With Regulation S-P compliance now in effect, firms may have the right AI policies, vendor records, and supervisory procedures on paper. But the real regulatory risk lies in whether AI oversight is actually functioning in practice, or whether review processes have quietly drifted into rubber-stamp approvals.