An AI acceptable use policy for an RIA is the written rule set that says which AI tools staff may use, what client data may go into them, who reviews AI output before it reaches a client or the public, and which records the firm keeps. No SEC rule addresses adviser AI use specifically, so the policy rests on rules already in force: Rule 206(4)-7, Regulation S-P, Rule 204-2 and the Marketing Rule.
The rules cited here apply to SEC-registered advisers. A state-registered adviser should also check its state securities regulator's requirements.
What is an AI acceptable use policy for an RIA?
It is the part of your compliance manual that governs AI tools: chat assistants such as ChatGPT and Claude, AI features built into software you already pay for (CRM, email, note-takers, portfolio tools), and anything an advisor installs on their own. A useful policy names the approved tools, says what each may be used for and with which data, puts a person between AI output and anything a client or the public sees, and says how the firm keeps the records.
A policy that only commits the firm to "responsible use of AI" in general terms fails at the first follow-up question. The exam priorities quoted below ask whether firms have "implemented" adequate policies, so expect the examiner to compare the policy with what staff do in practice. If the policy says client data never enters an unapproved tool, expect to be asked how you know.
Does the SEC have a rule on how RIAs use AI?
No. In 2023 the SEC proposed rules on conflicts of interest in broker-dealers' and advisers' use of predictive data analytics, which would have reached many AI tools. On June 12, 2025 the Commission withdrew that proposal along with 13 others, stating that "If the Commission decides to pursue future regulatory action in any of these areas, it will issue a new proposed rule." Until the Commission proposes something new, no AI-specific rule applies to advisers.
That leaves the existing rules, and the examination staff has said how it will apply them. The Division of Examinations' fiscal 2027 examination priorities, released October 23, 2026, note that firms are using generative AI tools, which the Division calls "super intelligence (SI)," to "support research, drafting, coding, and client communications." The Division says it "is intensifying its efforts to understand how the technologies influence outcomes and whether firms continue to comply with existing, technology-neutral obligations," and will prioritize "policies and procedures relating to monitoring SI." The fiscal 2026 priorities before them said the Division "will review for accuracy registrant representations regarding their AI capabilities" and "will assess whether firms have implemented adequate policies and procedures to monitor and/or supervise their use of AI technologies." The priorities are staff statements with no legal force of their own, but they tell you what the exam team will look at.
Dual registrants have a parallel signal from FINRA. Regulatory Notice 24-09 says FINRA's rules "apply when member firms use AI, including Gen AI or similar technologies, in the course of their business."
What does Claude for Financial Advisors change for your AI policy?
On September 14, 2026 Anthropic launched Claude for Financial Advisors, with connectors to systems advisors use every day, including Schwab (not yet released), Orion, Envestnet, Addepar, SS&C Black Diamond, Wealthbox and Vanguard. Its compliance skill "screens client-facing language against the SEC Marketing Rule" and "includes a self-guided AI-policy workflow that helps firms document their use of AI under SEC rules." Anthropic recommends Enterprise plans for RIAs because "it includes the audit logs that support recordkeeping," and says approval is "required on critical tasks."
Two things change for your policy. The tool tells your advisors that firms need an AI policy, so they will expect yours to exist. And a connector changes what "approved data" means. An assistant connected to the CRM or the custodian reads client nonpublic personal information directly, so each connector is a data-sharing decision the firm has to approve, put in the vendor file and supervise. A vendor's workflow can help you write things down. The policy, the supervision and the records remain the firm's job under Rule 206(4)-7.
What should an RIA AI policy cover?
