Best AI for AdvisorsFree template · Version 1.0 · Updated October 23, 2026
AI Acceptable Use Policy Template for Advisory Firms
A fill-in-the-blanks AI policy for RIAs, broker-dealers, hybrid firms and solo advisors: which AI tools are approved, what client data can go into them, who reviews AI output, which outputs are records, and how AI-assisted marketing, notetakers and vendors are handled.
Important: This template is general information, not legal, compliance or regulatory advice. Laws and rules change and vary by firm type and state. Have your chief compliance officer or counsel review and adapt it before adoption.
Free with the newsletter
Subscribe to Best AI for Advisors Weekly and the template opens right away. New AI tools for advisors, what changed, and practical ways to use them. One email a week; unsubscribe anytime.
Subscribing happens on our beehiiv page, which opens in a new tab. Free, unsubscribe anytime.
What's inside
- 15 sectionsplus 5 appendices
- 154 clausesnumbered, with guidance notes
- 7,000+ wordsRIA and BD clauses tagged
The policy
- 1. Purpose, scope and who this policy applies to
- 2. Definitions
- 3. Roles and responsibilities
- 4. Approved tools and plans
- 5. What information can go into an AI tool
- 6. Human review and accuracy
- 7. Client communications and marketing
- 8. Recordkeeping
- 9. AI meeting notetakers
- 10. Vendor due diligence and oversight
- 11. Supervision and monitoring
- 12. Prohibited uses
- 13. Incidents and mistakes
- 14. Training and attestation
- 15. Exceptions, enforcement and policy review
Appendices
- Appendix A. AI tools register
- Appendix B. New AI tool or use-case request form
- Appendix C. Vendor due-diligence checklist
- Appendix D. Employee acknowledgment and attestation
- Appendix E. Quick reference: AI do's and don'ts
Every fill-in field is listed with a one-line instruction, and clauses that apply only to advisers or only to broker-dealers are tagged.
Preview: section 1
The full text of the first section, exactly as it appears in the template. Fields to fill in are highlighted.
1. Purpose, scope and who this policy applies to
1.1 This policy sets the rules for using artificial intelligence (AI) tools at [FIRM NAME] (the "Firm"). Its goals are to protect client information, keep AI-assisted work accurate, meet the Firm's recordkeeping, supervision and marketing obligations, and let Covered Persons use approved AI tools with confidence.
1.2 This policy applies to all employees, investment adviser representatives (IARs), registered representatives, officers, contractors, temporary staff and interns of the Firm, and anyone else who performs work on the Firm's behalf (together, "Covered Persons").
Guidance Delete roles your firm doesn't have. If an outside provider handles compliance, IT or marketing for you, decide whether its people are Covered Persons under this policy or are overseen as vendors under section 10, and say which.
1.3 This policy covers any use of an AI tool for Firm business, including drafting, editing, summarizing, research, analysis, translation, meeting notes, client communications, marketing, and AI features built into software the Firm already uses.
1.4 This policy applies on Firm-owned devices and on personal devices (such as a personal phone or home computer) used for Firm business. Whatever the device, Firm business may be done with AI tools only through accounts the Firm approves and controls.
1.5 This policy supplements, and does not replace, the Firm's compliance manual, written supervisory procedures, code of ethics, information security program, privacy policy, records retention schedule and business continuity plan. If this policy and another Firm policy conflict, the stricter requirement applies, and Covered Persons should ask the CCO.
Guidance List the documents your firm actually has. SEC-registered advisers keep written compliance policies and procedures under Rule 206(4)-7; broker-dealers keep written supervisory procedures under FINRA Rule 3110.
1.6 No SEC or FINRA rule requires a stand-alone AI policy. The Firm adopts this policy because existing obligations already reach AI use, including the Firm's duty to maintain written compliance policies and procedures, its duty to protect client information, and its recordkeeping, communications and supervisory obligations.
Guidance Background from our published guide: the SEC's 2023 proposal on predictive data analytics, which would have covered some AI use, was withdrawn in June 2025. SEC-registered advisers must adopt written policies and procedures reasonably designed to prevent violations, review them at least annually and designate a chief compliance officer (Rule 206(4)-7). FINRA's Regulatory Notice 24-09 says its rules are intended to be technology neutral and apply to generative AI the same way they apply to any other tool, including AI features built into third-party products.
1.7 When this policy doesn't answer a question, Covered Persons should not use the AI tool for that purpose until they have asked the AI policy owner or the CCO.
1.8 Questions about this policy go to the AI policy owner, [POLICY OWNER], or the Chief Compliance Officer, [CCO NAME].
How to adapt it
Fill in the fields
Replace every [BRACKETED] field, starting with the firm name, policy owner, CCO and incident contact. The full template lists every field with a one-line instruction.
Delete what doesn't apply
Remove RIA-only or BD-only clauses that don't fit your registration, decide on each optional clause, and delete the guidance notes.
Align it with your compliance manual
Point to the documents your firm already has (compliance manual or WSPs, records schedule, incident response program) so the AI policy doesn't create a second, conflicting process.
Fill in the register and the records table
List the AI tools and plans you actually approve in Appendix A, and record the firm's decisions on which AI outputs are records in section 8.
