Yes: U.S. RIAs can use generative AI, but you remain fully responsible under existing SEC, FINRA, and FTC standards. Nothing about "AI" creates a new exemption or a new rulebook. Start with a low-risk pilot, put your usage policy in writing before you type a single prompt, and vet how any vendor stores or trains on your data.
TL;DR:
- Advisors must ensure their AI use complies with existing SEC, FINRA, and FTC standards, with no new exemptions for AI tools.
- A low-risk pilot should be conducted with clear controls, including prompt restrictions and validation of outputs before wider deployment.
- Supervision requires assigning specific approvers, maintaining logs, and implementing incident response plans aligned with regulator timelines.
- All AI-generated marketing content counts as communications requiring review, approval, and accurate performance claims safeguards.
- Vet vendor data policies carefully, negotiating no-training clauses, data deletion rights, and testing with anonymized inputs to manage client data risks.
Table of Contents
- What the SEC, FINRA, and FTC actually require
- Build a pilot-to-production plan before you go live
- Build the supervision and recordkeeping controls regulators expect
- Keep AI-assisted marketing and client messages compliant
- Vet your AI vendors before you send them client data
- The 90-day path to regulator-ready AI use
- The compliance mindset that actually protects your practice
- How Mastermind Advisor Marketing can help you move faster, with less risk
- FAQ
- Sources
- Essential regulator guidance to read next
What the SEC, FINRA, and FTC actually require
Regulators have been consistent on one point: they do not care what you call the tool. FINRA Regulatory Notice 24-09 confirms that existing, technology-neutral rules govern generative AI the same way they govern any other system, including Rule 3110 on supervision and Rule 2210 on communications with the public. If a chatbot drafts your newsletter, that newsletter is still subject to the same review standards as if you had written it yourself.
Three agencies matter here, and each has a distinct job:
- FINRA expects supervision of the AI lifecycle, from vendor selection to output review, under Regulatory Notice 24-09.
- The SEC requires written incident response programs and oversight of service providers handling customer data under its amended Regulation S-P.
- The FTC enforces against deceptive AI claims under Section 5, with no carve-out for firms that blame the algorithm.
The FTC has made clear there is no AI exemption from liability: its 2024 enforcement sweep targeted companies making deceptive or unsupported AI claims, a warning that applies directly to advisors who overstate what their AI tools can verify or predict.
Build a pilot-to-production plan before you go live
The safest path into generative AI is a phased one. Start narrow, test hard, and only expand once you have evidence the controls hold.
- Pick a genuinely low-risk pilot. Internal meeting summaries or first-draft admin memos are reasonable starting points; client-facing content and performance commentary are not.
- Ban personal or account data from prompts. No social security numbers, account numbers, or portfolio specifics go into a general-purpose chatbot.
- Run a validation batch. Generate 20 to 30 sample outputs and have a compliance reviewer score them for accuracy, tone, and factual drift before anyone touches a live client file.
- Stress-test with adversarial prompts. Try to get the tool to fabricate a return figure or a credential; if it does, you know where your human review layer has to sit.
- Set stop and go criteria. Define in writing what error rate or complaint count halts the pilot, and who has authority to make that call.
Pro Tip: Keep every pilot output and its reviewer's notes in one folder; that record becomes your audit trail if an examiner ever asks how you tested the tool before deploying it.
Build the supervision and recordkeeping controls regulators expect
A pilot proves the tool works. A governance framework proves you can supervise it at scale, which is the part examiners actually test.
- Assign a named approver for every category of AI-assisted output, mirroring the supervisory structure FINRA expects under Rule 3110.
- Write an incident response plan that matches the timelines in the SEC's final rule on the Safeguards and Disposal Rules, which generally calls for notification as soon as practicable and typically within 30 days of discovering a breach involving sensitive customer information.
- Log every prompt, output, and edit made by a human reviewer, not just the final published version.
- Set a retention schedule for those logs that matches your firm's existing books-and-records policy.
- Review vendor access to customer data at the same cadence you review any other service provider under Regulation S-P.
Supervision here is not a one-time checklist. It is an ongoing practice of confirming the model still behaves the way it did during your pilot, because updates on the vendor's end can shift outputs without any warning to you.
Keep AI-assisted marketing and client messages compliant
Every piece of AI-generated content that reaches a prospect or client is still an advertisement or communication under existing rules. The SEC's Marketing Rule 206(4)-1 and FINRA's Rule 2210 apply exactly as they would to copy a human wrote by hand. A point our guide to the SEC Marketing Rule covers in more depth.
- Treat AI drafts as unapproved first drafts, never as final copy, regardless of how polished they read.
- Flag any performance claim a model generates for a separate factual check against your actual books and records.
- Verify testimonials and endorsements the tool suggests or paraphrases; a fabricated quote is a real compliance violation, not a quirky output. Our breakdown of testimonial disclosure requirements walks through the three conditions that apply.
- Red-flag triggers include specific return numbers, comparisons to named competitors, and any language implying guaranteed outcomes.
Pro Tip: Build a simple approval stamp, even a shared spreadsheet column marked "reviewed," so no AI draft ever reaches a client without a documented human signoff. Our ranked guide to fiduciary marketing message risk can help you decide which drafts need the heaviest scrutiny.
