How Advisors Use AI for Compliance: Saifr, Red Oak and What Regulators Expect

What regulators say about AI

There is no special AI rulebook for advisors yet. In FINRA Regulatory Notice 24-09 (June 27, 2024), FINRA reminded firms that its rules “are intended to be technology neutral” and apply to generative AI the same way they apply to any other tool, whether a firm builds it or uses one embedded in a third-party product. The notice calls out Rule 3110 (supervision) and Rule 2210 (communications with the public), whose content standards apply whether a person or a tool wrote the communication.

The SEC is looking at the same issues. Its fiscal 2026 examination priorities say the Division of Examinations will review firms’ representations about their AI capabilities for accuracy and assess whether firms have adequate policies and procedures to monitor and supervise their use of AI technologies.

Overstating your own AI is also a risk. In March 2024 the SEC settled its first “AI-washing” cases against two investment advisers, Delphia and Global Predictions, for false and misleading statements about their use of AI, with combined civil penalties of $400,000.

Use case 1: Marketing and advertising review

This is where AI saves compliance teams the most time. Under FINRA Rule 2210, retail communications from broker-dealers need approval by a qualified principal before use, and RIAs must follow the SEC Marketing Rule (Rule 206(4)-1). AI tools pre-screen drafts for risky language, missing disclosures and performance claims so the human reviewer starts from a marked-up copy instead of a blank page.

Saifr, which began in Fidelity Labs, says its marketing compliance review can detect up to 90% of what a human reviewer would and get content to market up to 10x faster (vendor claims). Its SaifrReview workflow covers text, image, audio and video, and its AI agents are available inside partner platforms.

Red Oak is compliance software for RIAs and broker-dealers built around a configurable, books-and-records-compliant review workflow. Its AI Review feature uses large language models to increase accuracy and speed up advertising review, alongside disclosure management, social media compliance, website monitoring and FINRA-integrated registration management.

The two can complement each other. See our Red Oak vs Saifr comparison and the full compliance & marketing review category.

Use case 2: Communications surveillance and archiving

Regulators have shown how costly recordkeeping failures can be. In a November 2024 speech, the SEC’s acting enforcement director said that in fiscal 2024 the agency brought recordkeeping cases with over $600 million in civil penalties against more than 70 firms, and that the off-channel communications initiative had produced charges against more than 100 firms and over $2 billion in penalties since December 2021. In a single September 2024 action, 11 firms agreed to pay more than $88 million combined, including a $325,000 penalty for a wealth manager, Focused Wealth Management.

Archiving platforms such as Smarsh and Global Relay capture and supervise email, text and social messages, and AI is increasingly used to cut false positives in surveillance. Saifr also offers electronic communications surveillance across email, instant messaging, social media and mobile. Compare Smarsh vs Global Relay.

Use case 3: AI meeting notes as records

AI notetakers now run in a large share of practices (42.86% in the 2026 T3/Inside Information survey), which means AI is producing client records every day. Treat notes, transcripts and AI-drafted client emails like any other record: route them to your archive, set retention periods and require a human to approve anything that goes to a client. Zocks integrates with Smarsh, Global Relay and Proofpoint, and Jump says nothing reaches a client or a system of record until an advisor approves it. See our guide to the best AI notetakers for advisors.

A practical AI compliance checklist

1. Inventory every AI tool in use, including AI features inside existing software (CRM, email, notetakers).
2. Write an AI policy that says which tools are approved, what client data may be used and who supervises the output.
3. Keep a human approver on every client-facing communication, as Rule 2210 and the Marketing Rule require.
4. Archive AI output (notes, transcripts, drafts that were sent) under your existing recordkeeping procedures.
5. Do vendor due diligence: SOC 2 Type II, data retention, no model training on your data, and where data is stored.
6. Check your own marketing for AI claims you can’t substantiate. That is what the AI-washing cases were about.
7. Revisit the policy every year as FINRA and the SEC issue more guidance.

Using general assistants? Read can financial advisors use ChatGPT? first.