---
title: AI compliance for RIAs
description: AI compliance for RIAs in 2026: SEC exam priorities, AI washing, books and records, AI notetakers and client consent, linked to the primary sources.
canonical: https://privatesuperintelligence.si/blog/ai-compliance-for-rias/
last-updated: 2026-10-15
---

# AI compliance for RIAs

There is no SEC rule written for AI at investment advisers. Your existing obligations apply to it instead: the Marketing Rule and antifraud provisions to what you say about AI, Rule 204-2 to the records it helps create, amended Regulation S-P to the vendors that touch client data, and your compliance program to how you supervise it. The SEC's fiscal year 2026 exam priorities say examiners will check both your AI claims and your policies for supervising AI use.

This guide is general information, not legal advice. Check each point with your counsel and your CCO.

## What the SEC says it will examine in 2026

The SEC's Division of Examinations published its fiscal year 2026 priorities on November 17, 2025. AI appears in two places.

Under emerging financial technology, the Division says it remains focused on registrants' use of "automated investment tools, AI technologies, and trading algorithms or platforms." It says reviews will generally include whether representations are fair and accurate, whether operations and controls match disclosures, whether algorithms lead to advice consistent with investors' profiles or stated strategies, and whether controls confirm that automated advice meets obligations to investors, including retail and older investors.

On AI specifically, the Division says it will "review for accuracy registrant representations regarding their AI capabilities" and will assess whether firms have adequate policies and procedures to monitor or supervise their use of AI technologies, including for fraud prevention and detection, back-office operations, anti-money laundering and trading functions.

Under cybersecurity, the Division says it will look at the training and security controls firms use to identify and mitigate new risks associated with AI and polymorphic malware attacks.

The same document lists the 2024 amendments to Regulation S-P, with examiners focused on policies and procedures, internal controls, oversight of third-party vendors and governance.

## AI washing: what the enforcement cases say

"AI washing" means claiming AI capabilities you don't have. The leading adviser cases came on March 18, 2024, when the SEC settled charges against two firms.

| Firm | What it claimed | What the SEC found | Penalty |
|---|---|---|---|
| Delphia (USA) Inc. | It would "put collective data to work to make our artificial intelligence smarter so it can predict which companies and trends are about to make it big" | It did not have the AI and machine learning capabilities it advertised | $225,000 |
| Global Predictions Inc. | It was the "first regulated AI financial advisor" offering "expert AI-driven forecasts" | The claims were false, and it also claimed tax-loss harvesting services it did not offer | $175,000 |

Both firms violated the Marketing Rule, which bars untrue statements of material fact in advertisements. Then-Chair Gary Gensler said: "Investment advisers should not mislead the public by saying they are using an AI model when they are not."

The focus continued under Acting Chairman Mark Uyeda. On February 20, 2025, the SEC created the Cyber and Emerging Technologies Unit, whose priority areas include "fraud committed using emerging technologies, such as artificial intelligence and machine learning." The SEC's fiscal year 2025 enforcement results, published April 7, 2026, describe charges against the founder of an AI company for misleading investors about the company's use of AI.

For your firm, the practical test is simple. Every sentence about AI in your Form ADV, website, pitch book and client letters should describe a tool you use, in the way you use it.

## Books and records when AI drafts the work

Rule 204-2(a)(7) requires you to keep originals of written communications received and copies of written communications sent relating to recommendations or advice, the receipt or delivery of funds or securities, and the placing or execution of orders, among other things. Rule 204-2(e)(1) sets the retention period: at least five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser.

The rule does not mention AI, and it does not carve out messages drafted by software. Three questions follow for your policy:

- **The sent message.** An AI-drafted email or letter that goes to a client is a communication you sent. Make sure it lands in your archive, wherever it was written.
- **The prompts and drafts.** Whether a prompt or an unsent draft is a required record depends on what it contains. Decide your position in writing, and pick tools that can retain or export them if you decide they are.
- **Meeting notes.** If an AI notetaker writes a summary that records a recommendation, treat it like any other note on the client file.

