Best AI for AdvisorsWhat is an AI acceptable use policy?
Also called: AI policy, AI use policy.
Short answer
A firm's written rules for which AI tools staff may use, for what, with what data, and how output is reviewed and kept.
Definition
An AI acceptable use policy sets the firm's rules for AI: approved tools and plans, permitted uses, what data may go in, review of AI output, recordkeeping, vendor review, incidents and training.
As our policy guide puts it, there's no AI-specific SEC or FINRA rule requiring one, but existing obligations already reach AI use: SEC-registered advisers must have written compliance policies under Rule 206(4)-7, and FINRA says its rules apply to AI. A written AI policy is the clearest way to show how you handle those obligations.
Why it matters for advisors
It's the document examiners, clients and staff will ask about first. It also answers the everyday questions advisors have (can I use this tool, can I paste this, do I need to keep this), which is what stops shadow AI.
Our guide explains what to put in one and how to roll it out, and the template gives you a fill-in starting point with guidance notes for your CCO.
Related terms
- Shadow AIAI tools staff use for work without the firm's approval, such as personal chat accounts or unvetted browser extensions.
- Human in the loopKeeping a person responsible for reviewing or approving AI output before it's used, sent or acted on.
- Vendor due diligenceReviewing an AI vendor's security, data use, contracts and controls before your firm buys, and checking again over time.
- Nonpublic personal informationUnder Regulation S-P, personally identifiable financial information about a client that isn't publicly available, such as balances and tax data.
Learn more
Last updated .