenting AI outputs. This is the operational risk. Even if you disclose properly, you need records of what the AI produced and how you validated it. When a client questions your work or the SEC comes calling, your documentation is your defense. Without it, you are exposed.

What to Do This Week

I am not a compliance consultant, and I do not play one on YouTube. But I have built systems for 50

Learn more at markyegge.com.

Learn more at youtube.com/@aiblindspot.

This is education, not a guarantee of results. Results depend on implementation quality, firm size, and market conditions. Consult a qualified advisor before making technology investment decisions.

By Alex Chen