Article summary
In brief
There’s an 85% chance your RIA firm doesn’t have an AI policy. And if it does, your AI policy probably has at least one big gap that will likely lead to a compliance finding during your next SEC exam. This article reviews six of the most common areas where RIA firm’s AI policies fail SEC exams and how to fix those areas.
On this page
“I uploaded some statements, a couple of estate docs, and some other data into ChatGPT, and now the Managing Partner wants to meet.”
Those were the exact words I heard from a paraplanner at a multi-location RIA firm.
That’s the type of scenario keeping CCOs awake at night. His firm didn’t have an AI policy, and there’s an 85% chance that your firm doesn’t have one, either. And if it does, it probably has at least one big gap.
In this article, I’m going to share with you:
- Six areas where most RIA firms’ AI policies fail and how to fix them before your next SEC exam.
- The five most common AI policy problems I’ve seen in RIA firms and why they can put you in hot water with the SEC.
- For each problem, we’ll also look at how to fix it.
- What to do right now if your firm doesn’t have a policy or isn’t sure where to start.
Prefer to watch this content instead? Hit play below or watch here. Prefer to read? The article continues below the video.
Now, legal told me we need to add disclosures:
LEGAL DISCLOSURE: I am not an attorney, nor am I your regulatory authority, nor am I your Compliance representative. Nothing in this article or any other content created by Advisor Story is legal advice or regulatory advice, and should not be taken as such. Please consult with your legal and/or Compliance representatives for review and approval of any new policies or practices.
Disclosures aside, here are the five problems I most often see with AI policies for RIA firms.
Problem 1: The AI Policy doesn’t exist!
It’s kind of cheating to say that the biggest problem with AI policies for many RIA firms is that the policies simply don’t exist! InvestmentNews found that only 15% of RIA firms have any type of AI policy, and the SEC, in its Fiscal Year End 2026 Examination Priorities, said it’s prioritizing AI governance in exams for Q3 2026 onward.
Given how the SEC reviews compliance findings, not having a formal AI policy could put your firm at risk of civil fines, C&D orders, and formal censures.
So, how do you fix that problem? I created another article with video that walks you through, step by step, how to draft at least the first version of your AI policy.
Related Content: How to Create Your AI Policy as an RIA Firm
Problem 2: No Approved Platform List & No Data Governance Tiers
The second problem I’m seeing with AI policies is that they don’t clearly specify which platforms or programs are approved, which capabilities within each platform are approved, which access tiers are approved, and how your staff can use them.
If your policy doesn’t list your exact tech stack with specific mentions of what is or isn’t allowed to handle your clients’ data, it exposes your firm to misuse allegations and improper data management. There’s no standard for enforcement.
So, how do you fix that? You build an approved platform list as a living document within your policy. Include the name of the tool, its approved use cases, the data classification it’s permitted to touch, and the date it was last reviewed. It’s also wise to include a fast-track process for reviewing and approving new AI capabilities inside previously approved tech.
Problem 3: The AI Policy Lacks ‘Teeth’.
The third problem I see with AI policies is that they lack teeth. A policy without consequences is well…more like guidelines. The SEC and FINRA are actively monitoring AI oversight, and your policy won’t pass their approval if it lacks disciplinary guidance.
You can fix this by adding an enforcement ladder that covers first violations, repeat violations, and termination-level thresholds. Education needs to be at the forefront of policy. Enforcement is what happens after education is clearly offered and accepted, before a violation occurs.
Problem 4: The AI Policy Doesn’t Meet Reg S-P Amendment Requirements.
Reg S-P amendments went fully active for all U.S.-based RIAs on June 3rd, 2026, including incident response requirements, data breach containment protocols, and third-party vendor security notifications in the event of data compromise. If your AI policy doesn’t meet the Reg S-P amendments, it may now be flagged as a minor compliance finding, but I fully expect the SEC to start enforcing those requirements with greater force in the near future.
I recommend reviewing the latest version of these amendments and doing your own due diligence. A few links are in the description below to help kickstart your research. At the very least, your policy needs to include incident response protocols, service provider breach notification rules, and a secure way to document all potential incidents.
Problem 5: Personal Device Usage of Your Firm’s Data
Does your AI policy include guardrails for employees, including advisors and admins, on when and how they can use firm accounts in AI-powered programs on their personal devices? If not, that’s likely your biggest data-usage liability.
This is the situation I mentioned at the very beginning of this video. A paraplanner at a firm I was working with got my cell number through our folder system and called to let me know someone had uploaded a set of account statements, estate docs, and other PII into their ChatGPT account. In their words, “I was just trying to do some analysis on their account.”
It sounds colossally stupid, right, and yet, we’re going to see more and more financial professionals lose their jobs because of this exact type of incident.
Yes, they got fired, but I wonder how much the firm itself is to blame. The firm had no AI policy in place. The advisory team was using AI in the shadows, and the Director of Operations had no visibility into how rampant it was.
That’s why your AI policy needs to include data governance and usage guardrails for firm-specific AI platforms regarding personal device use. There are likely at least a few gaps in data usage that your compliance team may not even know exist. You fix that by extending your policy to cover personal device usage. The policy needs to follow the data, not just the device.
What To Do If Your RIA Firm Does Not Have an AI Policy Yet
Your AI policy doesn’t have to be an exhaustive document – it can be only a few pages if it’s efficient. But what do you do if your RIA firm doesn’t have an AI policy, or if you do have a policy that hasn’t been reviewed for a year or two?
The first thing you need to do is create a new AI policy with your legal and compliance staff’s assistance. This is one part we include with our Advisor Systems program. Connect with our team to see how we may help you implement AI, including drafting your new AI usage policy together.