Ten sections cover what the rules reach and what examiners ask about. The template below follows this order.
| Policy section | What it covers | Rule it answers to |
|---|---|---|
| Scope and definitions | Which tools and features count as AI | Rule 206(4)-7 |
| Approved tools register | Which tools, plans and connectors are allowed, for what | Rule 206(4)-7; Reg S-P |
| Data rules | What may and may not go into each tool | Reg S-P 248.30; Advisers Act Section 204A |
| Human review | Who checks AI output before it is used | Rule 206(4)-7; fiduciary duty |
| Client communications and records | What gets kept, and where | Rule 204-2 |
| Marketing and AI-drafted content | Pre-use review of anything public | Rule 206(4)-1 |
| How the firm describes its AI use | Form ADV, marketing and client statements stay accurate | Rule 206(4)-1; Form ADV Part 2A Item 8 |
| Vendor due diligence | Diligence before approval, monitoring after | Reg S-P 248.30(a)(5) |
| Supervision and testing | How the CCO checks the policy works | Rule 206(4)-7(a) and (b) |
| Training, attestation and exceptions | Who has read it, and what happens on a breach | Rule 206(4)-7; Rule 204A-1 if folded into the Code of Ethics |
Which rule does each section answer to?
Client data and Regulation S-P
Regulation S-P requires every SEC-registered adviser to maintain written policies and procedures with administrative, technical and physical safeguards for customer information. After the 2024 amendments, it also requires written policies "reasonably designed to require oversight, including through due diligence and monitoring, of service providers." Those policies must be reasonably designed to ensure the provider notifies the firm "as soon as possible, but no later than 72 hours after becoming aware" of a breach of a customer information system it maintains. Our Regulation S-P guide covers the full rule.
An AI vendor whose tool receives client information is a service provider under that clause. The rule asks for reasonably designed policies and does not dictate contract language, but a contract term is the most direct evidence that the provider has agreed to protect the data and report a breach in time. A personal consumer account has no contract with the firm, no breach-notice term and no firm-controlled retention, which is why the template bans client data in personal accounts outright.
Material nonpublic information gets the same treatment for a different reason. Section 204A of the Advisers Act requires written policies reasonably designed to prevent its misuse, and an AI tool whose prompts the vendor retains is one more place it can leak.
Records and Rule 204-2
Rule 204-2 does not mention AI, and it does not require a log of every prompt. It defines records by content. Paragraph (a)(7) covers written communications sent and received relating to advice, recommendations, orders and the movement of funds or securities. Paragraph (a)(11) covers every advertisement. Most records must be kept at least five years, the first two in an appropriate office of the adviser. Advertisements are kept five years from the end of the fiscal year in which they were last disseminated.
So an AI-drafted email to a client about a recommendation is an (a)(7) record whether a person or a model wrote it. If an advisor writes that message inside a chat assistant and pastes it into email, the sent email lands in the firm's email archive like any other email. If the assistant sends it, or the client conversation happens inside the assistant, the record lives with the AI vendor.
Plan tiers decide whether you can keep it. Anthropic's Compliance API, which exposes chats for archiving, is part of its Enterprise offering, and per its Compliance API FAQ a chat a user deletes comes back without its content. OpenAI's compliance platform is limited to Enterprise and Edu workspaces, keeps logs for 30 days, and tells customers who need longer retention to download and keep the logs themselves. So the policy should approve a tool for work that may create a required record only on a plan the firm can archive, and someone should pull those records before they age out. Where the firm cannot archive a tool, the policy should prohibit that use. RegFin can archive Claude Enterprise and ChatGPT Enterprise chats for six years, so a firm on those plans can approve them for record-creating work.
AI-drafted marketing and the Marketing Rule
The Marketing Rule applies to every advertisement whoever drafted it. An advertisement may not include an untrue statement of material fact, and it may not include a material statement of fact that the adviser has no reasonable basis to believe it can substantiate on demand by the SEC. AI drafting tools can invent statistics, performance figures and client outcomes and state them with fluent confidence, which makes the substantiation clause the one most likely to bite. The policy should send every AI-drafted advertisement through the same pre-use review as any other, with the reviewer checking each factual claim against a source. Our Marketing Rule guide covers the full checklist.
Describing your own AI use: AI washing and Form ADV
On March 18, 2024 the SEC settled charges against two advisers for false and misleading statements about their use of AI. Delphia (USA) Inc. made the statements in its SEC filings, a press release and its website, and agreed to pay a $225,000 civil penalty. Global Predictions Inc. made them on its website and social media, including calling itself the "first regulated AI financial advisor," and agreed to pay $175,000. Then-Chair Gary Gensler said "Such AI washing hurts investors."
