How to Create Your AI Policy as an RIA Firm

If your RIA firm doesn’t have an AI usage policy, you’re one data breach, a rogue admin, or just a dumb decision away from a regulatory nightmare.

Today, I’m going to show you how to create a solid AI usage policy for your RIA firm, and what the SEC is already prioritizing right now. In this article, we’ll cover:

• The eight details a good AI usage policy needs to include
• What the SEC is already asking RIA firms to produce about their AI usage
• How to draft and implement the right AI policy that fits your RIA firm

Prefer to watch this content instead? Hit play below or watch here. Prefer to read? The article continues below the video.

LEGAL DISCLOSURE: I am not an attorney, nor am I your regulatory authority, nor am I your Compliance representative. Nothing in this article or any other content created by Advisor Story is legal advice or regulatory advice, and should not be taken as such. Please consult with your legal and/or Compliance representatives for review and approval of any new policies or practices.

Disclosures complete, let’s continue.

Why Your RIA Firm Needs an AI Usage Policy

It’s still the Wild West when it comes to RIA firms telling their staff which tools and AI-powered programs to use. Not to be an alarmist, but there’s likely at least one person on your staff, whether that’s an admin or an advisor, who’s using AI tools on personal devices in ways that violate regulatory guidelines without even realizing it.

CCOs and Managing Partners are reaching out to me, saying, “Jon, we’re SO behind when it comes to AI. Our advisors are getting pitched products every day now that claim they use AI this and AI that. How do we get a handle on this?”

Let me assure you: Most RIA firms I talk with fall somewhere on a spectrum between using AI with no guardrails at all and having a policy written a few years ago, when ChatGPT first became a thing.

On top of that, platforms like Altruist, Zocks, Jump, AdvisorEngine, and more are shipping new AI capabilities at least once a week. I’ve never seen new features get shipped nearly as fast as what we’re seeing in the advisor tech space today.

And that’s causing plenty of CCOs to break out in hives. How do you maintain proper governance? How do you know what’s actually secure, auditable, and, here’s a novel idea, helpful for your clients?

That’s where a solid AI Usage Policy can give your firm a reasonable starting point. This is your two-fold operational and regulatory foundation for defending every AI-related decision.

What Does a RIA Firm’s AI Usage Policy Need to Include?

There are eight key details that I believe every AI Usage Policy needs to include if you’re an RIA firm:

1. Current Tech List – If you don’t have one already, create a list of every approved tech vendor you use. This could be custodian-specific tech, such as Hazel if you’re with Altruist, or an entity-agnostic vendor, such as RightCapital, Orion, Morningstar, etc.
2. Approval Levels – I recommend segmenting your current tech list into three levels or tiers of usage approval:
   1. Level I is fully approved and the most secure level of data compliance. This is likely your Holistiplan, MoneyGuidePro, your CRM, and whatever else you use for portfolio management. Level I is mostly in-platform-only AI usage, not accessed via API or any other type of integration.
   2. Level II is where you use Enterprise-level subscriptions to process anonymized data. That said, I still don’t fully trust platforms like ChatGPT, Claude, and others that say they don’t train their models on your data if you’re paying for their Enterprise-level subscription. All it takes is someone to write a bigger check than either of us will ever be able to write to make your data somehow accessible to that group.
   3. Level III has the most liberty because it should be reserved for ideation, research, and development that doesn’t use any firm or client data.
3. Prohibited Use Cases – What are the more popular platforms people use for AI, such as Claude, ChatGPT, Gemini Notebook, and more? They’re popular because there are few, if any, guardrails around their usage. If your firm has a Claude subscription, it needs to be at least an Enterprise-level subscription, not some $20 subscription.
4. Review Process for New Capabilities Inside Approved Tech – When an approved vendor, like Altruist, Wealthbox, Advyzon, or whoever, introduces a new AI capability inside their platform, what’s your process for reviewing and approving these new capabilities? This is consistently the most overlooked detail in AI policies for advisory firms. In fact, there’s one massive broker-dealer that you know of that I can personally attest is taking over six months to review and approve new AI capabilities from their existing tech vendors.
5. Vendor Vetting Procedures – The SEC just gave notice of enforcement for Reg S-P amendments that affect all covered institutions as of June 3rd, 2026, which change what firms are legally required to enforce during the vendor vetting and approval process. If someone wants to submit a new vendor for approval, what’s the general process? What documentation do they need? What are some minimum requirements that any vendor needs to meet at a quick glance before they’re even considered?
6. Incident Response – If a vendor’s platform is breached, to no fault of your own, what’s your firm’s response? What is your legally responsible timeline for disclosing to the appropriate parties who may be affected by the breach?
7. Personal Device Usage – If a staff member, even the Managing Partner or Founder, wants to use an AI-powered platform on their personal device, what platforms can they use, and how can they use them if they want to use your clients’ and firm’s data?
8. Governance & Enforcement – Give your policy some teeth. I recommend including some disciplinary language, an escalation path, and violation monitoring.

