Dive Deeper
Transcript
Episode Overview
Episode length: 48 minutes | Released November 19, 2025
AI washing, claiming AI capabilities your company does not have, is disclosure fraud, and the SEC has already brought enforcement actions against it.
Rebecca Fike spent a decade at the US Securities and Exchange Commission with subpoena power, working parallel criminal actions with the DOJ and FBI.
Now she is a Chambers-ranked partner at Reed Smith, and the companies calling her for help are the ones she used to come after.
In this episode of CZ and Friends, Fike and GC AI co-founder and CEO Cecilia Ziniti cover AI washing and SEC enforcement, the "scrapbook of the deal" that protects a company when a decision goes bad, and why documentation and process are an in-house lawyer's best friends.
About Rebecca Fike
Rebecca Fike is a partner in the Global Regulatory Enforcement Group at Reed Smith in Dallas, which she joined in July 2025 from Vinson & Elkins.
Before private practice, she spent roughly ten years as senior counsel in the SEC's Division of Enforcement at the Fort Worth Regional Office, leading investigations into corporate disclosures, insider trading, and whistleblower matters, and working parallel criminal actions with the DOJ, the FBI, and the Postal Inspection Service.
She is Chambers-ranked, and Lawdragon notes her work on high-profile matters including the SEC's case involving Nikola founder Trevor Milton. She began her career in private practice in Austin, earned her law degree at the University of Chicago, and has written her blog, Lag Liv, for nearly two decades.
Key Takeaways
Document the deliberation, not just the decision. A timeline that looks fast reads badly once something goes wrong, so a single descriptive bullet on an agenda, or an email showing the draft press release reached the GC, can carry the entire story.
Bad facts that get escalated beat bad facts that get buried. A bad email that reached the CEO, was considered carefully, and was deemed immaterial is protected by the business judgment rule, while the same email stuck with a middle manager becomes a problem.
AI washing is disclosure fraud, not marketing spin. The SEC charged investment advisers Delphia and Global Predictions in March 2024 for claiming AI-driven investment strategies that people at computers were actually running, the same enforcement playbook it uses against greenwashing.
Disclosing AI as a risk factor is the start, not the finish. CEOs and CFOs sign SEC certifications under their own names stating that disclosure controls and internal controls are designed, implemented, and reviewed, so the controls have to actually exist behind the disclosure.
AI belongs in investigations only with a human at the other end. AI-assisted review speeds up document work and internal investigations, but an experienced investigator still has to decide which threads are worth pulling.
What Is AI Washing, and How Is the SEC Enforcing Against It?
AI washing is claiming your company uses AI when it does not, and the SEC treats it as disclosure fraud.
In March 2024, the SEC charged investment advisers Delphia and Global Predictions for false and misleading statements about their purported use of AI; the firms paid \$400,000 in combined civil penalties. Fike's rule from ten years on the enforcement side is simple. You cannot say things you are doing and not do them.
The dynamic is familiar. AI is a buzzword, and customers and investors reward companies that claim it, especially the ones who do not fully understand it. Fike draws a straight line to greenwashing, the last hyped topic that pulled companies into overstating their disclosures.
Fike said:
"There have been a couple of SEC enforcement actions where funds have said, we're using AI to help us figure out the best stocks to put in here. And it turns out, no, they are not. It is still some people at a computer making those decisions. And that is just disclosure fraud."
The same logic applies to ESG, she notes. The SEC disbanded its ESG task force, but the underlying cases were never a separate enforcement arm. A false statement about your environmental impact, your social commitments, or your AI strategy lands in the same place: disclosure fraud, prosecuted the same way it always has been.
Does Disclosing AI as a Risk Factor Satisfy Your Legal Obligation?
No. Disclosing AI as a risk factor is the right first step, and it gets you a lot of the way there, but the obligation runs deeper. It requires demonstrating how you control for the risk you disclosed. Companies now routinely list AI in their risk factors. The next question a regulator asks is what the internal controls and disclosure controls look like in light of that risk.
Fike said:
"You as CEO and CFO sign certifications with your own name that get filed with the SEC that say you have designed, implemented, and reviewed your disclosure controls and your internal controls over financial reporting, and you have deemed them satisfactory. And so having the disclosure is great, but how are you then controlling for that risk?"
Her advice is to keep refining the risk factor on one end, and build the evidence that you are working to control the risk on the inside. Part of evaluating is evaluating; it can take time to figure out, and that is acceptable, as long as the work is happening and captured.
Regulators and legal leaders made the same point at the GC AI Summit on AI regulation, governance, and legal accountability: a defensible AI program is one you can show, not one you can describe.
What Does "Facts Don't Lie" Mean for How Companies Get in Trouble?
Facts don't lie in how a jury, a judge, or the other side will eventually view them. But facts as you read them in an email, or as a witness recalls them years later, mislead constantly. That gap between the record and the recollection is where companies get in trouble, and Fike built her career inside it.
She started in private practice in Austin, drifting toward IP litigation by default rather than by design. When an opening came up at the SEC's Fort Worth regional office, she studied for the interview as hard as she had studied for the bar exam, got the job, and moved her family. She spent the next decade building three-dimensional cases out of emails, texts, phone records, and trading data.
Fike said:
"Facts don't lie in that that is how they are viewed by other people, like the jury, the judge, the other side. But facts, as you read them in an email, a text message, or certainly a person's recollection, those lie all the time."
The lesson she carried into defense work is that the best defense is almost never built in response to a subpoena. It was built years earlier, in meeting invites that named the subject and emails that captured the thinking behind a decision.
What Is the Scrapbook of the Deal?