Both recent sets of exam priorities make the accuracy of firms' statements about their technology an exam item, so the policy should name one person (usually the CCO) who approves any statement about the firm's AI use in Form ADV, marketing, RFP responses or client letters. If AI shapes investment advice, Form ADV Part 2A Item 8 already asks you to describe your methods of analysis and the material risks of each significant method. Describe the AI only as it works.
Supervision and testing under Rule 206(4)-7
Rule 206(4)-7 requires written policies and procedures reasonably designed to prevent violations of the Advisers Act by the firm and its supervised persons, an annual review of their adequacy and the effectiveness of their implementation, and a designated CCO. For AI that means the policy needs a testing plan: periodic samples of AI-assisted work, a check that only approved tools are in use, and a record of what was found. Rule 204-2(a)(17) requires the firm to keep its policies and any records documenting the annual review. Fold the AI testing into your annual compliance review.
The Division's September 14, 2026 risk alert on annual compliance reviews shows where firms fall short. Staff saw advisers treat compliance training or annual attestations as a substitute for the review itself, and advisers that tested and recommended fixes during the review but did not keep that documentation in their books and records. For an AI policy, signed acknowledgments are not testing, and the testing has to leave a record.
AI acceptable use policy template for RIAs
Copy this into your compliance manual, or start from the Word version above, and replace each bracketed item. It is written to stand alone. It is a starting point and is not legal advice, so have your counsel or compliance consultant review it against your firm's business before you adopt it. Sections 2 and 9 need your firm's real tools and real testing schedule. Without them the policy is only a statement of intent.
1. Purpose and scope
1.1 This policy governs the use of artificial intelligence tools by [Firm Name] ("the Firm") and its supervised persons. It forms part of the Firm's compliance policies and procedures adopted under Rule 206(4)-7 of the Investment Advisers Act of 1940.
1.2 "AI tool" means any software that generates text, summaries, analysis, images, audio transcripts or recommendations using a machine-learning model. This includes standalone assistants (for example, chat assistants), AI features inside other software the Firm uses (CRM, email, meeting note-takers, portfolio and planning tools), browser extensions, and connectors that let an AI tool read or change data in another Firm system.
1.3 This policy applies to every supervised person, on Firm devices and on personal devices used for Firm business, and to Firm business conducted through any AI tool.
1.4 The Chief Compliance Officer ("CCO") administers this policy. [Name or title] is responsible for the approved tools register in Section 2.
2. Approved AI tools register
2.1 Only AI tools listed in the Firm's approved tools register may be used for Firm business. The register records, for each tool: the vendor and product; the plan or tier approved; the uses permitted; the data classes permitted (Section 3); any connectors approved and the systems they can reach; whether the tool can send communications or change records, and the approval step required; how records are retained (Section 5); the date of the last vendor review; and the business owner.
2.2 A tool approved on one plan is not approved on another. Personal or consumer accounts of an approved product are unapproved tools.
2.3 Adding a tool, a plan or a connector requires the CCO's written approval after the vendor review in Section 8.
2.4 Current register as of [date]:
| Tool and plan | Permitted uses | Data permitted | Connectors | Records |
|---|---|---|---|---|
| [Tool, plan] | [e.g., drafting internal documents, summarizing public research] | [e.g., public and internal only] | [none] | [where kept] |
| [Tool, plan] | [e.g., drafting client emails for advisor review] | [e.g., client NPI permitted] | [e.g., CRM, read only] | [e.g., vendor compliance export, retained by the Firm] |
3. Data rules
3.1 Data classes: Public; Internal; Confidential (Firm business information not about clients); Client NPI (any nonpublic personal information about a client or prospective client); MNPI (material nonpublic information about any issuer).
3.2 Client NPI may be entered into, uploaded to or made reachable by connector only in tools whose register entry permits Client NPI.
3.3 MNPI may not be entered into any AI tool unless the CCO has approved that specific use in writing.
3.4 Passwords, authentication tokens, recovery codes and multi-factor authentication codes are never entered into any AI tool. Full account numbers, Social Security numbers and other highly sensitive identifiers may be entered only where the register entry permits them for a named, documented business use the CCO has approved.
