SEC AI-Washing Enforcement: What Counts as a Violation

$400,000. That's what two investment advisers paid the SEC in March 2024 for describing AI capabilities they didn't actually have — the first cases the agency explicitly framed as "AI-washing." Two more followed within a year, including one against a public company's SEC filings rather than an adviser's marketing page. None of the four needed a new statute. The SEC built every one of them on securities law that existed years, in some cases decades, before generative AI became a pitch-deck staple.

That's the detail compliance teams keep missing: there is no SEC "AI rule" to check against and clear. There's the ordinary antifraud and disclosure framework that already governs what a regulated firm can tell investors, applied to a claim that happens to be about AI. If your firm's marketing describes an AI capability nobody has actually tested against what the system does today, you're not in a gray area waiting on future rulemaking — you're already inside the same legal exposure Delphia, Global Predictions, Rimar Capital, and Presto Automation found out about the hard way.

The provisions doing all the work

For investment advisers, the SEC reaches AI-washing through Section 206(2) and Section 206(4) of the Investment Advisers Act of 1940 — the general antifraud provisions barring an adviser from defrauding a client or engaging in conduct that's fraudulent, deceptive, or manipulative — plus Rule 206(4)-1, the Marketing Rule, which specifically bars advertisements containing an untrue statement of material fact or omitting a fact needed to keep the ad from being misleading. None of that language mentions AI. It doesn't need to: a false statement about a proprietary AI-driven stock-picking model is a false statement about "the investment process," a category the Marketing Rule has always covered.

For public companies, the toolkit shifts to the Exchange Act's ordinary reporting regime: Section 13(a), which requires accurate periodic filings, and Rules 13a-11 and 13a-15(a), which require adequate disclosure controls and procedures, alongside Securities Act Section 17(a)'s general fraud-in-the-offer-or-sale-of-securities prohibition. Same pattern as the FTC's approach to AI marketing claims under Section 5 — an agency reaching a new kind of claim with an old, technology-neutral statute, rather than waiting for Congress to write an AI-specific one.

Delphia and Global Predictions: the cases that started it

On March 18, 2024, the SEC announced settled charges against Delphia (USA) Inc. and Global Predictions Inc., both registered investment advisers, for violating Section 206(2), Section 206(4), and the Marketing Rule. Delphia's marketing had claimed the firm "put[s] collective data to work to make our artificial intelligence smarter so it can predict which companies and trends are about to make it big and invest in them before everyone else." The SEC's finding was blunt: Delphia did not have the AI and machine-learning capability the claim described. Global Predictions faced a parallel finding over its own overstated AI and expertise claims in advertisements and on its website.

Both firms settled without admitting or denying the SEC's findings. Delphia agreed to a $225,000 civil penalty and Global Predictions to $175,000 — $400,000 combined, plus censures and cease-and-desist orders. Notably, neither firm was accused of harming a client's actual investment returns; the violation was the marketing claim itself, independent of performance. That's a distinction worth sitting with, because it means "the strategy still worked out fine for clients" is not a defense to a Marketing Rule violation. The rule protects the accuracy of the claim, not just the outcome behind it.

Rimar Capital: when the AI story is the whole fraud

Delphia and Global Predictions were operating advisory businesses that oversold one feature. Rimar Capital's AI claim was the entire pitch. Between May 2022 and April 2023, Rimar Capital entities and their owner, Itai Liptz, raised nearly $4 million from 45 investors on the promise of AI-driven automated trading across equities, futures, and crypto assets in advisory client accounts. The SEC's October 2024 charges alleged the AI-driven trading capability was misrepresented — investors were funding a system that didn't perform as described, not just a firm with a rough patch of imprecise marketing.

The penalties reflect that difference in severity. Liptz agreed to pay more than $202,000 in disgorgement, over $11,000 in prejudgment interest, a $250,000 civil penalty, and accepted a five-year bar from serving as an officer or director of a public company or investment adviser. A Rimar USA board member, Clifford Boro, separately agreed to a $60,000 penalty. Where Delphia and Global Predictions look like a marketing department that got ahead of engineering reality, Rimar Capital looks like a fundraising scheme that used "AI" as the mechanism investors were told would generate the returns — which is why it drew individual, not just corporate, liability.