The scrapbook of the deal is Fike's framework for lightweight, contemporaneous documentation. It creates enough of a record to reconstruct the why behind a major decision years later. No formal record-keeping system required. The reason it matters is context. The government, a plaintiff's attorney, or a jury reads the story backwards, starting from an outcome that went badly. Every document showing your team considered the decision carefully makes that story harder to tell against you.
When Fike opens a new matter and asks the client for notes, emails, and meeting invites, the pattern repeats: meeting invites titled "meeting," email chains that reference a decision without any of the strategy behind it, and a timeline that looks startlingly fast. In one matter, she found more than 1,000 meeting invites that said only "meeting."
Documentation and process, Fike tells clients, are your friend. Fike said:
"You might have a decision that at the time was the right decision and was deeply considered and thought about, but four years later, the only reason you're ever looking backwards is because something bad happened."
What to Include in Your Scrapbook of the Deal
Meeting invites with descriptive subjects that name the matter discussed
Agendas with at least a bullet point capturing the topics considered
Emails that reflect the deliberation around a decision, not the decision alone
A clear paper trail showing who reviewed disclosures and press releases
Evidence that problematic facts traveled up the org chart to the decision makers who needed to know about them
Cecilia lived this framework firsthand at Amazon. She was product counsel when regulators, including then-California Attorney General Kamala Harris, pursued a group of app makers, Amazon among them, over children running up unauthorized in-app purchases.
Amazon fared better than some other defendants in that matter, and part of the reason was leniency tied to internal emails showing the company had been escalating and discussing the complaints, not ignoring them.
How Does the Business Judgment Rule Protect Executives Who Get It Wrong?
The business judgment rule protects executives who made decisions in good faith with the information they had at the time. Being wrong is allowed. What the rule requires is a working flow of information. Bad facts need a clear path up the organization to the people authorized to evaluate them and decide whether they must be disclosed.
Fike said:
"As a defense attorney, I am so much happier to see a very bad email have gone to the CEO or CFO and then decided, this is not material, we don't need to disclose it, than to find a very bad email that did not make its way up there."
The first email is protected. The experts inside the organization saw it, weighed it, and made a judgment covered by disclosure controls and procedures. The second forces defense counsel to explain why the decision makers never knew, from a set-aside view instead of from inside the company.
The CEO cannot and should not know everything; the point is a thoughtful escalation process, so bad sales numbers, unexpected product returns, and ugly emails reach the people who get to decide. That escalation path is the working core of a corporate legal compliance program, and when it does not exist, good intentions will not fill the gap.
Fike said:
"Business leaders are allowed to be wrong. You are allowed to mess up. You're allowed to have bad things happen. That doesn't mean there's any kind of fraud, or a shareholder action that's going to have anything successful. You were doing your best. You were being deliberate, and you were caring for the company in a way that is pursuant to the duties that you owe it."
How Are Defense Lawyers Using AI in SEC Investigations?
Fike's team uses AI-assisted review today, with a case-by-case check on subpoena obligations. She finds AI most useful in internal investigations, where the obligation runs to the client. The team digs in, finds out what happened, and tests whether allegations have substance. AI surfaces search terms, maps how documents connect, and pulls timelines out of a mass of facts. Then an investigator who has done this work decides which threads to pull, because plenty of things look innocuous until you have run a dozen investigations.
Fike said:
"AI is great as long as a human is at the other end of it."
Where Is the Billable Hour Going?
Fike would happily replace the billable hour; entering time is, in her words, the bane of her existence, and the model rewards hours over the efficiency and creativity that should drive defense work. Her own practice points the other way.
In one whistleblower-provision matter, a non-scienter violation with no fraud, she pushed to stop spending on the investigation phase once an action looked likely and negotiate the result directly. The client's cooperation and remediation earned a minimal penalty, and later cases on the same topic settled for many millions more.
Her worry is the junior associates. A senior tax partner's single billed hour carries hundreds of hours of accumulated judgment. A second-year is still learning how to be a lawyer, how to work with a client, and how to pull what matters out of a massive pile of documents, and the only way to learn is practice and watching.
Fike's workaround is frank value conversations with clients. The second-year joins the call because that is cheaper than the partner relaying everything afterward, and the associate learns the facts firsthand.
Why Is Big Law Still a Paid Apprenticeship Worth Taking?
Fike is unabashedly pro Big Law. It is the best practical legal education available, a paid apprenticeship where you watch eight or nine partners practice differently and absorb all of it before developing your own style.
Her advice to new lawyers is to stop evaluating the associate experience and look at the partnership instead. You will be an associate for eight to ten years. You will be a partner or in-house for thirty. The people you learn from matter more than the perks you are offered now.
Fike said:
"Observe and soak up and be a sponge as much as possible. I've now been a lawyer for almost 20 years. Things that I thought would never apply to me, or examples I thought I would never pull from, it's amazing how over time, this happens with parenting too, you think that will never apply to me, or that story isn't going to matter, and then 15 years later you've got a very different situation and you're like, I wonder if that would work here. Same thing with law."
Her other rule is to pick a small number of boundaries that matter to you and hold them, because the firm will not hold them for you. For Fike, that meant nightly dinner at home through three kids, a clerkship-free path from a one-year-old in her first year of practice, and reading fantasy novels on her own time. 10-Ks in the morning, dragons at night.
The scrapbook of the deal starts long before a regulator asks for it, in the meeting invites, agendas, and emails your team creates every day. What does your documentation trail look like right now?
Recommended Reading
What 10 Years at the SEC Taught Rebecca Fike About Fraud, Facts, and Documentation: GC AI's original write-up of this conversation, with Fike's SEC enforcement stories and the scrapbook of the deal framework in full.
Legal Document Review: the AI-assisted review Fike's team runs in internal investigations, where a human still decides which threads to pull.
AI for Compliance Monitoring: the disclosure controls Fike says have to back up an AI risk factor once a company has disclosed one.