3.5 Supervised persons may not connect an AI tool to a Firm system (CRM, email, custodian, document storage, RegFin or any other) unless the register lists that connector.
4. Human review
4.1 AI output is a draft. A supervised person who uses AI output is responsible for it as if they wrote it.
4.2 Before AI output is used in investment advice, a client communication, a regulatory filing or a compliance decision, the supervised person reviews it for accuracy, checks factual statements against a source, and confirms it is consistent with the client's profile and the Firm's policies.
4.3 An AI tool may not send a communication to a client, place or change an order, or change a Firm record without a person approving that specific action, unless the CCO has approved an exception in writing and recorded it in the register.
5. Client communications and records
5.1 Communications drafted with AI are subject to the same recordkeeping and supervision as any other communication, under Rule 204-2 and the Firm's [communications policy].
5.2 AI tools may be used to conduct or send client communications only on plans where the Firm can retain those communications for the periods Rule 204-2 requires. Where the vendor's retention is shorter than the Firm's obligation, [Name or title] exports and retains the records on [schedule].
5.3 Required records created in or through an AI tool are captured into the Firm's archive under [the Firm's retention procedures]. The Firm does not rely on supervised persons keeping conversations in the AI provider's application, and supervised persons may not delete an AI conversation that contains or produced a required record before it is archived.
5.4 Meeting recordings and transcripts produced by AI note-takers are kept under [the Firm's meeting-records procedure]. Clients are told when a meeting is recorded [consistent with applicable state consent laws].
6. Marketing and AI-drafted content
6.1 Any advertisement drafted in whole or part with AI goes through the Firm's marketing review before use, under Rule 206(4)-1 and [the Firm's marketing policy].
6.2 The reviewer confirms that every material statement of fact can be substantiated, that any performance follows the Firm's performance presentation procedures, and that no testimonial, endorsement or third-party rating appears without the required disclosures.
6.3 The Firm keeps a copy of each advertisement and the approval record.
7. Describing the Firm's use of AI
7.1 No supervised person may describe the Firm's use of AI in Form ADV, marketing, client communications, RFP or due diligence responses, or media statements without the CCO's prior approval.
7.2 Statements about the Firm's AI use must be accurate, current and substantiated. The CCO reviews them at each annual Form ADV amendment and whenever the approved tools register changes in a way that affects them.
8. Vendor due diligence
8.1 Before an AI tool, plan or connector is approved, [Name or title] completes a vendor review covering at least: data use and model training, data retention and deletion, subprocessors and data location, security controls and independent assurance, breach notification, access controls and audit logs, export of records, and notice of material model or terms changes.
8.2 Where the tool will receive Client NPI, the Firm's oversight of the vendor under Regulation S-P is designed to ensure the vendor protects customer information and notifies the Firm as soon as possible, and no later than 72 hours, after becoming aware of a breach affecting it. As Firm policy, that commitment is written into the contract.
8.3 Approved AI vendors are re-reviewed at least [annually] and whenever the vendor materially changes its terms, models or data handling.
9. Supervision and testing
9.1 The CCO tests this policy at least [quarterly / semi-annually], including: [a sample of AI-assisted client communications reviewed against Section 4; a review of the AI tools in use across Firm devices and accounts against the register; a review of activity logs for approved tools, where available; a review of marketing approvals for AI-drafted content].
9.2 Findings, exceptions and remediation are documented and kept with the Firm's annual compliance review records.
10. Training, attestation and violations
10.1 Each supervised person receives this policy and completes AI training at onboarding and [annually], and when the policy changes materially.
10.2 Each supervised person acknowledges in writing that they have received, read and will comply with this policy, at onboarding and [annually].
10.3 Suspected violations, including client data entered into an unapproved tool, are reported to the CCO immediately. The CCO assesses whether the event is a security incident under the Firm's incident response program and Regulation S-P.
10.4 Violations may result in [remedial training, loss of tool access, or other disciplinary action, up to termination].
10.5 Exceptions to this policy require the CCO's written approval, which is recorded in the approved tools register.
Adopted: [date]. Approved by: [CCO name]. Next review: [date].
How should an RIA vet an AI vendor?
