# The regulatory perimeter for AI in asset management
A robo-advisor recommends a leveraged ETF to a retiree with a low risk tolerance. No human reviewed the recommendation. Under the EU AI Act, that system likely sits in the high-risk tier. Under MiFID II, that recommendation may breach suitability rules. Under the SEC's approach to predictive analytics, the conflict baked into the model could trigger enforcement. One decision, three regulators, three different tests.
This lesson maps where AI actually "bites" across portfolio construction, advice, and trading, so you can tell which of your use cases fall inside the regulated perimeter and which do not.
Each regime asks a different question about your model. You need all three answers.
The EU AI Act is horizontal (it applies across all sectors and classifies by risk). MiFID II and the SEC rules are financial-conduct rules that apply to outcomes regardless of whether AI is involved. AI does not get a carve-out; existing obligations still apply.
The Act sorts AI into four buckets: prohibited, high-risk, limited-risk (transparency obligations only), and minimal-risk.
Most asset management AI lands in minimal or limited risk. That is the key nuance many people miss. Portfolio optimization, factor models, and trade-signal generation are generally not automatically high-risk under the Act's Annex III list.
Where it gets sharper:
Practical takeaway: a quant equity model is usually low-risk under the Act, but a retail credit-scoring or client-vulnerability component can pull a product into high-risk. Classify component by component, not app by app.
The European Commission's official summary is a clean starting reference: EU AI Act overview.
If a component lands in the high-risk tier, expect: a risk management system, data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → (documented training data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.Voir la définition complète → and bias testing), technical documentation, logging, human oversight, and accuracy and robustness testing. This is essentially formalized model risk management. If you already run a solid model validation function, you are most of the way there.
MiFID II's suitability obligation requires that any personal recommendation or discretionary portfolio decision match the client's knowledge, experience, financial situation, and objectives (including risk tolerance and, increasingly, sustainability preferences).
An AI advice engine does not lower this bar. It raises the documentation burden.
Concrete failure modes:
The European Securities and Markets Authority (ESMA) has issued guidance emphasizing that firms using AI in investment services remain fully responsible under MiFID II, with senior management accountable. AI is a tool, not a defense.
The US route is different. The SEC in 2023 proposed rules on the use of predictive data analytics (PDA) by broker-dealers and investment advisers. The core concern: when a firm uses AI to optimize for its own revenue (steering clients toward higher-fee products or more trading), that is a conflict of interest, and the firm must eliminate or neutralize it, not just disclose it.
As of early 2026, the specifics of that rulemaking have been contested and reshaped, so treat the exact final text as unsettled. What is durable is the SEC's underlying position: existing fiduciary duty and anti-fraud rules already apply to AI-driven advice. A registered investment adviser owes a duty of care and loyalty regardless of whether a human or a model produces the recommendation.
The SEC has also warned publicly about "AI washing": overstating AI capabilities in marketing. Claiming your fund uses "proprietary AI" when it runs a simple rules engine is a disclosure problem, and the SEC has brought enforcement actions on this theme.
Take a hybrid robo-advisor serving EU retail clients and US clients.
| Component | EU AI Act tier | MiFID II | SEC |
|---|---|---|---|
| Risk-tolerance questionnaire scoring | Limited/minimal | Suitability core | Duty of care |
| Portfolio optimizer | Minimal | Indirect (via suitability) | Fiduciary |
| Product recommendation engine | Limited (transparency) | Suitability + report | Conflicts, PDA concern |
| Margin credit check on client | High-risk | N/A | Fiduciary |
| LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.Voir la définition complète → research summarizer | GPAI provider duties | N/A | AI washing risk |
One product, five different regulatory footprints. This is why "is our AI compliant?" is the wrong question. The right question is "which component, which regime, which tier?"
Vérification des acquis
1. Why can a single AI-driven robo-advisor recommendation trigger scrutiny under the EU AI Act, MiFID II, and the SEC simultaneously?
2. What does it mean that the EU AI Act is a 'horizontal' regulation while MiFID II and SEC rules are not?
3. A firm assumes that because its portfolio optimization model is not 'high-risk' under the EU AI Act, it faces no other AI-related regulatory obligations. Why is this reasoning flawed?
4. Select ALL correct answers about how AI use cases map to the EU AI Act's risk tiers in asset management.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about the distinct questions each regime poses to an AI model.
Sélectionnez toutes les réponses correctes.
Regulators converge on the same practical controls. Build these before you ship, not after.
Maintain a model inventory. For each AI component, record: purpose, EU AI Act tier, MiFID II touchpoint, data sources, and owner. Regulators increasingly expect this on demand.
"Human in the loop" must mean a human who can understand and override, not a rubber stamp. For high-risk components the Act requires it explicitly. Define the override authority and log when it is used.
A suitability recommendation needs a client-facing rationale. A back-office trade-cost estimator does not. Match the explainability effort to the client harm potential.
Set thresholds and alerts. A minimal logging pattern for a recommendation service:
# Log every recommendation for audit and drift detection
log_record = {
"client_id": client.id,
"risk_score": client.risk_score, # from suitability questionnaire
"recommended_product": rec.product_id,
"product_risk_level": rec.risk_level,
"model_version": model.version,
"timestamp": now_utc(),
}
# Compliance flag: recommendation riskier than client tolerance
if rec.risk_level > client.risk_score:
log_record["suitability_flag"] = True
audit_store.write(log_record)That single suitability_flag is the difference between catching a MiFID II breach internally and explaining it to a regulator later.
Have compliance sign off on any external claim about AI. "AI washing" enforcement is a genuine, current risk in the US.
The EU AI Act's high-risk obligations phase in through 2026 and 2027, so build documentation now. ESMA and national regulators are actively supervising AI in investment services. In the US, expect enforcement under existing fiduciary and anti-fraud rules to lead, with the exact PDA rulemaking still in flux. Firms operating across both jurisdictions should design to the stricter standard, which is usually the EU's.