In March 2024, the SEC fined two investment advisers a combined $400,000 for lying about their AI. Not for building bad AI. For claiming they had AI capabilities that literally didn't exist. One firm, Delphia, told clients its machine learning analyzed their spending and social media to "predict which companies and trends are about to make it big." The SEC found that Delphia had never integrated that data into its investment process — not once, across four years of marketing the claim. This is AI washing, and it's now a federal enforcement priority that every enterprise leader needs to understand.
I've spent the last two years building AI systems for high-stakes industries — banking, legal, healthcare — where a single wrong answer can trigger lawsuits, regulatory action, or worse. When the SEC announced these enforcement actions, my first reaction wasn't surprise. It was relief. Because the gap between what companies claim their AI does and what it actually does has been the central problem of this industry, and someone finally decided to do something about it.
$400,000 in Fines for AI That Never Existed
The details of the SEC cases are worth understanding because they reveal how common this problem is.
Delphia, a Toronto-based investment adviser, marketed a "predictive algorithmic model" from 2019 to 2023. The SEC even warned them in 2021 to stop making these claims. They didn't. They kept running the same language in regulatory filings, press releases, and social media. Penalty: $225,000.
Global Predictions, based in San Francisco, called itself "the first regulated AI financial advisor" and promised "expert AI-driven forecasts." When the SEC asked for technical documentation to back those claims, the firm couldn't produce it. Penalty: $175,000.
The SEC didn't need new AI-specific laws to bring these cases. It used existing antifraud statutes — the same rules that have governed financial markets for decades.
SEC Chair Gary Gensler made the message explicit: if you're an investment adviser, broker-dealer, or public company making AI claims, those claims must be truthful and substantiated. The regulatory infrastructure to punish AI washing already exists. What changed is the willingness to use it.
This Isn't Just an SEC Problem
The FTC launched its own campaign — "Operation AI Comply" — targeting AI deception across the broader economy. In January 2025, they settled with DoNotPay, a service that marketed itself as "the world's first robot lawyer." The FTC found the company couldn't substantiate its claim that its AI could replace a human attorney. They've also gone after Evolv Technologies for overstating its AI weapon-detection capabilities in schools, and Rytr LLC for enabling AI-generated fake consumer reviews.
The Department of Justice has entered the arena too. Through its "Justice AI" initiative, federal prosecutors now evaluate a company's ability to manage AI-related risks as part of corporate compliance assessments. They've been instructed to seek harsher penalties when crimes are deliberately facilitated by misused AI.
I had a conversation with our compliance lead after the DOJ announcement, and she put it bluntly: "This isn't three agencies acting independently. This is a coordinated message." She was right. The SEC handles investors, the FTC handles consumers, the DOJ handles criminal liability. Together, they've closed every exit.
Why Most Enterprise AI Can't Survive Scrutiny
Here's what most people miss about AI washing: it's not always intentional fraud. Sometimes it's a genuine misunderstanding of what the technology actually does.
A Large Language Model — the technology behind ChatGPT and similar tools — works by predicting the most likely next word in a sequence. That's it. It has no internal concept of truth. It doesn't "know" anything. It calculates probabilities based on patterns in its training data. When it generates a confident-sounding legal citation or financial figure, it's not retrieving a fact — it's completing a pattern.
Think of it like autocomplete on your phone, but scaled up to an extraordinary degree. Your phone might suggest "on my way" after you type "I'm." An LLM does the same thing with paragraphs of text that sound authoritative but might be entirely fabricated.
For a consumer chatbot helping you plan a vacation, this is fine. For a bank providing mortgage advice or a healthcare system supporting a diagnosis, "statistically plausible" is legally identical to "wrong."
In regulated industries, an AI system that's 95% accurate isn't 95% compliant. It's 100% liable for the 5% it gets wrong.
The majority of enterprise "AI solutions" being sold today are what the industry calls wrappers — applications that call a public API from OpenAI or Anthropic, add some prompt engineering and a user interface, and ship it. These wrappers can't verify their own outputs. They can't trace a claim back to a source document. They can't prove their reasoning to an auditor. I explored this problem in depth in our interactive analysis of the AI washing regulatory landscape, and the pattern is consistent: the companies getting fined aren't outliers. They're representative of how most enterprise AI is built.
Building AI That Can Prove Its Own Answers
When my team started designing systems for regulated industries, we realized early that the core challenge wasn't making AI smarter. It was making AI accountable.
The approach we landed on — and that the industry is slowly converging toward — combines the pattern-recognition power of neural networks with the logical rigor of symbolic systems. In practice, this means the AI doesn't just generate an answer; it proves where that answer came from.
One concrete example: in legal AI, a standard system might retrieve a court case based on how semantically similar a query sounds to the case text. But "similar sounding" doesn't mean "legally relevant." A case that cites a statute isn't the same as a case that overturns it — and a basic retrieval system can't tell the difference.
