October is Cybersecurity Awareness Month, and our colleagues at RM Cyber spent part of it on a question that applies directly to fund managers: where is AI already operating inside your management company, and what data can it see? In an October 8 webinar, Michael Nouguier, Richey May’s CISO and Head of Services for RM Cyber, made the core point plainly: you can’t protect what you can’t see.
For most funds, AI doesn’t arrive dramatically. It comes in through one of two doors.
Two Ways AI Enters a Fund
In-House: The Well-Intentioned Shortcut
It’s late in the quarter-end close. A capital account reconciliation won’t tie, so someone on the finance team pastes the working file into a public chatbot and asks it to find the break. Thirty seconds later, problem solved.
Nothing about that was careless. But they also handed investor-level financial data to a system your firm has no agreement with, and no one filed a ticket because, from where they sat, there was nothing to report.
Out-of-House: The Feature You Didn’t Buy
A fund administration platform, CRM, investor portal, or document management tool you’ve used for years adds an AI assistant in a routine update, sometimes switched on by default. There’s no new contract, purchase order, or due diligence questionnaire.
Neither scenario involves bad intent. Both can leave a firm with AI exposure nobody has inventoried.
Why This Is on Regulators’ Radar
The SEC’s Division of Examinations names AI in its Fiscal Year 2026 Examination Priorities. The Division says it will look at the training and security controls firms use to address new AI-related risks, and whether firms have adequate policies and procedures to monitor or supervise their use of AI, including in back-office operations.
The same document says exams will cover Regulation S-P, including oversight of third-party vendors. The SEC’s 2024 amendments to Regulation S-P apply to SEC-registered investment advisers and other covered institutions and, per the SEC’s fact sheet, require written policies and procedures for service provider oversight, including due diligence and monitoring. Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026.
When a vendor adds AI to a product that touches investor information, the relationship has changed, whether or not the contract did.
What Should Stay Out of Unvetted AI Tools
Each firm defines this in its own policies. Categories fund managers most often treat as sensitive include:
- Investor personally identifiable information (PII), such as Social Security numbers, bank details, and subscription documents.
- LP identities, commitments, capital account balances, and side letter terms
- Nonpublic portfolio company information and deal materials
- Draft financials, NAV calculations, and performance figures before release
- Positions, trading activity, and proprietary strategy details
There’s a second side to this. AI assistants connected to your file shares can search them far faster than any person. Michael’s example was a spreadsheet of Social Security numbers saved somewhere it shouldn’t be. For a fund, the equivalent might be subscription documents in a widely shared folder. In the past, documents without proper access controls could sit buried in folders, and the people who weren’t supposed to see them never noticed. Now they’re just a prompt away.
Where to Start
“If I have a dollar to spend on security, ninety-nine cents of it’s going to go into visibility,” Michael said. His recommended sequence, adapted for funds:
- Define what’s acceptable. Based on your fund’s risk tolerance, set which tools are approved and which data types can go into them. As Michael put it, “If you don’t have a clear definition of what’s acceptable inside of your organization, then everything’s acceptable.”
- Find where AI already lives. The goal isn’t to catch anyone. Review your licensed products and their recent release notes, then ask key service providers which AI features are active, where your data is processed, and whether it’s used to train their models. Monitoring tools can fill in the rest, and RM Cyber helps firms set up and configure tools that show how AI is being used across the organization.
- Tighten data and access. Confirm where sensitive files live and who can reach them, since an AI tool can typically surface whatever its user can access.
- Name owners and train your team. Assign a person, not a department, to each tool, and teach people how to use AI well. “You are the accountable party in your use of AI,” Michael noted.
What’s Next
AI is a real productivity gain for lean fund teams. Using it well comes down to knowing what you have and what it touches. If you’d like to talk through where your firm stands, reach out to Steve Vlasak, Business Development Partner, Alternative Investments Practice, at svlasak@richeymay.com. Steve can connect you with the right members of the RM Cyber team.