How to Create an AI Usage Policy as an RIA Firm Step-by-Step

Start your AI Usage Policy by stating its purpose, naming the responsible party for policy questions, and, most importantly, timestamping your policy and distributing it firmwide whenever there’s an update. If you sort your tech stack by levels or tiers, include a clear definition of each level. 

The next section lists all of your current approved tech. You may want to do this in a grid format so you can color-code what each item is approved for and its respective usage level. For example, if you use Holistiplan, it’s likely to be Level I with full approval for client data usage within Holistiplan.

Immediately after mentioning and segmenting your approved tech, include a section titled “Prohibited Use Cases.” Give clear direction on approved alternatives so your staff knows where to go instead.

Then, include your sections on Capability Updates and Vendor Vetting for New Tech. This doesn’t have to be a large section, probably only a paragraph or two, that helps your staff know what to expect as far as timeline.

Finally, end with enforcement expectations, recommendations, and encouragement that if someone isn’t sure whether something’s approved, they can connect with the right person overseeing the policy.

This isn’t a complicated document, but it’s essential. Creating your AI Usage Policy, especially as an RIA firm, may be one of the most foundational documents you work on for your firm’s future.

Related Content: Why Most RIA AI Policies Fail – And How to Fix Your AI Policy Before Your Next SEC Exam

What Is the SEC Asking RIA Firms About AI Usage?

The U.S. Securities and Exchange Commission explicitly stated on page 17 in its Fiscal Year 2026 Examination Priorities document that:

“With respect to AI, the Division will focus on recent advancements in AI and will review for accuracy registrant representations regarding their AI capabilities or AI. The Division will assess whether firms have implemented adequate policies and procedures to monitor and/or supervise their use of AI technologies, including for tasks related to fraud prevention and detection, back-office operations, anti-money laundering (AML), and trading functions, as applicable. Reviews will also consider firm integration of regulatory technology to automate internal processes and optimize efficiencies.”

Translation: Your AI Policy will likely be one of the first documents the SEC requests moving forward. Now, before you wonder if this is a new enforcement, no, the current SEC investment advisor oversight includes this type of governance.

Without a solid AI policy, you’re already handing the SEC a compliance finding from Day 1.

What to Do If Your RIA Firm Doesn’t Have an AI Policy Yet

If your RIA firm doesn’t have an AI policy yet, don’t buy another piece of software until you have this document in place.

It doesn’t take that long to create and implement a solid AI policy, maybe a week or two. And I get it – everything inside you may be yelling, “Jon, we’re already behind with AI!” Every vendor may laugh at this idea – if they truly care about your firm, they’ll respect you putting in healthy guardrails first.

RIAs who adopt these policies first will be much better positioned to scale with confidence because every new software decision can flow through this framework.

Now, what if you need help creating your AI policy? That’s part of what we do inside our Advisor Systems program with Advisor Story. Hit the link to start a conversation with our team.