We use something called a Knowledge Graph, which maps the actual relationships between legal entities. A judicial opinion isn't just a block of text — it's a node connected to other nodes through specific relationships: this case cites that statute, this ruling overrules that precedent, this interpretation applies within this jurisdiction. When our system generates a response, it can only reference a citation if it can trace a verified path through that graph. The model is physically prevented from hallucinating a source.
This is the difference between AI that sounds right and AI that is right.
The Sovereignty Question Nobody's Asking
There's another dimension to AI washing that rarely makes headlines: data sovereignty.
When an enterprise uses a public LLM through an API, its data — client information, proprietary strategies, internal documents — passes through infrastructure it doesn't control. For industries governed by HIPAA, GDPR, or similar regulations, this isn't a preference issue. It's a compliance violation waiting to happen.
I've sat in boardrooms where the CISO asks, "Where does our data go when we use this AI tool?" and nobody can answer. Not the vendor. Not the integration team. Nobody. That silence is a regulatory risk.
The alternative is deploying models within the enterprise's own infrastructure — fully self-hosted behind the company's firewall, or isolated within a private cloud environment. Yes, this requires more investment upfront. But it eliminates the single biggest unknown in most enterprise AI deployments: whether your sensitive data is truly yours.
Governance That Auditors Actually Accept
Technical architecture alone isn't enough. Enterprises need governance frameworks that translate engineering decisions into audit-ready documentation.
Two standards have emerged as the industry benchmarks. The NIST AI Risk Management Framework provides a tactical playbook — it helps teams identify, measure, and manage AI risks in practical terms. It's voluntary, flexible, and fast to implement.
ISO/IEC 42001 goes further. It's a certifiable international standard, meaning a third-party auditor can verify your compliance. When a board member, regulator, or acquisition partner asks "How do you govern your AI?" — an ISO 42001 certification is a concrete answer, not a slide deck.
The smartest organizations I've seen use NIST to build their internal capabilities quickly, then map those capabilities to ISO 42001 for formal, third-party-verified certification.
There's also an emerging practice called an AI Bill of Materials — a comprehensive record of everything that goes into an AI system: training datasets, base models, third-party libraries, infrastructure dependencies. Think of it like a nutrition label for AI. When an auditor asks what's inside your system, the AIBOM is your answer. For the full technical methodology behind these governance approaches, see our detailed research on engineering deterministic trust.
What About Companies That Are Genuinely Trying?
I want to be clear: not every company with imprecise AI marketing is committing fraud. The technology is genuinely confusing, the terminology shifts constantly, and the line between aspiration and deception isn't always obvious from the inside.
The test I use is simple: Can you show your work?
If a regulator, auditor, or sophisticated client asked you to demonstrate exactly how your AI reaches its conclusions — the data it uses, the logic it follows, the sources it cites — could you do it? Not with a demo. Not with a pitch deck. With actual system documentation that traces an output back to its inputs.
If the answer is no, you don't necessarily have a fraud problem. But you have a liability problem that's getting more expensive every quarter.
What Continuous Monitoring Actually Looks Like
Traditional model risk management — the kind banks have used for decades — was built for static models that get reviewed annually. Generative AI doesn't sit still. It interacts with new inputs constantly, and its risk profile shifts with every deployment change.
The metrics that matter for generative AI systems are different from what most teams track:
Grounding rate: What percentage of the AI's claims are supported by verifiable sources?
Hallucination rate: How often does it generate unsupported or false statements?
Human review adherence: For high-stakes decisions, what percentage actually gets reviewed by a person before action is taken?
If you're not measuring these continuously — not quarterly, not annually, but in real time — you're flying blind in a regulatory environment that's adding radar every month.
The Uncomfortable Truth
The SEC's enforcement actions weren't the beginning of AI accountability. They were the end of AI impunity.
I think about this industry in two eras: before March 2024, when you could claim almost anything about your AI and face no consequences, and after, when every claim became a potential exhibit in an enforcement action.
The companies that will thrive in this new era aren't the ones with the most impressive demos. They're the ones that can open the hood and show exactly how their systems work — what data goes in, what logic is applied, what sources support every output, and what happens when the system isn't confident enough to answer.
That's not a technical nice-to-have. It's the new minimum for operating in any regulated industry.
The era of the opaque AI wrapper is over. What replaces it isn't less AI — it's AI that can prove it deserves your trust.
If you're navigating this shift — whether you're a compliance officer trying to audit AI systems you didn't build, or a technical leader trying to make your AI defensible — I'd genuinely like to hear what you're running into. The problems are evolving faster than any single team can track, and the best insights I've gotten this year have come from people working through these challenges in real time.