In March 2024, the SEC fined two investment advisory firms a combined $400,000 for lying about their AI. Not for building bad AI. For claiming to have AI they never actually built. This was the first-ever federal enforcement action for AI washing — the practice of exaggerating or fabricating artificial intelligence capabilities — and it marked a permanent shift in how enterprises must think about their technology claims.
One firm said it used machine learning to analyze clients' spending habits and social media activity to predict market trends. It never integrated any of that data. The other called itself "the first regulated AI financial advisor." It couldn't produce the technical documentation to back that up. Both got caught. Both paid.
We've spent the past year studying this regulatory shift and its technical implications, and the conclusion is stark: the era of vague AI marketing is over. What's replacing it is a demand for verifiable, auditable AI systems — and most enterprise AI stacks aren't built to survive that scrutiny.
We explored the full scope of this regulatory and technical landscape in our interactive analysis, and the picture is more urgent than most executives realize.
It's Not Just the SEC
The Securities and Exchange Commission's cases against Delphia and Global Predictions were the opening salvo, not an isolated event. The Federal Trade Commission launched its own campaign — "Operation AI Comply" — targeting deceptive AI claims across the broader economy.
One notable case: the FTC went after DoNotPay, a service that marketed itself as "the world's first robot lawyer." The company couldn't prove its AI could actually replace a human attorney or produce legally sound documents. It was barred from making those claims and forced to settle.
The Department of Justice has entered the picture too, announcing that federal prosecutors will seek harsher penalties for crimes facilitated by AI misuse and will evaluate a company's AI risk management as part of corporate compliance assessments.
The crackdown isn't coming from one agency. It's a coordinated, government-wide consensus that AI deception is a serious threat to markets and consumers.
This means the liability chain now stretches from the company making the AI claim, to the vendor providing the underlying technology, all the way to the infrastructure it runs on. If your "AI-powered" product is really just a chatbot with a fancy interface sitting on top of someone else's API, every link in that chain is exposed.
Why Most Enterprise AI Fails the Truth Test
The technical root of AI washing is a fundamental misunderstanding of how large language models (LLMs) — the technology behind tools like ChatGPT — actually work.
An LLM doesn't "know" things. It predicts the next word in a sequence based on patterns it absorbed during training. Think of it like an extraordinarily sophisticated autocomplete. When it generates a confident-sounding legal citation or financial figure, it's not retrieving a fact from a database. It's producing the sequence of words that is statistically most likely to follow the previous ones. Sometimes that sequence happens to be correct. Sometimes it isn't. The model genuinely cannot tell the difference.
For consumer applications — drafting an email, brainstorming ideas — this is fine. For a bank giving mortgage advice or a healthcare provider supporting a diagnosis, "statistically plausible" is legally indistinguishable from "wrong."
This is where the "wrapper" problem comes in. The majority of products marketed as AI solutions today are thin layers of user interface and prompt engineering sitting on top of a public API from OpenAI, Anthropic, or Google. These wrappers are optimized for speed and low cost, not for accuracy or auditability. They can't verify their own reasoning. They can't trace a claim back to a specific source document. And they can't guarantee that sensitive data won't leak to external servers.
A wrapper relays whatever the base model produces to the user, regardless of whether it's true. That's not an AI solution. That's a liability delivery system.
Building AI That Can Prove Its Own Answers
So what does an AI system look like when it's engineered for truth instead of speed-to-market?
The approach we advocate — and what our team builds — centers on combining the pattern-recognition strengths of neural networks with the rigor of formal logic. The industry calls this neuro-symbolic architecture. We call it building AI that can show its work.
One critical piece is rethinking how AI retrieves information. Most enterprise AI uses a technique called RAG — Retrieval-Augmented Generation — where the system searches a collection of documents to find relevant context before generating a response. Standard RAG works by finding documents that are semantically similar to the question. It's a fuzzy match. It might find the right document, but it can't distinguish between a legal precedent that's still valid and one that was overturned last year.
Citation-Enforced GraphRAG replaces that fuzzy search with a structured knowledge graph — a map of verified relationships between pieces of information. In a legal context, for example, every judicial opinion is connected to other opinions through specific, labeled relationships: this case cites that one, this ruling overrules that one, this statute interprets that regulation. When the AI generates a response, the system physically prevents it from citing a source unless it can trace a verified path through the graph.
The difference matters enormously. In our testing, standard RAG systems cannot reliably distinguish between a case being cited approvingly and a case being cited because it was overruled. GraphRAG can, because the relationship is explicit and verified — not inferred from word proximity.
The second piece is multi-agent orchestration. Instead of asking one AI model to research, verify, and write simultaneously — which is like asking one person to be the reporter, fact-checker, and editor on the same story — a robust system uses specialized agents. One retrieves raw information. Another cross-references it against the knowledge graph. A third produces the final output using only verified facts. These agents review each other's work in iterative cycles before anything reaches a human reviewer.
