---
title: ChatGPT for financial advisors: client data and compliance
description: Can advisers put client data into ChatGPT? What each plan keeps, books-and-records duties, Reg S-P vendor oversight, and what your CCO will ask first.
canonical: https://privatesuperintelligence.si/blog/chatgpt-for-financial-advisors/
last-updated: 2026-10-15
---

# ChatGPT for financial advisors: client data and compliance

ChatGPT is safe for financial advisors only on a business plan your firm has approved, set up and put under its compliance program. A personal Free, Go, Plus or Pro account may train on your chats unless you turn that setting off, and it sits outside your firm's books and records and vendor oversight. Business, Enterprise and the API don't train on your data by default, but your firm still owns the record-keeping, the Regulation S-P service provider review and the supervision of what the tool writes.

## Why advisers are asking now

You may already use AI, or sit next to someone who does. Charles Schwab's 2026 RIA study, published on January 22, 2026, found that 63% of RIAs use AI tools in some capacity, and about one in ten are fully integrating AI into their business strategy. The most common uses Schwab names are administrative: notetaking and email drafting.

The holdouts have a specific worry. In an AssetMark survey of 400 advisers reported by Kitces in September 2026, advisers who had not adopted AI cited client confidentiality or data privacy as their top concern (46%), ahead of the time it takes to learn and implement AI (43%) and accuracy or reliability (34%).

Both groups are right. The drafting help is real, and the client data question decides whether compliance will let you keep using it.

## What each ChatGPT plan does with client data

OpenAI's own policy pages set different rules for each plan. Our guide [Is ChatGPT safe for confidential information?](/blog/is-chatgpt-safe-for-confidential-information/) covers them in full; here is the part that matters for a client file.

| Plan | Trains on your chats by default | Retention | Fit for client data |
|---|---|---|---|
| Free, Go, Plus, Pro | Yes, unless you turn off "Improve the model for everyone" | Saved chats stay until you delete them; deleted chats are removed within 30 days, with security and legal exceptions | No. It sits outside your firm's control and records |
| Temporary Chat | No | A copy may be kept up to 30 days | No, for the same reason |
| ChatGPT Business | No | Workspace admins set it | Possible, once compliance approves and configures it |
| ChatGPT Enterprise | No | Workspace admins set it | Possible, once compliance approves and configures it |
| API | No | Abuse logs up to 30 days by default; Zero Data Retention for approved customers | Possible inside a tool your firm builds or buys |

Two details catch advisers out. If you rate a response with a thumbs up or down, OpenAI says the whole conversation may be used for training, even after you opt out. And retention promises can be overridden by a court: in the New York Times copyright case, a federal court ordered OpenAI in May 2025 to preserve ChatGPT output logs that would otherwise have been deleted, an obligation that ended on September 26, 2025.

## What your CCO will ask first

Your chief compliance officer will come at ChatGPT through the rules the firm already follows. Expect four questions.

**Is it part of our books and records?** SEC Rule 204-2(a)(7) requires an adviser to keep originals of written communications received and copies of written communications sent relating to, among other things, any recommendation made or advice given. The rule's text says nothing about who, or what, drafted the message. An AI-drafted email you send a client about a rebalance is still an email you sent. Under Rule 204-2(e)(1), required records are kept for at least five years, the first two in an appropriate office of the adviser.

**Is OpenAI now one of our service providers under Reg S-P?** Amended Regulation S-P defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through its services to the firm. If client information goes into the tool, your incident response program must oversee that vendor through due diligence and monitoring, and require it to notify you within 72 hours of a breach affecting a customer information system it maintains. See [Reg S-P and AI vendors](/blog/reg-s-p-and-ai-vendors/).

**Are we describing our AI use accurately?** The SEC's Division of Examinations said in its fiscal year 2026 priorities that it will review registrants' representations about their AI capabilities for accuracy, and assess whether firms have policies and procedures to monitor or supervise their use of AI. In March 2024 the SEC settled charges against two advisers, Delphia and Global Predictions, for claiming AI capabilities they did not have.

**Who reviews the output before it reaches a client?** A model can draft a confident, wrong sentence about a client's account. Your procedures should say who checks drafts and how.

The full picture is in [AI compliance for RIAs](/blog/ai-compliance-for-rias/). This guide is general information, not legal advice.

## ChatGPT, Claude and Copilot for advisers

Here is how the three major assistants compare on what your CCO will check. On training, their business plans now look alike; the differences sit in feedback handling and in how each fits your records.

| | ChatGPT Business and Enterprise | Claude for Work | Microsoft Copilot |
|---|---|---|---|
| Trains on business data by default | No | No | No: prompts, responses and Microsoft Graph data aren't used to train foundation models |
| Feedback caveat | Thumbs up or down can send the conversation for training | Thumbs up or down feedback is stored up to 5 years and may be used for training; owners can turn the button off | Optional feedback isn't used to train foundation models |
| Fit with records | OpenAI offers a Compliance Platform for Enterprise and Edu that feeds eDiscovery, DLP and SIEM tools | Ask Anthropic which archiving routes your plan supports | Admins can search Copilot interactions and set retention in Microsoft Purview |

If your firm already runs on Microsoft 365, Copilot stores prompts and responses with your other Microsoft 365 content, under the Purview tools your archiving setup may already cover. ChatGPT Enterprise suits firms that want OpenAI's models and will connect the Compliance Platform to their archive. Claude for Work suits teams that prefer Anthropic's models, once someone confirms how its records reach the archive.

