How to Write an AI Acceptable Use Policy for Your Advisory Firm

Why does an advisory firm need a written AI policy?

Because AI is probably already in use at your firm, whether or not anyone approved it. An advisor drafts an email in a personal ChatGPT account, an assistant pastes a client's statement into a free summarizer, or your CRM switches on a new AI feature. Without a written policy, each of those is a private decision about client data, records and communications that your firm is still responsible for.

There's no SEC or FINRA rule that says "have an AI policy." The SEC's 2023 proposal on conflicts of interest from predictive data analytics, which would have covered some AI use by advisers and broker-dealers, was withdrawn in June 2025. But SEC-registered advisers must adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and SEC rules, review them at least annually and name a chief compliance officer to run them, under Rule 206(4)-7. If AI tools touch advice, client data, records or marketing, your compliance program has to account for them, and a dedicated AI policy is the cleanest way to do that.

On the broker-dealer side, FINRA's Regulatory Notice 24-09 (June 2024) reminds member firms that its rules are intended to be technology neutral and apply to generative AI just as they apply to any other tool, including AI features built into third-party products. If your representatives are dually registered or you're a broker-dealer, your supervisory system under FINRA Rule 3110 needs to cover AI use too.

A short, clear policy also makes adoption easier. Advisors stop guessing, staff know which tools they're allowed to use, and your CCO has a document to point to when an examiner asks how the firm manages AI.

Which obligations should the policy tie back to?

Write the policy as an extension of rules you already follow, not as a new rulebook. The main ones for most advisory firms:

Fiduciary duty. The SEC's 2019 interpretation of the standard of conduct for investment advisers describes an adviser's fiduciary duty as a duty of care and a duty of loyalty that apply to the entire relationship. An AI tool doesn't change that: if AI-assisted analysis feeds a recommendation, the adviser is still responsible for it being in the client's best interest.

Regulation S-P. The SEC amended Regulation S-P on May 16, 2024 (press release 2024-58). Covered firms, including SEC-registered advisers and broker-dealers, must have an incident response program, notify affected individuals as soon as practicable and no later than 30 days after learning of certain unauthorized access to sensitive customer information, and oversee service providers, including requiring them to notify the firm of a breach within 72 hours. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, according to the SEC's small entity compliance guide. An AI vendor that handles client information is a service provider.

Books and records. Advisers keep the records listed in Rule 204-2, including written communications about advice given or proposed and every advertisement. Broker-dealers follow SEA Rule 17a-4 and FINRA Rule 4511. AI-drafted emails and client-facing chat can fall into these categories.

Marketing and communications. The SEC Marketing Rule applies to advertisements however they were drafted, and FINRA Rule 2210 governs broker-dealer communications. FINRA's advertising regulation FAQ says firms are responsible for communications created with AI and that chatbot communications must be supervised.

If your firm is state-registered rather than SEC-registered, your state securities regulator's rules apply instead of some of the SEC rules above. Ask your compliance team or counsel which apply to you.

Who should own the AI policy?

Your chief compliance officer should own it, because it's part of the compliance program. In a small RIA that may be the founder wearing the CCO hat. In a larger firm, the CCO typically works with operations or IT (who manage the tools and access) and a senior advisor (who knows how AI is actually used day to day).

Name a single owner in the policy itself, plus a backup. Say who can approve a new tool, who can grant exceptions, and how often the policy is reviewed. Since Rule 206(4)-7 already requires at least an annual review of your policies, the simplest approach is to review the AI policy at the same time, and sooner whenever you add a major tool.

Keep a short inventory alongside the policy: every approved AI tool, the plan or license tier, who uses it, what data it may receive and the date it was approved. An examiner is far more likely to ask "what AI do you use and how do you control it?" than to ask for the policy's wording.

Which AI tools are approved, and how are vendors vetted?

Approve tools at the level of the specific plan, not just the brand. Consumer, team and enterprise tiers of the same assistant can differ in data controls, admin features and contract terms. Our listings note this for the general assistants: for example, ChatGPT and Microsoft 365 Copilot both offer business plans, and Microsoft says Copilot is built into Word, Excel, PowerPoint, Outlook and Teams. Compare options in general ai assistants and check each vendor's current terms yourself.