Have your CCO or counsel review it
The template is a starting point, not legal advice. Your chief compliance officer or counsel should review and adapt it before adoption.
Train, and collect attestations
Walk everyone through the policy, hand out the one-page quick reference (Appendix E) and collect the acknowledgment in Appendix D.
Review it on a schedule and keep versions
Review at least annually and when you add a major tool, and keep each approved version as a record of your compliance program.
What the template covers and why
Each area extends a rule advisory firms already follow. Citations are the same ones used in our fact-checked guides.
Approved tools and plans
An allowlist approved at the level of the specific plan, firm-managed accounts, and the rule that AI features switched on inside existing software need approval too. FINRA's Regulatory Notice 24-09 says its rules apply to generative AI, including AI features embedded in third-party products.
Client data
A data classification table, a never-enter list and de-identification steps. They support the firm's duty to protect customer information under Regulation S-P, which uses the term nonpublic personal information.
Regulation S-P definitions (17 CFR 248.3) · Regulation S-P amendments
Human review
AI output is a draft until a qualified person reviews it, numbers are checked against systems of record, and AI never makes the recommendation. FINRA's 2026 oversight report flags hallucinations, and an adviser's fiduciary duty applies to the whole relationship whatever tools are used.
Marketing and communications
AI-assisted marketing goes through the same review as anything else, with a checklist of common AI problems and a rule that claims about the firm's own AI use are accurate. It supports the SEC Marketing Rule for advisers, FINRA Rule 2210 for broker-dealers, and lessons from the SEC's 2024 "AI washing" cases.
SEC Marketing Rule (eCFR) · FINRA Rule 2210 · SEC press release 2024-36
Recordkeeping
A table for deciding which AI outputs are records, where they're kept and for how long, plus export-before-deletion and an off-channel prohibition. It maps to Rule 204-2 for advisers and SEA Rule 17a-4 and FINRA Rule 4511 for broker-dealers.
AI meeting notetakers
Notice and consent before recording, what to do when a client declines, and review of summaries before they become the official note. Recording-consent laws vary by state, and some require every party's consent.
Vendor oversight
Minimum due-diligence questions, contract terms and reassessment, including the 72-hour breach notice amended Regulation S-P requires of service providers, and FINRA's reminder that outsourcing doesn't outsource supervision.
Regulation S-P small entity compliance guide · FINRA Regulatory Notice 21-29
Supervision, incidents and training
Monitoring tied to the compliance program rule for advisers and FINRA Rule 3110 for broker-dealers, AI incidents routed to the Regulation S-P incident response program, and training with annual attestation.
Word version
Most firms adopt a policy as a Word document, so the template also comes as a Word-ready .docx with the same clauses: numbered sections, fill-in fields in [BRACKETED CAPITALS], guidance notes you can delete, a version history and signature blocks. Download it below, or from the links that appear after you subscribe.
FAQ
Is an AI policy required for advisory firms?
No SEC or FINRA rule specifically requires a stand-alone AI policy. But SEC-registered advisers must have written compliance policies and procedures under Rule 206(4)-7, and FINRA says its rules apply to generative AI the same way they apply to any other technology. If AI touches advice, client data, records or marketing, your policies need to address it, and a dedicated AI policy is the cleanest way to do that.
Is this template legal advice?
No. It's general information and a starting point. It hasn't been reviewed by a lawyer or a regulator, and laws and rules change and vary by firm type and state. Have your chief compliance officer or counsel review and adapt it before your firm adopts it.
Does the template work for broker-dealers?
Yes. Clauses tagged BD cover FINRA Rule 2210 communications, Rule 3110 supervision, recordkeeping under SEA Rule 17a-4 and FINRA Rule 4511, and FINRA's reminder that outsourcing doesn't outsource supervision. Clauses tagged RIA cover the Marketing Rule, Rule 204-2 and Rule 206(4)-7. Dually registered and hybrid firms keep both; state-registered advisers should check which state rules apply instead.
How often should we update our AI policy?
At least annually, alongside the annual review of compliance policies that Rule 206(4)-7 requires of SEC-registered advisers, and whenever the firm adds a major new AI tool or a vendor changes its terms. The template's last section sets the review cadence and keeps a version history.
Can we use it with Microsoft 365 Copilot or an enterprise plan of ChatGPT?
Yes. The template doesn't name or endorse any vendor. You list the specific tools and plans your firm approves in the AI tools register (Appendix A), because consumer, team and enterprise plans of the same assistant can differ in data controls and contract terms. Check each vendor's current terms for the plan you buy.
Do we need client consent to use an AI notetaker?
Recording-consent laws vary by state, and some require every party's consent, so many firms ask for and document consent at the start of each recorded meeting. Section 9 of the template covers notice, consent, what to do if a client declines, and reviewing summaries before they become the official note.
Does the template cover Regulation S-P?
Yes. It ties incidents to the incident response program required by amended Regulation S-P and requires AI vendors that handle client information to notify the firm of a breach within 72 hours. Larger entities had to comply with the amendments by December 3, 2025 and smaller entities by June 3, 2026.
Is the template really free?
Yes, it's free with our weekly newsletter. Subscribe on our beehiiv page and the template opens right away here. You can unsubscribe at any time.