---
title: Reg S-P and AI vendors: what SEC-registered MFOs and RIAs must now check
description: Amended Regulation S-P and AI vendors: service provider oversight, 72-hour notice, compliance dates for smaller firms, and questions to send each vendor.
canonical: https://privatesuperintelligence.si/blog/reg-s-p-and-ai-vendors/
last-updated: 2026-10-15
---

# Reg S-P and AI vendors: what SEC-registered MFOs and RIAs must now check

Under amended Regulation S-P, an AI vendor that receives, processes or can access your clients' information is a "service provider" your firm must oversee. Your written incident response program has to cover that vendor through due diligence and monitoring, and require it to tell you within 72 hours of becoming aware of a breach affecting a customer information system it maintains. Larger advisers have had to comply since December 3, 2025, and smaller advisers since June 3, 2026.

This guide is general information, not legal advice. The rule text and the SEC's compliance guide, both linked below, are the authority.

## What changed in Regulation S-P, and when

The SEC announced the amendments on May 16, 2024, in Release No. 34-100155. They took effect on August 2, 2024, with two compliance dates:

| Firm size | Who counts (investment advisers) | Compliance date |
|---|---|---|
| Larger entities | Registered advisers with $1.5 billion or more in assets under management | December 3, 2025 |
| Smaller entities | Registered advisers below that threshold | June 3, 2026 |

The SEC estimated in the adopting release that about 23% of registered advisers would count as larger entities, as of September 2023. Both dates have now passed, so every SEC-registered adviser should have the new program in place.

The amendments add four things that matter for AI tools:

- A written **incident response program** reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information.
- **Service provider oversight** written into that program.
- **Customer notification** within 30 days when sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.
- **Written records** documenting compliance with the safeguards and disposal rules.

## Who the rule covers

Regulation S-P applies to broker-dealers, funding portals, investment companies, investment advisers registered with the SEC, and registered transfer agents. For a wealth management firm, the question is whether you are an SEC-registered adviser.

- **RIAs and multi-family offices registered with the SEC** are covered.
- **A single-family office** that meets the SEC's family office rule, Rule 202(a)(11)(G)-1, is excluded from the definition of investment adviser. To qualify, it advises only "family clients," is wholly owned by family clients and controlled by family members or family entities, and does not hold itself out to the public as an adviser. Such an office is outside Regulation S-P as an adviser, though good practice still points the same way.
- **Private funds** that rely on section 3(c)(1) or 3(c)(7) of the Investment Company Act are not subject to Regulation S-P, according to the adopting release. Their registered adviser is.

The rule also widened the information it protects. Safeguarding now applies to all "customer information," meaning any record containing nonpublic personal information about a customer that the firm holds or that is handled on its behalf, including information received from another financial institution.

## When an AI vendor becomes a "service provider"

The rule defines a service provider as "any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution."

Read that against your AI stack:

- **A meeting notetaker** that hears client calls and writes summaries receives and processes customer information.
- **An enterprise AI seat** (ChatGPT Business or Enterprise, Microsoft Copilot, Claude for Work) receives customer information the moment an adviser pastes a client email into it.
- **An AI feature inside your CRM or portfolio system** processes customer information through that vendor, and possibly through the model provider behind it.
- **A private AI deployment** run for your firm by an outside company is a service provider too, if that company can access customer information.

The definition turns on access, so "we only send summaries" or "it's just a pilot" doesn't take a vendor out of scope.

## What service provider oversight requires

The SEC's small entity compliance guide says your response program must include written policies and procedures "reasonably designed to require oversight of service providers," including to ensure that service providers take appropriate measures to:

- protect against unauthorized access to or use of customer information; and
- notify you "as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider."

The fact sheet adds that oversight runs "through due diligence and monitoring." In practice that means you check a vendor before it receives data and keep checking afterward.

You can agree in writing that a service provider will send customer notices on your behalf, but the guide is clear that "the ultimate responsibility for such notice rests with the covered institution." If your AI vendor has a breach, the 30-day clock to notify affected clients is yours.

The 30-day notice must describe the incident, the data involved and how affected people can protect themselves. You can skip it only if, after a reasonable investigation, you determine the sensitive customer information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience. A delay is possible if the Attorney General notifies the SEC in writing that notice poses a substantial risk to national security or public safety.

## What examiners will look for

The SEC's Division of Examinations said in its fiscal year 2026 priorities that it will assess compliance with Regulations S-ID and S-P, focusing on "policies and procedures, internal controls, oversight of third-party vendors, and governance practices." After the compliance dates, the Division says it will examine whether firms have developed, implemented and maintained policies and procedures under the new provisions.