List what's approved, and say everything else is not. A short allowlist ("approved: these tools, on these plans, through firm-managed accounts") is easier to follow and supervise than a long list of banned apps.

Require firm-managed accounts. Personal accounts on approved tools are hard to supervise, hard to offboard and may sit outside your records. Say that business use happens only in accounts the firm controls.

Cover AI features inside existing tools. CRMs, email platforms, video-meeting apps and planning software increasingly ship with AI built in. Your policy should say that turning on a new AI feature in an existing system goes through the same approval as a new tool.

Set an approval path. Describe how someone requests a new tool: a short written request, a vendor review (below) and a sign-off by the CCO. Keep the approval and the review notes.

Make vendor review a required step before any tool that receives client data is approved. Under amended Regulation S-P, firms must oversee service providers that handle customer information, including requiring notice of a breach within 72 hours. For broker-dealers, FINRA's Regulatory Notice 21-29 reminds firms that outsourcing an activity doesn't outsource the responsibility for supervising it.

The policy doesn't need the full questionnaire, but it should require answers on the essentials: whether your data is used to train models, how long it's kept and how it's deleted, where it's stored, which sub-processors (including AI model providers) see it, what security attestations the vendor has, how fast it reports incidents, and how you export your records if you leave. The AI vendor due-diligence prompt drafts a questionnaire you can adapt, and our AI vendor due diligence guide has the full question list.

What client data can go into an AI tool?

This is the section advisors will read most closely, so make it concrete. One simple option is a tiered approach:

Never, in any AI tool unless specifically approved for it: Social Security numbers, account numbers, passwords, full dates of birth, government ID numbers and other sensitive customer information.

Only in tools approved for client data: client names, holdings, tax returns, estate documents, meeting recordings and notes that identify a client. These go only into tools the firm has vetted and approved for that purpose.

Fine in any approved tool: general questions, public information, de-identified examples and your own drafts that contain no client details.

Tell people how to de-identify: replace names with "Client A," round or remove figures that aren't needed, and strip account details. Our prompt library is written to work without client identifiers for this reason. And remind everyone that the rules don't change because a tool is convenient; our guide to using ChatGPT as an advisor covers the basics.

How should AI output be reviewed before it's used?

State plainly that a person is responsible for everything AI produces at the firm, and that AI output is a draft until a qualified person has reviewed it. Generative AI can state wrong information confidently; FINRA's 2026 Annual Regulatory Oversight Report flags these "hallucinations" among the risks firms should manage.

Client-facing content: reviewed by the advisor responsible for the client before it's sent, and by compliance when your procedures require it.

Meeting summaries and CRM notes: checked against what was actually said before they become the official record.

Numbers and facts: every figure, deadline, limit and rule citation checked against a primary source. Tell staff to have the AI write [SOURCE NEEDED] rather than guess.

Advice: AI can help organize information, but it doesn't make recommendations to clients. The advisor does, under the firm's normal suitability or best-interest process.

What does the policy say about recordkeeping?

Decide, in writing, which AI outputs your firm treats as records, and where they're kept. A sent AI-drafted email is a communication like any other. A client-facing chatbot conversation is very likely one too. Internal drafts, prompts and notetaker transcripts are less clear-cut and depend on their content, your registration and your firm's choices.

Write down: what you keep (for example the final sent version, the approved meeting summary and the recording, or only some of these), where it's archived (your archive, not just the vendor's app), how long, and who's responsible. FINRA's 2026 report describes storing prompt and output logs as one way firms monitor AI tools; whether you do that is a policy decision to make with your CCO.

Our guide to record-keeping for AI chats and notetakers walks through which rules can apply and how to map each AI output to them. Archiving tools in our compliance & marketing review category, such as Smarsh, Global Relay and Theta Lake, describe capturing communications across channels; Theta Lake says it captures AI prompts and responses.

How should AI-assisted marketing and client communications be handled?

