AI Chatbots on Advisor Websites: What's Allowed and What to Watch

What does a website chatbot actually do?

A website chatbot answers visitors' questions in a chat window. Older chatbots followed scripts: a visitor clicked a button and got a pre-written answer. AI chatbots generate answers on the fly from a language model, often grounded in your website's content or documents you provide. That makes them more flexible and more likely to say something you didn't write.

Common uses on advisor sites include answering questions about services and fees, booking introductory calls, collecting contact details and pointing existing clients to portals or forms. Riskier uses include answering questions about markets, products or a visitor's own finances.

Is it worth it? Before buying, ask what problem the chatbot solves. If most visitors want to book a call or find the client login, a clear button and a short contact form may do the job with far less supervision. If prospects repeatedly ask the same questions about fees, minimums and process, a well-written FAQ page answers them in approved words. A chatbot makes most sense when the volume of questions is high enough that a narrow, well-tested assistant saves real staff time, and when you have someone to supervise it.

Scripted or generative? A scripted bot that only returns pre-approved answers is easier to supervise because every possible answer can be reviewed in advance. A generative bot is more flexible but needs the testing, monitoring and change control described below. A cautious path is to start scripted, or generative with a very narrow scope, and widen it only after a few months of clean reviews.

We don't list website-chatbot vendors in our directory, so this guide is vendor-neutral. If you're also rebuilding your site, our advisor websites category covers website providers such as FMG, Twenty Over Ten and Advisor Websites; ask any provider whether it offers chat, and apply the checks below.

What does FINRA say about chatbots?

FINRA addressed this directly in May 2024, when it added two AI questions to its advertising regulation FAQ.

Firms are responsible for AI-generated content. FINRA says firms are responsible for their communications whether they're generated by a person or by AI, and must make sure AI-generated communications comply with securities laws, FINRA rules and supervision and recordkeeping requirements, including the content standards of FINRA Rule 2210. Those standards generally require communications to be fair and balanced and prohibit false, exaggerated, promissory or misleading statements.

Chatbot messages must be supervised. FINRA says that, depending on the nature and number of persons receiving them, chatbot communications may be correspondence, retail communications or institutional communications, and firms must supervise them under Rule 2210 and FINRA Rule 3110, including Rule 3110(b)(4)'s requirement for written procedures to review correspondence. FINRA also notes that if a broker-dealer uses AI to recommend a securities transaction or investment strategy to a retail customer, Regulation Best Interest applies.

More broadly, FINRA's Regulatory Notice 24-09 says its rules are technology neutral and apply to generative AI just as they apply to any other tool.

What supervision looks like in practice. Because a chatbot generates new text for every visitor, you can't pre-approve each answer the way you pre-approve a brochure. One practical approach is to supervise in layers: approve the instructions and the content the chatbot is allowed to draw on, test it before launch and after every change, review a sample of live conversations on a set schedule, and review every conversation the system flags. Write down who does each of these, how often and what happens when they find a problem. That written procedure is what an examiner will ask to see.

Change control matters. A chatbot can change behavior when its vendor updates the underlying model or when someone edits its instructions. Keep a log of every change, with the date and who approved it, and retest after each one.

How might the SEC Marketing Rule apply to chatbot answers?

For SEC-registered advisers, the Marketing Rule applies to advertisements, broadly defined as communications to more than one person that offer the adviser's services. The rule excludes some communications, such as extemporaneous, live oral communications and most one-on-one communications.

How a chatbot fits that definition isn't settled. A chatbot talks to visitors one at a time, but it runs on content and instructions the firm prepared for everyone, and its answers about your services can promote them to many people. We haven't found SEC staff guidance specifically on advisers' website chatbots, and the staff's Marketing Compliance FAQ didn't address them when we checked in October 2026. Until there is, a cautious approach is to treat chatbot answers about your services as if the Marketing Rule's general prohibitions apply: no untrue or unsubstantiated statements of material fact, fair and balanced treatment of benefits and risks, and no testimonials or performance figures unless they meet the rule's conditions. Check the SEC's Marketing Compliance FAQ for current staff positions, and decide the approach with your compliance team.

Our guide to the SEC Marketing Rule and AI-written content covers the general prohibitions in detail.

Do chatbot conversations need to be kept as records?

Very likely, in many cases. For broker-dealers, SEA Rule 17a-4 and FINRA Rule 4511 require preserving business-related communications. For SEC-registered advisers, Rule 204-2 requires keeping, among other records, written communications relating to advice given or proposed and every advertisement the adviser disseminates.

What to capture: every conversation transcript, with date and time; the version of the chatbot's instructions, approved content and model in use at that time; and any changes to them. If you can't show what the chatbot was configured to say on a given date, it's hard to show it was supervised.

Where: in your firm's archive, not only in the chatbot vendor's dashboard. Archiving tools in our compliance & marketing review category describe capturing communications across many channels, and Theta Lake says it captures AI prompts and responses. Our guide to record-keeping for AI chats and notetakers explains which rules can apply.

What about the information visitors type in?

Visitors will type things you didn't ask for: account numbers, health details, family situations, Social Security numbers. Plan for it.

Tell visitors not to share sensitive information in the chat, in plain words, before they start typing.