Run the same service-provider review you run for any vendor that touches client data, plus the questions specific to AI. Ask in writing, keep the answers, and back each answer with a contract term or an independent report where you can.
- Training. Is our data (prompts, files, outputs, connected-system data) used to train or improve your models? Is that off by default on our plan, and is it in the contract?
- Retention. How long are prompts, outputs and uploaded files kept? Can we set retention ourselves? What happens to our data at termination?
- Records export. Can we export conversations and activity logs for archiving? On which plans? Is deleted content still exportable?
- Subprocessors. Which subprocessors and model providers see our data, and where is it stored?
- Security assurance. Which independent reports cover the service, such as a SOC 2 Type II, and what is the report period? Which exceptions did the auditor note?
- Breach notice. Will you notify us within 72 hours of becoming aware of a breach involving our customer information? Is that in the contract?
- Access and logging. Do you support single sign-on, role-based permissions and audit logs of user activity? Can we restrict which connectors users may enable?
- Actions. Can the tool send messages or change records in connected systems? Can we require a person to approve each change?
- Model changes. Will you tell us before you change the underlying model or materially change data terms?
- Accuracy claims. What does the product actually do with AI, and what testing supports the claims in your materials? (A firm's description of its own AI use can end up repeating the vendor's claims.)
Keep the AI vendor file in the same system that holds the rest of your service-provider oversight: a vendor register that records which products receive client data, the contract terms behind them, the questionnaire answers, the SOC 2 report and the next review date, and that can export the whole file for an examiner. Our vendor due diligence page shows how RegFin handles that, and the free Regulation S-P checklist covers the rest of the service-provider requirements.
What will an examiner ask about your AI use?
Together, the fiscal 2026 and 2027 priorities point examiners at three things: whether your statements about AI are accurate, whether your policies and procedures to monitor or supervise AI use are adequate, and whether the firm still meets its existing obligations where AI is part of the work. Every exam is scoped to the firm, but a document request built on those items might include:
- the written AI policy and every version in force during the review period;
- the approved tools register, including plans and connectors;
- vendor due diligence files and contracts for each approved AI tool that touches client data;
- evidence of training and written acknowledgments by each supervised person;
- records of the CCO's testing, exceptions and remediation;
- every statement the firm has made about its AI use in Form ADV, marketing and client materials, with support;
- samples of AI-assisted client communications and advertisements, with the review record for each;
- any incidents involving AI tools and how they were handled.
Most firms already have some of these records, spread across a shared drive, inboxes and the CCO's memory. The work is gathering them into one place before the request arrives. RegFin keeps the policy, its acknowledgments, the AI vendor files and the record of what connected AI assistants did in RegFin together, each ready to export for an examiner.
How do you roll the policy out?
- Inventory first. Ask every supervised person which AI tools, accounts and browser extensions they use for work, including AI features inside existing software. Expect surprises.
- Decide the register. Approve, approve on a different plan, or prohibit each tool. Write the register entries in Section 2 format.
- Close the contract gaps. Run the vendor questions above for each approved tool that will see client data, and get a 72-hour breach-notice term into the contract.
- Adopt and train. Approve the policy, train staff on the data rules and the review step, and collect written acknowledgments.
- Put testing on the calendar. Schedule the Section 9 tests and assign them, so the annual review has evidence to point to.
- Fix your disclosures. Read Form ADV, the website and pitch materials for any AI statement, and make each one match the register.
If the AI policy is folded into the Code of Ethics, Rule 204A-1(a)(5) requires written acknowledgment of receipt of the code and amendments, and Rule 204-2(a)(12) requires the firm to keep those acknowledgments. As a standalone policy, the acknowledgment is good practice that gives you the evidence an examiner will ask for.