For the full technical methodology behind these architectures, see our detailed research.
Your Data Can't Live on Someone Else's Server
For enterprises in banking, healthcare, legal services, or defense, there's a non-negotiable requirement that most AI wrappers simply can't meet: data sovereignty. Laws like HIPAA, GDPR, and the CCPA require that sensitive information stays within controlled environments. Public LLMs, running on shared infrastructure with opaque data policies, are disqualified from the start.
The alternative is deploying AI models within the enterprise's own infrastructure — on-premises servers, private cloud environments, or dedicated virtual private clouds. Yes, this requires more upfront investment. But it provides something no public API can: a guarantee that client data, trade secrets, and intellectual property never leave your governance framework.
Data sovereignty isn't a security preference. It's a regulatory requirement. And it's the first thing an auditor will check.
The Governance Stack: Frameworks, Audits, and the AI Bill of Materials
Technical architecture alone isn't enough. Enterprises need governance structures that can withstand regulatory scrutiny — and two frameworks have emerged as the industry standards.
The NIST AI Risk Management Framework is a voluntary, tactical guide published by the National Institute of Standards and Technology. It helps organizations identify, measure, and manage AI risks. Think of it as the playbook for building internal capabilities and establishing a common language between your technical and compliance teams.
ISO/IEC 42001 goes further. It's a certifiable international standard, meaning a third-party auditor can verify your compliance. That certification becomes critical for procurement screenings, board reporting, and regulatory submissions. Smart organizations sequence both: use NIST to build agile controls quickly, then map those controls to ISO 42001's requirements for formal, auditable trust.
One emerging tool deserves particular attention: the AI Bill of Materials (AIBOM). Just as a software bill of materials tracks every component in a software product, an AIBOM records everything that goes into an AI system — training datasets, base models, third-party libraries, infrastructure dependencies. It makes AI transparency concrete and machine-readable instead of aspirational. When an auditor asks "what's in your model?", the AIBOM is the answer.
Enterprises should also prepare for rigorous technical audits that go beyond surface-level testing. The standard is shifting toward what researchers call "outside-the-box" access — auditors reviewing not just what the system outputs, but how it was trained, what data it uses, and whether its documentation matches reality. If your AI system is treated as an opaque black box, it will increasingly fail both regulatory and investor scrutiny.
What About Smaller Companies Without Massive AI Budgets?
This is the most common objection we hear: "We're not a bank with a $50 million AI budget. Does this apply to us?"
It does — but proportionally. The SEC didn't fine Delphia and Global Predictions because they lacked cutting-edge technology. It fined them because they claimed to have capabilities they didn't possess. The first and most important step for any company is brutally simple: make sure your marketing matches your technology. Audit your website, your pitch decks, your regulatory filings. If you say "AI-powered," can you explain exactly what the AI does?
For companies that genuinely are building AI into their products, the governance frameworks scale down. You don't need a full ISO 42001 certification on day one. But you do need documentation — what data your model uses, how it was trained, what its known limitations are. Start with an AIBOM. Start with a human review process for high-stakes outputs. These are not expensive. They're disciplined.
Will This Regulatory Pressure Slow Down AI Innovation?
We don't think so. In fact, we think it accelerates the right kind of innovation. When companies can no longer compete by exaggerating their AI capabilities, the competitive advantage shifts to firms that have done the hard engineering work — building systems that are accurate, auditable, and sovereign.
The parallel to financial regulation is instructive. After Sarbanes-Oxley imposed strict accounting standards in 2002, companies didn't stop innovating in financial services. They just couldn't lie about their numbers anymore. The same dynamic is playing out with AI. The companies that thrive will be the ones whose technology can withstand the same level of scrutiny that we already apply to financial statements.
What This Means for Your Organization
The regulatory message from 2024 forward is unambiguous: if you claim your product uses AI, you must be able to prove it. Not in a marketing deck. In front of an auditor, a regulator, or a federal judge.
Four things every enterprise should be doing now:
Audit your claims. Compare every public statement about AI to the technical reality. Close the gaps or change the language.
Demand architectural transparency from vendors. If your AI vendor can't explain how their system reaches its conclusions, that's not a feature — it's a risk.
Start building your AIBOM. Document your training data, model versions, and third-party dependencies. Make it a living document, updated with every deployment.
Adopt a governance framework. Use NIST AI RMF to build immediate controls. Plan a path toward ISO 42001 certification if you operate in a regulated industry.
The firms that treat this moment as a compliance burden will fall behind. The ones that treat it as an engineering challenge — building AI systems that are truthful by design, not just by intention — will earn the trust that regulators, investors, and customers are now explicitly demanding.
We'd welcome hearing how your organization is navigating this shift. The challenges are real, and the solutions are still being invented.