Chapter 12: The Regulator's View

Regulators are often portrayed as either asleep or overreaching. The reality in 2026 is more interesting. American and European regulators have mostly decided that existing rules already cover AI trading, and they're enforcing those rules against AI claims with growing enthusiasm. Technology-neutral regulation is the theme. What follows is what that means in practice.

The SEC: enforcing old rules against new claims

The SEC's most telling move was actually a retreat. In June 2025, it formally withdrew its 2023 proposal on predictive data analytics conflicts, the rule that would have specifically governed how firms use AI and predictive tech with investors. Instead of writing AI-specific rules, the SEC is applying existing ones.

Its fiscal-2026 examination priorities (published November 2025) keep AI as a standing focus in two areas: the accuracy of firms' AI capability claims, that's the anti-AI-washing mandate behind the Delphia and Global Predictions cases, and whether firms' policies actually supervise the AI they use, from fraud detection to back-office to trading itself. Plus AI-related cybersecurity, because the models are now targets too.

One practical change worth knowing: FINRA's old $25,000 pattern-day-trader minimum was replaced by new intraday margin standards effective June 2026, phasing in through late 2027. If you're an active trader, the margin math changed under you. Check your broker's current requirements.

FINRA: the rulebook for the humans in charge

FINRA's Regulatory Notice 24-09 is the clearest statement of the American approach: the rules are technology-neutral. They don't create new AI requirements. They remind firms that existing supervision, disclosure, and recordkeeping obligations apply to AI systems. Firms must evaluate generative AI before deploying it, and supervisory procedures must address model risk, data privacy and integrity, and model reliability.

The 2026 Annual Regulatory Oversight Report went further, sketching what examiners expect to see: governance and model-risk frameworks, logging of prompts and outputs, model version tracking, human-in-the-loop review, and, for the first time, explicit discussion of AI agent risks. The direction is unmistakable: the more autonomy you give the machine, the more control you're expected to demonstrate.

For individual investors, the key FINRA principle from Chapter 6 bears repeating. AI may surface an investment idea, but a human must verify suitability before acting. Auto-execution based solely on AI output is an examination red flag for firms, and it should be a personal red flag for you.

Europe: the AI Act arrives, with nuance

The EU's AI Act, the world's most comprehensive AI law, began enforcing its applicable rules in August 2026. Most coverage missed the nuance: standard algorithmic trading does not become "high-risk" merely because it uses AI. The listed high-risk finance use is things like credit scoring. Ordinary internal drafting, market surveillance, and algo trading stay under existing financial regulation, primarily MiFID II, whose Article 17 algo-trading obligations (order records, market-maker agreements, system testing) remain the operative law, now with AI governance folded into supervisory expectations.

Meanwhile, MiCA, the crypto-asset regulation, became fully effective in December 2025, bringing transparency and risk-management requirements to automated trading on crypto platforms. And industry surveys show 87% of finance firms keeping their AI use cases internal rather than client-facing, a quiet signal about where firms themselves think the risk-reward stands.

What "technology-neutral" means for you

The regulators' collective bet is that fraud is fraud, supervision is supervision, and recordkeeping is recordkeeping, regardless of whether a neural network is involved. I think they're mostly right, and it gives you a simple heuristic:

Any AI trading operation that can't explain its compliance in terms of the old rules, supervision, audit trails, human accountability, honest marketing, is not "too innovative to regulate." It's just non-compliant.

The firms doing this seriously (the Renaissance and Citadel tier, the regulated robo-advisors, the registered advisers like M1) can all describe their governance in boring detail. Boring detail is the sound of compliance. Excitement is the sound of its absence.

With the map complete, the machines, the data, the speed, the tools, the research, the plumbing, the failures, the frauds, and the rules, we turn to the compass: how a disciplined investor evaluates all of it. That starts with due diligence.