How RegFin helps you run the policy
Writing the policy is the first step. Showing an examiner that the firm follows it is harder, because each requirement, from vendor reviews to acknowledgments to testing, needs a record that the work happened. The September 2026 risk alert found advisers missing exactly those records. RegFin ties each part of the policy to the workflow and the records behind it, so you can show both what the firm requires and what it has done.
| The policy requires | The evidence RegFin keeps |
|---|---|
| An approved, current policy (template header and Section 10) | The policy in Policy Documents with approvals, every version, review-date reminders and acknowledgment lists, exportable for an examiner |
| Training and written acknowledgment (10.1, 10.2) | Attestations collected through a recurring compliance form, with who completed it and when |
| Vendor review before approval (Section 8) | The vendor register: products marked as receiving client information under Regulation S-P, questionnaires sent through a secure link, scored assessments the CCO approves, and contract terms such as 72-hour breach notice |
| Review of AI-drafted marketing (Section 6) | Marketing review records: the material, the issues flagged against the Marketing Rule, the approval decision and every version |
| Records of AI-assisted communications (Section 5) | Business email in the communications archive for a fixed six years, and Claude Enterprise and ChatGPT Enterprise or Edu chats archived for six years, including the assistant's replies, the tools it used and every edit, checked with the same keyword list and policies as email and texts. An archived chat stays on the record even after a user deletes it |
| Approved, controlled AI connections (Sections 2 and 4.3) | For Claude or ChatGPT connected to RegFin: the areas each assistant can read or change, an approval setting your CCO controls, and an AI Activity log of every action the assistant took in RegFin, kept for six years |
| Testing and remediation (Section 9) | An annual compliance review with the testing procedures, results and findings for each section, and each deficiency recorded as a finding so its remediation is tracked |
The connection page covers the AI connection details for your IT lead.
For the broader question of choosing compliance software that uses AI, our guide to evaluating AI compliance software runs six tests that apply to every vendor, including us.
The bottom line
No AI-specific rule applies to advisers today. The SEC withdrew its predictive data analytics proposal and said any future action starts with a new proposed rule. The rules you already follow decide what your AI policy must do. Keep client data inside approved tools under contract (Regulation S-P). Keep the records AI helps create (Rule 204-2). Review AI-drafted marketing before it runs (Rule 206(4)-1). Describe your AI use accurately. And test that all of it is happening (Rule 206(4)-7). The template above covers each one. For the rest of the program it sits in, start with our RIA compliance guide or the RIA compliance requirements explainer.
If your advisors already use AI tools and the policy, the vendor file and the attestations behind them are still scattered across inboxes and shared drives, book a demo to unlock the full capabilities of RegFin for your firm.
Frequently asked questions
Does an RIA need an AI acceptable use policy?
Is there an SEC rule on how investment advisers use AI?
Can advisors put client information into ChatGPT or Claude?
Do RIAs have to keep AI chat logs?
What is AI washing?
What should an RIA ask an AI vendor before approving it?
Sources
- 17 CFR 275.206(4)-7, Compliance procedures and practices — eCFR
- 17 CFR 275.204-2, Books and records to be maintained by investment advisers — eCFR
- 17 CFR 275.206(4)-1, Investment adviser marketing — eCFR
- 17 CFR 275.204A-1, Investment adviser codes of ethics — eCFR
- 17 CFR 248.30, Procedures to safeguard customer information (Regulation S-P) — eCFR
- 15 U.S.C. 80b-4a, Prevention of misuse of nonpublic information (Advisers Act Section 204A) — U.S. Government Publishing Office
- Division of Examinations, Fiscal Year 2026 Examination Priorities — U.S. SEC
- Division of Examinations, Fiscal Year 2027 Examination Priorities (October 23, 2026) — U.S. SEC
- Risk Alert: Examinations Observations Regarding Investment Adviser Annual Compliance Review (September 14, 2026) — U.S. SEC
- Withdrawal of Proposed Rules, Release Nos. 33-11377; IA-6885 (June 12, 2025) — U.S. SEC
- SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence (Press Release 2024-36) — U.S. SEC
- SEC Adopts Rule Amendments to Regulation S-P (Press Release 2024-58) — U.S. SEC
- Form ADV Part 2, Uniform Requirements for the Investment Adviser Brochure and Brochure Supplements — U.S. SEC
- FINRA Regulatory Notice 24-09, FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (June 27, 2024) — FINRA
- Claude for Financial Advisors (September 14, 2026) — Anthropic
- Compliance API FAQ — Anthropic
- OpenAI Compliance Platform for Enterprise and Edu Customers — OpenAI