Regulation S-P and AI vendors: what the 2024 amendments mean for client data

What Regulation S-P is and who it covers

Regulation S-P is the SEC's set of privacy rules for nonpublic personal information about consumers held by certain financial institutions. The SEC first adopted it in 2000. On May 16, 2024 the Commission adopted amendments to address, in the SEC's words, "the expanded use of technology and corresponding risks" that have emerged since then (small entity compliance guide).

The amended rules apply to broker-dealers (including funding portals), investment companies, investment advisers registered with the SEC, and transfer agents registered with the SEC or another appropriate regulatory agency. The SEC calls these firms "covered institutions" (press release 2024-58). If you're a state-registered adviser that isn't registered with the SEC, Regulation S-P's adviser provisions don't reach you in the same way; ask your compliance consultant which state rules apply instead.

None of this is AI-specific. The rule doesn't mention notetakers or chatbots. It matters for AI because almost every useful AI tool in an advisory practice touches client data: a meeting notetaker hears account details, a CRM assistant reads the client record, and a chat assistant gets whatever an advisor pastes in.

What the 2024 amendments require

The SEC's small entity compliance guide summarizes the main requirements. These are rule requirements, not best practice:

• An incident response program. Written policies and procedures reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. The program has to include steps to assess and contain an incident.
• Service-provider oversight. Written policies and procedures reasonably designed to require oversight of service providers, including making sure they take appropriate measures to protect customer information and notify you as soon as possible, but no later than 72 hours after becoming aware of a breach in security that results in unauthorized access to a customer information system they maintain.
• Customer notification. Notice to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, as soon as practicable but not later than 30 days after you become aware of the incident, with limited exceptions.
• Broader scope. The safeguarding and disposal rules now cover all customer information in your possession or handled or maintained on your behalf, which the SEC says is broader than before.
• Records. Written records documenting compliance with the amended rules.

Compliance dates

The amendments became effective on August 2, 2024. The SEC gave firms a tiered compliance period: larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026 (small entity compliance guide). Both dates have passed, so the amended rules now apply to every covered institution.

The adopting release defines which firms count as larger or smaller entities. If you're not sure which tier your firm was in, it no longer changes what you have to do today, but it may matter for how an examiner looks at records from late 2025 and early 2026.

What counts as customer information and sensitive customer information

For advisers and broker-dealers, customer information is any record containing nonpublic personal information about a customer that's in your possession or handled or maintained by you or on your behalf. That last part is the AI angle: a transcript sitting on a notetaker vendor's servers is handled on your behalf.

Sensitive customer information is the subset that triggers client notification. The SEC describes it as information that, alone or combined with other information, could create a reasonably likely risk of substantial harm or inconvenience to the person if compromised. Its examples include a Social Security number, and an account number or user name combined with something that could be used to get into the account, such as a security code.

Think about what your AI tools actually capture. A meeting where a client reads out an account number, or a CRM note with a date of birth and Social Security number, puts sensitive customer information inside the vendor's systems. That's why a vendor breach can become your client-notice obligation.

How AI tools fit in: notetakers, chat assistants and CRM AI

The practical question for each tool is simple: does the vendor store, process or have access to customer information? If yes, treat the vendor as a service provider under your Regulation S-P procedures. The table below is our reading of how common tool types usually line up. Your answer depends on each vendor's architecture and contract, so check it.

Two things catch firms out. First, AI features switched on inside software you already use (your CRM, email or video platform) can send data to a new sub-processor without a new contract. FINRA makes a similar point for broker-dealers: its rules apply whether a firm builds a tool or uses "embedded features in existing third-party products" (Regulatory Notice 24-09). Second, advisors trying free consumer tools on their own can put client data with a vendor your firm never reviewed. Your AI acceptable use policy is the place to stop that.

Vendor oversight in practice

The rule requires written policies and procedures for overseeing service providers. It doesn't hand you a form. Most firms do this in three places: due diligence before signing, contract terms, and periodic review.

Our AI vendor due diligence guide has the full question list, including data retention, model training on your data, sub-processors, SOC 2 scope and the breach-notice clause. We won't repeat it here. The Regulation S-P pieces to make sure are covered are: the vendor's security measures for customer information, a written commitment to notify you as soon as possible and no later than 72 hours after it becomes aware of a qualifying breach, a named contact, and what the notice will contain.

You can also agree in writing that a service provider will send client notices on your behalf. The SEC is clear that "the ultimate responsibility for such notice rests with the covered institution," so check the vendor's process before you rely on it (small entity compliance guide).

Building AI into your incident response program

Your incident response program already has to detect, respond to and recover from unauthorized access to customer information. Adding AI mostly means naming the AI-specific incidents so staff recognize them. Good practice (not a rule requirement) is to list examples such as: client data entered into an unapproved AI tool, a notetaker recording shared to the wrong person, a vendor breach notice, or an AI integration given broader account access than intended.

Then map each one to your existing steps: who gets told and how fast, how you assess whether sensitive customer information was involved, how you contain it (revoking access, deleting data, asking the vendor to purge), and how you decide whether the 30-day client notice applies. The SEC allows you to skip notice if, after a reasonable investigation, you determine sensitive customer information hasn't been and isn't reasonably likely to be used in a way that would cause substantial harm or inconvenience. Document that investigation.

The AI policy template includes an incident section you can adapt so the policy and the incident response program point at each other.

What SEC examiners have said they'll look at

The SEC's fiscal year 2026 examination priorities, published November 17, 2025, say examinations of Regulation S-P will focus on firms' policies and procedures, internal controls, "oversight of third-party vendors," and governance practices. After the compliance dates, the Division says it will examine whether firms have developed, implemented and maintained policies and procedures under the rule's new provisions.

Expect an examiner to ask for your incident response program, your list of service providers that handle customer information, and evidence that you actually oversee them. An inventory of AI tools with the vendor review for each is a simple way to show that. See AI washing, SEC enforcement and exam priorities for the rest of the exam picture.