Presto Automation: the theory reaches a public company's own filings

Every case above involved an investment adviser. In January 2025, the SEC charged Presto Automation Inc., a public company, over statements about Presto Voice, its AI-powered drive-thru ordering product. Presto had told investors the technology "eliminated the need for human order taking." The SEC's order alleged that was false: the units running Presto's proprietary voice technology lacked the capability to take orders unassisted, and the company had hired, trained, and supervised human order-takers — based largely in the Philippines and India — who processed the substantial majority of drive-thru orders placed through the system.

The charges — Securities Act Section 17(a)(2), Exchange Act Section 13(a), and disclosure-controls Rules 13a-11 and 13a-15(a) — are a different statutory family from the Advisers Act provisions used against Delphia, Global Predictions, and Rimar Capital, because Presto isn't an adviser making claims to clients; it's an issuer making claims to public shareholders and the market. The SEC settled for a cease-and-desist order with no civil penalty, citing Presto's financial condition and remedial steps — a reminder that penalty amount tracks a company's ability to pay and its cooperation, not the underlying legal theory. The theory itself is the point: any public company's earnings call, investor deck, or 10-K disclosure describing an AI capability is now inside the same enforcement lane as an adviser's marketing page.

Meridian Advisory Partners: a claim that looks fine until someone tests it

Picture Meridian Advisory Partners, a mid-sized RIA that licenses a portfolio-optimization tool it brands "AdaptIQ" and describes on its website as software that "continuously re-optimizes every client portfolio in real time using machine learning." In reality, AdaptIQ runs a quarterly rebalancing job built on a fairly conventional mean-variance optimizer, with a lightweight classifier that only adjusts risk-band assumptions — nothing that trades or reallocates in real time, and nothing a securities lawyer would call "continuous."

That claim fails the same way Delphia's did: it's specific enough to test, and it doesn't survive the test. "Continuously re-optimizes in real time" is a factual, falsifiable description of system behavior, not a vague aspiration — an examiner can ask for logs and immediately see a quarterly cadence instead. The fix isn't dropping the word "AI" from Meridian's marketing; AdaptIQ's classifier genuinely is a machine-learning component. The fix is matching the claim to what the system provably does: "a quarterly portfolio review that uses a machine-learning model to help set risk-band assumptions, reviewed and approved by our investment committee" is defensible, specific, and true. "Continuously re-optimizes in real time" is a claim nobody at Meridian actually checked against the code before it went on the website — exactly the gap that turned Delphia's and Presto's marketing into a case.

The one test that would have caught all four cases

Strip away the differences in dollar amounts and defendants, and the same failure repeats four times: someone in marketing, sales, or investor relations wrote a specific, testable claim about what an AI system does, and nobody with the ability to check the system's actual behavior signed off before it went out. Delphia's "predict which companies... are about to make it big," Rimar's autonomous multi-asset trading, and Presto's "eliminated the need for human order taking" are all claims a single engineer could have confirmed or falsified in an afternoon.

That's the practical control worth building before the SEC builds it for you: route every AI capability claim — marketing copy, an investor pitch, a 10-K risk factor or MD&A line — through someone who can test the system's current behavior, not just someone who knows the roadmap. The same documentation discipline the NIST AI RMF's Govern function recommends for high-stakes models — a dated record of what a system was validated to do, and by whom — doubles as the evidence a firm needs if an examiner ever asks how a claim was substantiated. And the broader lesson generalizes past the SEC specifically: as our overview of federal AI regulation covers, agencies from the CFPB to the FTC to the FCC, which settled in 2024 that an AI-cloned voice is still an "artificial voice" under the TCPA are all reaching AI-specific fact patterns through old, technology-neutral statutes, which means "there's no AI-specific law on this" has stopped being a useful compliance answer to any regulator that already has a fraud or disclosure statute on the books.