## A setup that passes a compliance review

- Get written approval from your CCO before any client information goes into any AI tool, and record the tool on your vendor list.
- Use a business plan. Keep client data out of personal accounts, including on your phone.
- Confirm in writing that the plan does not train on your data, how long it keeps prompts and outputs, and who at the vendor can see them.
- Turn off or restrict the thumbs up and down buttons where the admin console allows it.
- Route prompts, outputs and sent messages to your archive, or confirm that the final client communication is archived wherever it is sent from.
- Add the vendor to your Reg S-P service provider oversight, including the 72-hour breach notice.
- Write down who reviews AI drafts, and keep marketing language about AI to what the tool does.
- Strip account numbers and Social Security numbers before pasting, even on an approved plan.

## When the firm wants more than a chat window

A ChatGPT seat helps one adviser with one prompt at a time. Meeting prep, client correspondence and reporting draw on the whole firm's email, CRM and documents, and each connection adds a vendor to review. For a firm that wants AI across all of it, see [AI for wealth management](/wealth-management/).

Private SuperIntelligence is the most capable AI, trusted with everything. It works across a firm's own email, documents and data, answers with citations, and acts only within the permissions the firm sets. Each deployment is built for one client, and the provider keeps no copy of the work, trains nothing on it and cannot see the outputs. You can [register interest](/#waitlist) for the next intake.

## Frequently asked questions

### Is ChatGPT safe for financial advisors?

On a business plan your firm has approved and configured, it can be. On a personal Free, Go, Plus or Pro account it is a poor fit for client data, since chats may train OpenAI's models unless you opt out and nothing reaches your firm's records.

### Can I put client information into ChatGPT?

Only through a tool and plan your compliance team has approved. Once client information goes in, the vendor becomes a service provider your firm must oversee under amended Regulation S-P.

### Do AI-drafted client emails count as books and records?

Rule 204-2(a)(7) covers written communications an adviser sends about recommendations or advice, and it makes no exception for drafts written by software. Ask your CCO how prompts and drafts are treated in your firm's policy.

### Is Claude or ChatGPT better for financial advisors?

On training, their business plans match: neither trains on your data by default. Pick on how each fits your archive, your Microsoft or Google stack and your vendor review, and on which model your advisers find more accurate for their work.

### What is a secure AI for financial advisors?

One that does not train on client data, gives you control of retention, feeds your books and records, passes your Reg S-P vendor review and keeps client information inside an environment your firm controls.


## Related reading

- [AI compliance for RIAs](/blog/ai-compliance-for-rias/)
- [Reg S-P and AI vendors: what RIAs and MFOs must check](/blog/reg-s-p-and-ai-vendors/)
- [AI tools for financial advisors and RIAs, compared on client data](/blog/best-ai-for-wealth-managers/)
- [Your private bank's AI vs. AI that works for the family](/blog/private-bank-ai-vs-family-ai/)
- [Is ChatGPT safe for confidential information?](/blog/is-chatgpt-safe-for-confidential-information/)
- [What is zero data retention AI?](/blog/zero-data-retention-ai/)
- [What is private superintelligence?](/blog/what-is-private-superintelligence/)

## Sources

- [Schwab Study Reveals RIA AI Adoption More Than Doubles, But Most Firms Still in Early Stages (Charles Schwab, 2026-01-22)](https://pressroom.aboutschwab.com/press-releases/press-release/2026/Schwab-Study-Reveals-RIA-AI-Adoption-More-Than-Doubles---But-Most-Firms-Still-in-Early-Stages/default.aspx)
- [Weekend Reading for Financial Planners, September 26-27, 2026 (Kitces, reporting an AssetMark survey)](https://www.kitces.com/blog/weekend-reading-for-financial-planners-september-26-27-2026/)
- [Data controls in ChatGPT (OpenAI Help Center)](https://help.openai.com/en/articles/7730893-data-controls-faq)
- [How your data is used to improve model performance (OpenAI)](https://openai.com/policies/how-your-data-is-used-to-improve-model-performance/)
- [Enterprise privacy at OpenAI (OpenAI)](https://openai.com/enterprise-privacy/)
- [OpenAI Compliance Platform for Enterprise and Edu customers (OpenAI Help Center, accessed 2026-10-15)](https://help.openai.com/en/articles/9261474-openai-compliance-platform-for-enterprise-and-edu-customers)
- [How we're responding to The New York Times' data demands (OpenAI)](https://openai.com/index/response-to-nyt-data-demands/)
- [Is my data used for model training? (Anthropic Privacy Center, accessed 2026-10-15)](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training)
- [Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn, accessed 2026-10-15)](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy)
- [17 CFR 275.204-2, Books and records to be maintained by investment advisers (Legal Information Institute)](https://www.law.cornell.edu/cfr/text/17/275.204-2)
- [Final Rule: Enhancements to Regulation S-P, Release No. 34-100155 (SEC, 2024-05-16)](https://www.sec.gov/files/rules/final/2024/34-100155.pdf)
- [Examination Priorities, Fiscal Year 2026 (SEC Division of Examinations, 2025-11-17)](https://www.sec.gov/files/2026-exam-priorities.pdf)
- [SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence (SEC, 2024-03-18)](https://www.sec.gov/newsroom/press-releases/2024-36)