It could—but not simply because your firm uses AI. The risk is that a policy fails to match how the firm actually uses a tool, handles client information, relies on its output, or supervises the people and systems involved. SEC materials reviewed for this topic do not establish a universal, standalone AI-policy mandate for all registered investment advisers. They do, however, describe existing fiduciary and compliance responsibilities that firms should consider when AI is part of their work.
What the SEC materials do—and do not—establish
For an RIA, the practical question is not whether every AI tool is inherently safe or prohibited. It is whether the firm’s use of that tool fits its obligations to clients and its compliance program. The legal status of the materials matters: a staff statement, a proposed rule, a speech, and an advisory committee recommendation are not interchangeable with a binding final rule.
As an Amazon Associate I earn from qualifying purchases.
Existing fiduciary duties still frame the analysis
An SEC staff bulletin describes an investment adviser’s fiduciary duty under the Investment Advisers Act as comprising a duty of care and a duty of loyalty, under the overarching obligation to act in the client’s best interest. The bulletin describes the duty of care as including reasonable investigation into investments and advice based on a reasonable understanding of a client’s objectives. It is staff material, not a new AI regulation.
Applied to AI, that means the tool’s presence does not settle whether the resulting research, recommendation, draft communication, or other service is appropriate. The firm needs to understand what the system contributes and how a professional evaluates its output in the context of the client relationship.
The 2023 predictive-data-analytics release was a proposal
On July 26, 2023, the SEC announced a proposal concerning conflicts of interest associated with certain predictive-data-analytics and similar technology uses by broker-dealers and investment advisers in investor interactions. The proposed approach included evaluating whether covered uses put a firm’s interests ahead of investors, eliminating or neutralizing identified conflicts, and adopting written procedures and recordkeeping requirements. Those were proposed requirements, not a final rule in the cited release.
A Spring 2025 Unified Agenda entry later described the contemplated re-proposal as withdrawn from that agenda. That status is useful context, but an agenda entry does not itself establish the current state of the Code of Federal Regulations or settle all rulemaking status. Do not treat either the 2023 proposal or the agenda entry as a new binding AI-policy requirement.
Later SEC discussion is not a mandate
On February 3, 2026, SEC Division of Investment Management Director Brian Daly discussed potential uses of AI in investment management. One example was an AI agent helping investors navigate fund disclosures. Daly expressly framed the idea as a conversation starter—not a mandate, guidance, or investment advice. It indicates staff-level discussion of AI applications, not a compliance rule for advisers.
The SEC Investor Advisory Committee Disclosure Subcommittee has also made a recommendation concerning disclosure of AI’s impact on operations. That is an advisory recommendation, not a Commission rule or a binding adviser duty.
When an AI policy can become a real risk
A document can create a false sense of control if it says “employees may use approved AI responsibly” without identifying what is approved, what data may be entered, or what review is required. The following distinctions are a practical risk-management lens inferred from the fiduciary and compliance context; they are not an SEC-published scoring model or prescribed checklist.
| Use case | Questions that change the risk | Policy response to consider |
|---|---|---|
| Internal summarization or drafting | Does the tool receive confidential client or firm information? Will staff use its summary as a basis for advice or a client communication? | Define permitted data and uses; require a qualified person to verify material facts before relying on or sending output. |
| Research or analysis that informs advice | Can staff explain the basis for an output? What happens if it omits, misstates, or invents a material fact? | Set review standards appropriate to the advice, document material verification, and keep the adviser accountable for the work product. |
| Client-facing chatbot or automated interaction | Could a client mistake output for individualized advice? Can the system make recommendations, respond to personal circumstances, or escalate an uncertain question? | Define the system’s scope, disclosures and escalation route; decide which interactions require human review and what records must be retained under applicable requirements. |
| Vendor-hosted or embedded AI | What information does the service receive? Who can access it, and how do vendor changes affect the tool’s behavior or the firm’s controls? | Assess the service and its data handling, set approval and monitoring responsibilities, and revisit controls when the service or use changes. |
The axes behind these distinctions are whether a use is internal or investor-facing, whether output affects advice or recommendations, the sensitivity of the data, the consequences of an error, and the degree of human review and recordkeeping. They help a firm focus its analysis; they do not determine legal compliance by themselves.
How to review the policy against actual use
The steps below are a practical way to connect policy language to firm operations. They are not a verbatim regulatory checklist.
- Inventory tools and workflows. Include standalone applications, AI features embedded in existing software, vendor services, and tools employees may use outside the firm’s approved stack. Record the business purpose, owner, users, and whether the tool is available to clients.
- Trace the output. For each use, identify whether the result stays internal, becomes part of a client communication, informs research or advice, or can influence a recommendation or transaction. A tool’s label is less informative than the role its output plays in the workflow.
- Map the data. Identify what employees enter or upload, whether it includes client information or other sensitive firm material, and what the service’s data handling means for the firm. Avoid assuming that a tool is appropriate for sensitive information merely because it is convenient or widely available.
- Set review and escalation rules. Specify who checks outputs, what must be verified, and when a question or uncertain result must go to a qualified professional. Calibrate review to the consequences of an error rather than applying the same light check to every use.
- Address conflicts and client understanding. Consider whether a covered technology use could serve the firm’s interests ahead of investors, and whether the interaction could confuse clients about the nature of the service or the source of a recommendation. The 2023 proposal addressed conflict evaluation for certain covered uses; this article’s broader review prompts are practical risk-management considerations, not a claim that the proposal is binding.
- Document decisions and applicable records. Record the approved purpose, boundaries, responsible reviewers, and material changes. Determine retention and books-and-records treatment under requirements that apply to the firm and the particular activity; do not assume the proposed 2023 requirements became a general AI recordkeeping rule.
- Revisit controls through compliance review. Review whether tools, workflows, vendors, and staff practices still match the written policy. The SEC Division of Examinations’ risk-alert index lists an item titled “Examinations Observations Regarding Investment Adviser Annual Compliance Review,” dated September 14, 2026. The index supports annual-review context; it does not establish that the alert is AI-specific or reveal detailed findings.
What a useful policy should make clear
A policy should let an employee answer practical questions before using a tool, not merely express a general preference for caution. The precise wording depends on the firm and its services, but a review can test whether the document addresses:
- Which AI tools and use cases are approved, restricted, or prohibited, and who can approve an exception.
- What client, personal, confidential, or other sensitive information may be entered into each type of tool.
- Which outputs can inform advice or reach clients, and what human verification is required before either happens.
- How staff should handle unsupported, conflicting, or uncertain output, including when to stop and escalate.
- Who owns vendor assessment, user access, monitoring, training, incident handling, and policy updates.
- How the firm determines what interactions and work product must be documented or retained under requirements applicable to its activities.
These are policy-design considerations, not a list of elements the SEC has expressly mandated for every RIA AI policy. A firm should align them with its actual services, client relationships, adviser status, existing policies, and applicable law.
Questions for the CCO and firm leadership
- Can we identify every AI use that touches client data, client communications, research, advice, or recommendations?
- Could an employee or client rely on an output without a qualified person checking it?
- Do our controls still work if a vendor changes its model, features, data practices, or service terms?
- Can we explain why a use is appropriate for its purpose and how material output is reviewed?
- Do our written policies, staff practices, and records describe the same workflow?
- Do we need counsel or compliance advice on a particular use involving client information, recommendations, third-party models, or automated investor interactions?
Those answers depend on the firm’s facts. A policy review should therefore be specific to the systems and services in use, not based on a blanket assumption that all AI is either harmless or forbidden.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
