CFTC Commissioner outlines AI, third-party, cyber, and digital-asset governance expectations

What changed

Across a 2025 series culminating in an August roundtable recap, Commissioner Kristin Johnson identified governance expectations for financial-sector AI and digital-asset adoption, including explainability, bias controls, human oversight, post-deployment monitoring, scenario testing, cyber resilience, third-party oversight, incident response and firm accountability. These are an individual commissioner’s nonbinding policy and supervisory signals, not Commission rules.

Who it affects

• CFTC registrants using AI in trading, risk, compliance or surveillance
• Investment advisers and funds using AI or digital-asset infrastructure
• Firms relying on critical technology and data vendors

What is still open

• Whether the Commission will convert these recommendations into rules, staff guidance or examination expectations
• How any future framework will allocate accountability among firms, models and third-party providers

What it means for an advisor

• Treat the remarks as a watch signal; inventory covered AI and digital-asset uses, document human oversight and testing, and strengthen cyber, incident-response and critical-vendor controls without representing the recommendations as binding CFTC requirements.