## AI notetakers and client consent

Charles Schwab's 2026 RIA study names notetaking and email drafting among the most common uses of AI at RIAs. Notetakers raise a consent question your firm should answer before the first call. Vendors take different approaches:

- Morgan Stanley describes its AI @ Morgan Stanley Debrief tool as generating meeting notes "with client consent."
- Jump says firms can choose transcript-only, summary-only, or full audio and video recording.
- Zocks says it "never records your client conversations."

State laws on recording and listening to calls differ, and a tool that transcribes without keeping audio still processes the conversation. Ask counsel which consent your firm needs in the states where you and your clients sit, and write the answer into your procedures and client disclosures.

## Vendors and client data under Regulation S-P

Once client information goes into an AI tool, the vendor is a "service provider" under amended Regulation S-P. Your incident response program must include written policies requiring oversight of service providers through due diligence and monitoring, and must require them to notify you within 72 hours of becoming aware of a breach in security that results in unauthorized access to a customer information system they maintain. Larger advisers had to comply by December 3, 2025, smaller ones by June 3, 2026. Our guide [Reg S-P and AI vendors](/blog/reg-s-p-and-ai-vendors/) covers the rule in detail, and [ChatGPT for financial advisors](/blog/chatgpt-for-financial-advisors/) applies it to the most common tool.

## The predictive data analytics proposal is gone

On July 26, 2023, the SEC proposed rules that would have required broker-dealers and investment advisers to address conflicts of interest from their use of predictive data analytics and similar technologies to interact with investors. On June 12, 2025, the Commission formally withdrew that proposal along with others issued between March 2022 and November 2023, and said it "does not intend to issue final rules with respect to these proposals." If it acts again, it will issue a new proposal. For now, no AI-specific rule binds advisers, which puts the weight on the existing rules above.

**If you are dually registered,** FINRA's Regulatory Notice 24-09 (June 27, 2024) reminds broker-dealers that its rules apply to generative AI "whether member firms are directly developing Gen AI tools for their proprietary use or when leveraging the technology of a third party," and that Rule 2210's content standards apply whether a person or a tool wrote a communication. The notice says it creates no new requirements.

## An AI compliance checklist for your firm

| Area | What to have in place |
|---|---|
| Inventory | A list of every AI tool in use, who uses it and what data it touches |
| Approval | CCO sign-off before any tool receives client information |
| Marketing | AI language in Form ADV, the website and pitch materials checked against how the tools work |
| Records | A written position on prompts, drafts and notetaker summaries, and an archive that captures sent communications |
| Vendors | Each AI vendor in your Reg S-P oversight, with the 72-hour breach notice in the contract |
| Supervision | Named reviewers for AI drafts sent to clients, and testing of any tool that produces advice |
| Consent | A documented approach to meeting recording and transcription, and the matching client disclosure |
| Training | Staff guidance on what may go into which tool, including on personal phones |

## Where Private SuperIntelligence fits

Private SuperIntelligence is the most capable AI, trusted with everything. For a wealth management firm, it works across the firm's own email, documents and client data, answers with citations a reviewer can check, and acts only within the permissions the firm sets. Each deployment is built for one firm, and the provider keeps no copy of the work and trains nothing on it. Read more on [AI for wealth management](/wealth-management/).

## Frequently asked questions

### Does the SEC have rules on AI for investment advisers?

No AI-specific rule binds advisers today. The SEC withdrew its predictive data analytics proposal on June 12, 2025, so existing rules on marketing, books and records, Regulation S-P and compliance programs govern AI use.

### What is AI washing?

AI washing is claiming AI capabilities a firm does not have, or overstating how it uses AI. In March 2024 the SEC settled AI washing charges against Delphia and Global Predictions for $400,000 in combined penalties.

