Best AI for AdvisorsWhat is Regulation S-P?
Also called: Reg S-P.
Short answer
The SEC's privacy rule for client data at advisers and broker-dealers, amended in 2024 to require incident response and vendor oversight.
Definition
Regulation S-P is the SEC's set of privacy rules for nonpublic personal information held by broker-dealers, investment companies, SEC-registered advisers and registered transfer agents. The SEC adopted amendments on May 16, 2024.
The amendments require a written incident response program, oversight of service providers (including a requirement that they notify the firm within 72 hours of becoming aware of a qualifying breach), and notice to affected individuals within 30 days. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026.
Why it matters for advisors
Most AI tools that touch client data (notetakers, CRM assistants, document tools) are run by vendors that hold or process customer information. Under amended Regulation S-P, those vendors are service providers you have to oversee.
The SEC's fiscal 2026 exam priorities say Regulation S-P exams will focus on policies, controls, oversight of third-party vendors and governance.
Example
When adding a notetaker, a firm adds the vendor to its service-provider list, confirms the 72-hour breach notice in the contract and adds a notetaker breach scenario to its incident response plan.
Watch out for
AI features inside existing software can add new sub-processors that handle customer information. Review them too.
Related terms
- Incident response programUnder amended Regulation S-P, written procedures to detect, respond to and recover from unauthorized access to customer information.
- Nonpublic personal informationUnder Regulation S-P, personally identifiable financial information about a client that isn't publicly available, such as balances and tax data.
- Sub-processorA third party your vendor uses to handle your data, such as the AI model provider behind a notetaker or CRM assistant.
- Vendor due diligenceReviewing an AI vendor's security, data use, contracts and controls before your firm buys, and checking again over time.
- Data processing agreementThe contract terms that set how a vendor may use, protect, share, keep and delete the data you give it.
Learn more
Sources
Not legal or compliance advice. This is a plain-English summary for general education. Rules change and depend on your firm's facts, so check the primary source and talk to your CCO or counsel before relying on it.
Last updated .