The same priorities say examiners will review how firms supervise their use of AI technologies. Expect the two topics to meet in one question: which AI tools hold your clients' data, and how do you oversee them? Our guide [AI compliance for RIAs](/blog/ai-compliance-for-rias/) covers the rest of that exam picture.

Keep the evidence. The adopting release points advisers to Rule 204-2(e), under which required records are kept for at least five years, the first two in an easily accessible place.

## Questions to send each AI vendor

| Question | What a good answer includes |
|---|---|
| Does the service receive or store our clients' information, and where? | The systems, regions and subprocessors involved, including the model provider |
| Do you or your model provider train on our data? | A contractual no-train commitment, plus how feedback buttons are handled |
| How long do you keep prompts, outputs, transcripts and files? | Retention periods per data type, and how deletion is confirmed |
| Who at your company, or your model provider, can see our data? | Named roles, the conditions for access, and logging of that access |
| Will you notify us within 72 hours of a breach affecting systems holding our data? | That commitment in the contract, with a named contact |
| What security attestations do you hold? | A current SOC 2 Type II report or equivalent you can read |
| Can we export or archive what the tool produces? | A route into your books-and-records archive |
| What happens to our data when we leave? | Return and deletion terms with a deadline |

For a fuller list, see the [AI vendor due diligence checklist](/blog/ai-vendor-due-diligence-checklist/). Record each answer, the date and who reviewed it: that file is your due diligence record.

## How Private SuperIntelligence fits a Reg S-P review

Private SuperIntelligence is the most capable AI, trusted with everything. Each deployment is built for one client, from the hardware to the model provider to where the data is stored, and a client deployment captures none of the client's data and sends no telemetry back to Mitosis Labs. It works across the firm's own email, documents and data and acts within permissions the firm sets. Read more on [AI for wealth management](/wealth-management/).

## Frequently asked questions

### What is the Reg S-P compliance date for smaller firms?

June 3, 2026. Larger entities, which for investment advisers means $1.5 billion or more in assets under management, had to comply by December 3, 2025.

### What is the Reg S-P 72-hour rule?

Your policies must require each service provider to notify you as soon as possible, and no later than 72 hours after becoming aware of a breach in security that results in unauthorized access to a customer information system it maintains.

### Is ChatGPT a service provider under Reg S-P?

If your firm's staff put customer information into it, OpenAI receives and processes that information through its services to your firm, which fits the rule's definition. Your firm should oversee it like any other service provider. See [ChatGPT for financial advisors](/blog/chatgpt-for-financial-advisors/).

### Does Reg S-P apply to single-family offices?

A family office that meets the SEC's family office rule is excluded from the definition of investment adviser, so Regulation S-P does not reach it as an adviser. A multi-family office registered with the SEC is covered.

### How fast do we have to notify clients after an AI vendor breach?

As soon as practicable, and no later than 30 days after becoming aware that unauthorized access to customer information has occurred or is reasonably likely to have occurred. A vendor can send the notice for you under a written agreement, but the responsibility stays with your firm.


## Related reading

- [ChatGPT for financial advisors: client data and compliance](/blog/chatgpt-for-financial-advisors/)
- [AI compliance for RIAs](/blog/ai-compliance-for-rias/)
- [AI tools for financial advisors and RIAs, compared on client data](/blog/best-ai-for-wealth-managers/)
- [Your private bank's AI vs. AI that works for the family](/blog/private-bank-ai-vs-family-ai/)
- [Is ChatGPT safe for confidential information?](/blog/is-chatgpt-safe-for-confidential-information/)
- [What is zero data retention AI?](/blog/zero-data-retention-ai/)
- [What is private superintelligence?](/blog/what-is-private-superintelligence/)

## Sources

- [Fact Sheet: Final Rules, Enhancements to Regulation S-P (SEC, May 2024)](https://www.sec.gov/files/34-100155-fact-sheet.pdf)
- [Final Rule: Regulation S-P, Release No. 34-100155 (SEC, 2024-05-16)](https://www.sec.gov/files/rules/final/2024/34-100155.pdf)
- [Enhancements to Regulation S-P: A Small Entity Compliance Guide (SEC)](https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf)
- [SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information (SEC, 2024-05-16)](https://www.sec.gov/newsroom/press-releases/2024-58)
- [Examination Priorities, Fiscal Year 2026 (SEC Division of Examinations, 2025-11-17)](https://www.sec.gov/files/2026-exam-priorities.pdf)
- [Family Offices: A Small Entity Compliance Guide (SEC, rule adopted 2011-06-22)](https://www.sec.gov/files/rules/final/2011/ia-3220-secg.htm)
- [17 CFR 275.204-2, Books and records to be maintained by investment advisers (Legal Information Institute)](https://www.law.cornell.edu/cfr/text/17/275.204-2)