Treat the vendor as a service provider. If the chatbot handles customer information, amended Regulation S-P requires covered firms to oversee service providers, including requiring them to notify the firm of a breach within 72 hours, per the SEC's compliance guide. Ask whether the vendor uses chat data to train models, how long it keeps transcripts and which sub-processors see them; the AI vendor due-diligence prompt drafts the questions.

Update your privacy policy to describe the chatbot, what it collects and who processes it. Ask counsel whether any state privacy or chat-recording laws apply to your site's visitors.

Never let it authenticate clients or take instructions. Account changes, money movement and trade requests should go through your normal, verified channels, not a chat window.

Collect only what you need. If the chatbot's job is booking calls, it needs a name, an email address and a preferred time, not income, assets or account details. Every extra field you collect is more data to protect, retain and possibly disclose in a breach.

Decide what happens to leads. If the chatbot collects contact details, make sure they flow into your CRM through an approved integration, that the visitor knows how they'll be contacted, and that any later marketing to them follows the email and call rules that apply to all prospecting.

How do you keep chatbot answers accurate?

Generative AI can state wrong information confidently. FINRA's 2026 Annual Regulatory Oversight Report describes these "hallucinations" as inaccurate or misleading information presented as fact, and lists testing and ongoing monitoring of prompts, responses and outputs among the practices firms may use.

Narrow the scope. Limit the chatbot to approved content: your services, fees, process, team and how to book a call. Instruct it to decline questions about markets, specific investments, taxes and a visitor's personal situation, and to offer a call with an advisor instead.

Test before launch. Write a list of the questions you expect, plus questions designed to push it off-script ("Should I buy X?", "What return can I expect?", "Are you a fiduciary?") and check every answer. Retest whenever the content, instructions or model change.

Monitor after launch. Review a sample of conversations regularly, and every conversation the chatbot flags or a visitor complains about. Fix problems at the source by changing the instructions or content.

Plan for the bad answer. Despite testing, a chatbot will eventually say something wrong. Decide in advance what happens: who corrects the content, whether the visitor is contacted with the right information, how the incident is documented and whether the chatbot is paused while it's fixed. Treat it like any other communication error, following your firm's procedures.

How do you avoid AI washing in what the chatbot says?

Be accurate about what the chatbot is, and about how your firm uses AI generally. The SEC settled charges in March 2024 against two advisers for false and misleading statements about their use of AI (press release 2024-36), and the FTC has said there is no AI exemption from the laws on the books, for example in its September 2024 Operation AI Comply announcement.

Don't describe the chatbot as an "AI advisor," imply it gives personalized advice, or claim capabilities it doesn't have. Describe it plainly: an automated assistant that answers general questions about the firm and can schedule a call.

The same applies to the chatbot's own answers. If a visitor asks whether your firm uses AI to manage money, the chatbot should give an accurate, approved answer or hand the question to a person. Include questions about your firm's AI use in your pre-launch testing.

What disclosures should the chatbot show?

Agree on the wording with your compliance team. A typical set, shown before or at the start of each chat:

It's automated. Visitors should know they're talking to an AI assistant, not a person.

It isn't advice. Answers are general information about the firm, not investment, tax or legal advice, and not a recommendation.

Don't share sensitive information, such as account numbers or Social Security numbers.

Conversations are recorded and kept, with a link to your privacy policy.

How to reach a person, with a clear option to book a call or contact the office.

Your firm's other required disclosures, such as links to Form CRS or ADV Part 2A where applicable, should remain easy to find on the site.

A launch checklist for an advisor website chatbot

1. Compliance sign-off on the scope, content, disclosures and supervision procedures before launch.

2. [Vendor diligence](/guides/ai-vendor-due-diligence-for-advisors/) completed: data use, retention, sub-processors, security reports, breach notice within 72 hours.

3. Narrow scope: approved content only; declines personal, product and market questions; hands off to a person.

4. Disclosures shown at the start of every chat.

5. Capture and archive every conversation and every version of the chatbot's configuration in your firm's archive.

6. Testing completed with expected and adversarial questions, and documented.

7. Monitoring plan: who reviews conversations, how often, and how problems get fixed.

8. Privacy policy updated, and a warning not to share sensitive information.

9. No transactions or authentication through the chat.

10. Accurate description of the chatbot everywhere it's mentioned, with no AI washing.

11. A review date. Schedule the first full review for a few months after launch: what visitors asked, what the chatbot got wrong, what compliance flagged and whether it's saving the time you expected. Decide then whether to keep it, narrow it or widen it.

If your firm doesn't yet have a written AI policy, write it first; the chatbot should be one approved use within it. The AI use policy prompt drafts a starting point for your compliance team.

Sources

FINRA: Advertising regulation FAQ (B.4 and D.8); Rule 2210; Rule 3110; Rule 4511; Regulatory Notice 24-09; 2026 Annual Regulatory Oversight Report, GenAI.

SEC: Rule 206(4)-1, Marketing Rule (eCFR); Marketing Compliance FAQ; Rule 204-2 (eCFR); Regulation S-P amendments, final rule; Regulation S-P small entity compliance guide; Press release 2024-36.

FTC: Operation AI Comply announcement. This guide is general information, not legal or compliance advice.