Route AI-assisted marketing through exactly the same review as anything else. The policy should say that AI doesn't create an exception, and list the common problems reviewers should look for: invented statistics, unsupported superlatives, benefits without risks, testimonials that aren't real and any performance figures not drawn from approved data.

Add a line about describing your own use of AI. The SEC has brought "AI washing" cases against advisers for overstating their use of AI (press release 2024-36), so any public claim about how your firm uses AI should be accurate and approved. Our guide to the SEC Marketing Rule and AI-written content covers both points in detail, and the compliance pre-check prompt catches common issues before a draft reaches compliance. Review tools such as Red Oak and Saifr describe using AI to flag compliance risks in marketing content.

If you plan to put a chatbot on your website or let clients interact with AI directly, treat that as a separate approval with its own review. FINRA's advertising FAQ says chatbot communications with investors may be correspondence, retail or institutional communications, depending on their nature and audience, and must be supervised under its rules. Our guide to AI chatbots on advisor websites covers the checks.

How do you train staff, monitor use and handle incidents?

Training. Everyone who uses AI at the firm should get a short walkthrough of the policy when they start and when it changes, and should acknowledge it in writing. Cover the approved tools, the data tiers, review expectations and how to ask for help.

Monitoring. Say how the firm checks the policy is followed: periodic review of the tool inventory and licenses, spot checks of AI-drafted communications, and attention to unapproved tools in expense reports or browser extensions. Fold the results into your annual compliance review.

Incidents. Define what counts as an AI incident (for example, client data entered into an unapproved tool, an inaccurate AI-drafted communication sent to a client, or a vendor breach notice) and what happens next: who to tell, how fast, and how it connects to your Regulation S-P incident response program.

A risk framework, if you want one. Some firms organize their AI governance around the NIST AI Risk Management Framework, a voluntary framework, and its Generative AI Profile (NIST AI 600-1, July 2024). Neither is required, but both are useful checklists of risks to consider.

A section-by-section outline you can adapt

This outline is a starting point for discussion with your compliance team or counsel, not a legal template. Adapt it to your registration, size and tools.

1. Purpose and scope. Why the policy exists; who it covers (employees, contractors, supervised persons); which activities it covers.

2. Definitions. What the firm means by AI tool, generative AI, client data, sensitive customer information and AI output.

3. Ownership. The policy owner (usually the CCO), backup, approvers and review schedule.

4. Approved tools. A pointer to the current tool inventory, with plans and permitted data, and the rule that unlisted tools aren't approved.

5. Requesting a new tool or AI feature. The request, vendor review and sign-off steps.

6. Client data. The data tiers, de-identification instructions and the firm-managed-accounts rule.

7. Human review. Who reviews what before it's used or sent, and the rule that advisors, not tools, make recommendations.

8. Records. Which AI outputs are records, where they're archived and for how long.

9. Marketing and client communications. Same review as any other content; accuracy of claims about the firm's own AI use; chatbots need separate approval.

10. Vendor oversight. Required diligence and contract terms for any vendor that handles client data.

11. Training and acknowledgment. When training happens and how acknowledgment is recorded.

12. Monitoring and testing. How compliance is checked and documented.

13. Incidents and violations. What to report, to whom, how quickly, and the consequences of violations.

To get a first draft quickly, use the internal AI use policy prompt in an approved tool, then edit it against this outline with your CCO.

Sources

SEC: Rule 206(4)-7, compliance procedures and practices (eCFR); Commission Interpretation Regarding Standard of Conduct for Investment Advisers, Release IA-5248; Regulation S-P amendments, final rule; Press release 2024-58; Regulation S-P small entity compliance guide; Press release 2024-36 (AI washing); Withdrawal of the predictive data analytics proposal; Rule 204-2 (eCFR); Rule 206(4)-1, Marketing Rule (eCFR).

FINRA: Regulatory Notice 24-09; Regulatory Notice 21-29; 2026 Annual Regulatory Oversight Report, GenAI; Rule 2210; Rule 3110; Rule 4511; Advertising regulation FAQ.

NIST: AI Risk Management Framework; Generative AI Profile, NIST AI 600-1. This guide is general information, not legal or compliance advice.