Episode Details

Global Predictions paid the Securities and Exchange Commission 175,000 dollars on March 18, 2024, for calling itself the first regulated AI financial adviser without being able to support the claim. Delphia paid 225,000 dollars in the same action. Both cases charged violations of Section 206.2 and Section 206.4 of the Investment Advisers Act of 1940, and both involved a company describing its own AI capability in terms the underlying technology could not support. That enforcement pattern is the backdrop against which an entire new software category, automated compliance and audit tools for enterprise AI, is now selling itself into finance, health, and defense.

This Substack is reader-supported. To receive new posts and support my work, consider becoming a free or paid subscriber.

The commercial case for these tools is strong on paper. Enterprise AI systems in regulated sectors carry obligations under statutes that predate large language models by decades: the Investment Advisers Act of 1940 for financial advisers, the Health Insurance Portability and Accountability Act of 1996 for health systems, and Federal Acquisition Regulation cybersecurity clauses for defense contractors. Layered on top of those older statutes are two newer reference points. The National Institute of Standards and Technology published its AI Risk Management Framework, organized around four functions the agency labels Map, Measure, Manage, and Govern, as a voluntary structure with no certification mechanism. The International Organization for Standardization published ISO/IEC 42001 in December 2023 as the first certifiable AI management system standard, complete with a two stage audit and a three year recertification cycle.

Platforms including Credo AI, Holistic AI, ModelOp, and Vanta have built businesses mapping enterprise AI deployments against these frameworks. Vanta advertises ISO/IEC 42001 audit readiness within two to four weeks using 70 prebuilt controls. Credo AI markets assessments spanning the EU AI Act, the NIST framework, and ISO/IEC 42001 in a single registry. Amazon Web Services, Anthropic, and Microsoft already hold ISO/IEC 42001 certification as of 2026, and enterprise buyers increasingly ask vendors and each other for the same credential before signing.

Venture capital has priced this shift into how it evaluates the startups building these tools and the startups relying on them. A KPMG Private Enterprise Venture Pulse analysis found that 74 percent of late stage venture deals included a dedicated AI or technical review in 2025, up from 31 percent in 2022. Andreessen Horowitz and Sequoia Capital, the two funds most frequently named as anchor investors in AI unicorns, each manage roughly 90 billion dollars in assets and now run diligence that tests model ownership, training data sourcing, and whether commercial contracts assign AI specific liability rather than relying on generic software as a service language. Four compliance automation startups, Hadrius, Spektr, Iridius, and Haast, raised a combined 67.6 million dollars in 2026 selling directly into that demand.

In contract negotiations over the past year, I have watched enterprise customers try to substitute a vendor’s ISO/IEC 42001 certificate for the indemnification language their own counsel had asked for, and in every instance the certificate covered a process, not the specific output the customer was buying. A certification audit tests whether an organization followed its documented procedures. It does not test whether the underlying AI model produced a biased credit decision, a wrong diagnosis, or a leaked medical record. The Health Insurance Portability and Accountability Act of 1996 does not excuse a data breach because the health system’s AI vendor held a clean audit score, and Section 206 of the Investment Advisers Act of 1940 does not excuse a misleading AI marketing claim because a third party platform generated the language. The