Governance and Compliance

AI adoption in advisory firms is limited less by model capability than by privacy, supervision, recordkeeping, fiduciary duty, and client trust.

Regulatory frame

SEC: fiduciary duties, marketing rules, AI-washing risk, Regulation S-P safeguards, and proposed predictive-analytics conflict controls.
FINRA: technology-neutral rules still apply: supervision, communications with the public, recordkeeping, fair dealing, cybersecurity, vendor risk.
CFP Board: AI is a tool; CFP professionals remain responsible for competence, care, confidentiality, integrity, and final work product.
CFPB: consumer finance chatbots and AI credit decisions require accuracy, human escalation, and no “AI exemption.”

Practical guardrails

Tooling pattern: Governance is less about one AI model and more about approved environments, archives, supervision, and vendor controls. Firms typically combine enterprise AI environments such as Microsoft Copilot, ChatGPT Enterprise, or Claude Enterprise with compliance/archiving tools such as Smarsh, Global Relay, Red Oak, Comply, SmartRIA, and RIA in a Box.

AI use inventory

Track each tool, owner, data inputs, client-facing status, vendor, risk level, and recordkeeping requirements.

Data policy

No client nonpublic personal information in unapproved public AI tools. Confirm whether vendors train on prompts/files.

Human approval

Require review before AI-generated advice, marketing, plans, recommendations, or client communications are delivered.

Vendor due diligence

Review SOC 2/ISO reports, retention, deletion, encryption, subprocessors, breach notice, audit rights, and exportability.

Recordkeeping

Archive AI-generated client communications, chatbot logs, meeting summaries used in advice, approvals, and marketing records as required.

Testing

Test for hallucinations, bias, misleading statements, privacy leakage, bad calculations, and advice-like chatbot responses.

High-risk uses

Uploading tax returns, account numbers, estate documents, health data, SSNs, or credentials into public AI tools.
Client-facing bots that provide personalized investment, tax, insurance, credit, legal, or planning advice without supervision.
AI-generated recommendations delivered without advisor review.
AI-written performance claims, testimonials, or “AI-powered” marketing claims without substantiation.
Autonomous trading or model changes without approved controls.
Tools that cannot support retention, audit, supervision, or deletion obligations.

Implementation checklist

Define approved and prohibited AI uses.
Select secure vendors and negotiate data protections.
Train staff on confidentiality, hallucinations, bias, and escalation.
Integrate AI outputs into systems of record; do not make chat logs the source of truth.
Require human sign-off for advice and client communications.
Archive required records and approval evidence.
Review outputs periodically and remediate errors.

Governance principle: Treat AI as regulated infrastructure, not a productivity toy. The more client-specific and consequential the output, the stronger the controls should be.