### Will SEC examiners ask about our AI use?

The fiscal year 2026 exam priorities say examiners will review the accuracy of firms' AI representations and whether firms have policies and procedures to supervise their AI use. Have your inventory and policies ready.

### Do we need client consent for AI notetakers?

It depends on state law and on how the tool works, since some record audio and some only transcribe. Ask counsel, and disclose your approach to clients.

### Does FINRA guidance on AI apply to RIAs?

FINRA Regulatory Notice 24-09 addresses FINRA member firms. If your advisers are also registered representatives of a broker-dealer, it applies to that side of their work.


## Related reading

- [ChatGPT for financial advisors: client data and compliance](/blog/chatgpt-for-financial-advisors/)
- [Reg S-P and AI vendors: what RIAs and MFOs must check](/blog/reg-s-p-and-ai-vendors/)
- [AI tools for financial advisors and RIAs, compared on client data](/blog/best-ai-for-wealth-managers/)
- [Your private bank's AI vs. AI that works for the family](/blog/private-bank-ai-vs-family-ai/)
- [Is ChatGPT safe for confidential information?](/blog/is-chatgpt-safe-for-confidential-information/)
- [What is zero data retention AI?](/blog/zero-data-retention-ai/)
- [What is private superintelligence?](/blog/what-is-private-superintelligence/)

## Sources

- [Examination Priorities, Fiscal Year 2026 (SEC Division of Examinations, 2025-11-17)](https://www.sec.gov/files/2026-exam-priorities.pdf)
- [SEC Division of Examinations Announces 2026 Priorities (SEC, 2025-11-17)](https://www.sec.gov/newsroom/press-releases/2025-132-sec-division-examinations-announces-2026-priorities)
- [SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence (SEC, 2024-03-18)](https://www.sec.gov/newsroom/press-releases/2024-36)
- [SEC Announces Cyber and Emerging Technologies Unit to Protect Retail Investors (SEC, 2025-02-20)](https://www.sec.gov/newsroom/press-releases/2025-42)
- [SEC Announces Enforcement Results for Fiscal Year 2025 (SEC, 2026-04-07)](https://www.sec.gov/newsroom/press-releases/2026-34)
- [SEC Proposes New Requirements to Address Risks to Investors From Conflicts of Interest Associated With the Use of Predictive Data Analytics (SEC, 2023-07-26)](https://www.sec.gov/newsroom/press-releases/2023-140)
- [Withdrawal of Proposed Regulatory Actions, including Conflicts of Interest Associated with the Use of Predictive Data Analytics (SEC, 2025-06-12)](https://www.sec.gov/rules-regulations/2025/06/s7-12-23)
- [17 CFR 275.204-2, Books and records to be maintained by investment advisers (Legal Information Institute)](https://www.law.cornell.edu/cfr/text/17/275.204-2)
- [Enhancements to Regulation S-P: A Small Entity Compliance Guide (SEC)](https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf)
- [Schwab Study Reveals RIA AI Adoption More Than Doubles, But Most Firms Still in Early Stages (Charles Schwab, 2026-01-22)](https://pressroom.aboutschwab.com/press-releases/press-release/2026/Schwab-Study-Reveals-RIA-AI-Adoption-More-Than-Doubles---But-Most-Firms-Still-in-Early-Stages/default.aspx)
- [Regulatory Notice 24-09 (FINRA, 2024-06-27)](https://www.finra.org/rules-guidance/notices/24-09)
- [Morgan Stanley Wealth Management Announces Latest Game-Changing Addition to Suite of GenAI Tools (Morgan Stanley, 2024-06-26, accessed 2026-10-15)](https://www.morganstanley.com/press-releases/ai-at-morgan-stanley-debrief-launch)
- [Jump (jump.ai, accessed 2026-10-15)](https://jump.ai/)
- [Zocks (zocks.io, accessed 2026-10-15)](https://www.zocks.io/)