Vet your AI vendors before you send them client data
Most generative AI risk for advisors starts with the vendor, not the model itself. The FTC has warned that model-as-a-service providers can quietly use customer inputs to train future versions of their systems unless you negotiate otherwise.
- Ask directly whether your prompts train the model, and get a no-training clause in writing if your firm handles sensitive data.
- Confirm data retention periods and whether you can force deletion on demand.
- Negotiate audit rights so your compliance team can verify the vendor's claims rather than taking them on faith.
- Require breach notification terms that align with your own Regulation S-P incident response timeline, not the vendor's default schedule.
- Sandbox real client data entirely: run any test involving actual account information on a system with no external data transmission, never on a public chatbot interface.
Anonymizing or filtering inputs before they reach a third-party tool is a cheap control that eliminates most of this risk at the source.
The 90-day path to regulator-ready AI use
A phased timeline keeps the work manageable and gives you documentation at each stage.
- Days 1 to 30: Write your AI usage policy, select one low-risk pilot, and shortlist two or three vendors for due diligence.
- Days 31 to 60: Run validation testing, keep dated logs, and get supervisory signoff on the pilot's results.
- Days 61 to 90: Promote approved use cases to production, run a mock incident drill, and schedule your first quarterly audit.
| Phase | Owner | Minimum documentation |
|---|---|---|
| Days 1-30 | Chief Compliance Officer | Written policy, vendor shortlist |
| Days 31-60 | Designated supervisor | Validation logs, signoff memo |
| Days 61-90 | Firm principal | Production approval, drill notes |
Our compliance marketing checklist pairs well with this timeline if you want a parallel list for marketing-specific approvals.
The compliance mindset that actually protects your practice
Most advisors treat AI compliance as a disclosure problem: add a disclaimer, move on. That misses the point. Regulators care far less about the label "AI" than about whether you maintained the same investor protections you'd owe with any other tool, a standard FINRA's own guidance makes explicit.
The firms that avoid trouble are the ones that can produce a paper trail: a dated policy, a named approver, a log of what was tested and when. Generic marketing templates built for other industries rarely account for this, because they were never built around supervision and recordkeeping obligations in the first place. An advisor-specific playbook starts from the regulation, not from a generic content calendar, which is why it creates far less friction down the line.
— Josh
How Mastermind Advisor Marketing can help you move faster, with less risk
We built our system specifically for independent advisors, which means every piece, from the content library to CRM integrations, accounts for supervision and recordkeeping realities covered above. Rather than adapting a generic agency template to your compliance needs after the fact, we start from the advisor's regulatory reality and build outward.
Our services include webinars, seminars, a content library built for advisors, automated email follow-ups, social media scheduling, and full website builds, all designed around the long buying cycles and disclosure requirements specific to financial services. If you'd rather build your AI governance in-house, the steps above will get you there. If you want a done-for-you path backed by a team that has run real advisory practices, our growth strategy page is the place to start.
- Compliance-friendly content library built for advisor review workflows.
- CRM and email automation that keeps a documented trail of client touches.
Our firm reports a $25 million-per-year playbook built from advisors who have grown real practices, not generic marketing templates.
FAQ
Can financial advisors legally use ChatGPT or similar tools?
Yes, using generative AI tools is not restricted by a specific rule, but every output is subject to existing supervision, communications, and recordkeeping requirements under FINRA Regulatory Notice 24-09. The advisor, not the tool, remains responsible for accuracy and compliance.
What does Regulation S-P require for AI tools that handle client data?
Firms covered by the amended rule must maintain written incident response programs and oversee service providers that access sensitive customer information, as detailed in the SEC's final rule. Notification generally must occur as soon as practicable, typically within 30 days of discovering a qualifying incident.
Can AI-generated testimonials violate the SEC Marketing Rule?
Yes, a fabricated or unverified testimonial generated by AI is treated the same as one a person wrote, and it must meet the disclosure conditions under the Marketing Rule. Our testimonial compliance guide outlines the three required conditions in detail.
What happens if an AI vendor uses my firm's data to train its model?
The FTC has warned that model-as-a-service providers may use client inputs for training unless your contract prohibits it, which makes a no-training clause essential before sharing any sensitive data. Review retention and deletion terms before any pilot begins.
Should a small RIA build an in-house AI policy or hire outside help?
Either path can work, but a small RIA benefits from a lean governance model: one written policy, one named approver, and centralized logs reviewed quarterly, an approach reflected in recent industry guidance on phased adoption. Firms without compliance staff to build this internally often turn to advisor-focused marketing partners for the content and workflow pieces.
Sources
- FINRA Regulatory Notice 24-09
- FTC announces crackdown on deceptive AI claims and schemes
- SEC press release on amended Regulation S-P and Safeguards Rule
- SEC final rule adopting amendments to the Safeguards and Disposal Rules (34-100155)
- Federal Trade Commission’s policy statement on AI and accuracy suppression
Essential regulator guidance to read next
- FINRA Regulatory Notice 24-09 for supervisory expectations around generative AI.
- SEC Regulation S-P final rule for incident response and notification timing.
- FTC AI policy statement on accuracy suppression and disclosure obligations.
- FTC enforcement actions on deceptive AI claims under Section 5.