What the rules actually require.
Rule numbers named so you can check them. The artifacts, not another summary of the alert.
No SEC or FINRA rule prohibits an adviser from using AI, and FINRA said so directly in Regulatory Notice 24-09 — the rules are technology-neutral and apply whether the tool was built in-house or bought. The obligations that do apply are the ordinary ones: written procedures under Rule 206(4)-7, records under Rule 204-2, supervision under FINRA Rule 3110, and accuracy in anything that counts as an advertisement under Rule 206(4)-1.
Build the inventory before the policy.
Firms write the policy first and then discover it does not describe what anyone is doing. Reported SEC exam requests start with an inventory of AI tools in use, governance documentation, the vendor list and diligence records, written policies, training records and incident response. The inventory is upstream of all of it.
One row per tool: what it is, who approved it, what data it touches, whether the vendor trains on that data, what it produces, and whether that output is retained. If a row cannot be completed, that is the finding — before an examiner makes it one.
The eight that come up.
Marketing Rule
Whether a communication is an advertisement. Turns on what the communication does, not who wrote it. A model drafting it changes nothing except that the adviser still owns every claim in it, including invented ones.
Substantiation and hypothetical performance→Compliance Rule
Written policies and procedures, a designated CCO, and an annual review. This is the hook your AI policy hangs on, and the annual review is where AI controls get tested — or do not.
The policy sections, with language→Books and Records
Five-year retention, the first two years in an easily accessible place. The question for an AI artifact is whether it falls into a listed record category, not whether a model produced it.
Antifraud, duty of care and loyalty
The fiduciary backdrop. Using a tool you cannot explain, in a process that shapes advice, is a duty-of-care question before it is a technology question.
The duty applied to tools→Communications with the Public
Retail communications and, under 2210(b)(1), principal approval before first use. Nothing switches off because a model produced the draft.
Supervision
Written supervisory procedures. If AI touches a supervised activity, the WSPs have to describe how it is supervised.
Electronic recordkeeping (BDs)
Since the October 2022 amendments there is an audit-trail alternative to WORM: recreate an original if a record is modified or deleted. Which pathway you are on determines what your archive has to do with AI output.
Regulation Best Interest
Broker-dealers only, and that distinction does most of the work — advisers acting as advisers are under Section 206 instead. Where it does apply, the Care Obligation is the part that moves when a tool decides which alternatives you ever see.
Which regime applies, and when→The two clients actually see.
Two of the rules above resolve into documents a client reads and signs, and both have a page of their own because the sample language is the thing people are looking for and nobody publishes it.
- Form ADV Part 2A disclosure language — sample text for Items 4 and 8, and the materiality test that decides whether you need any of it.
- The advisory agreement clause — three versions at three levels of involvement, and why none of them is the recording consent firms assume they are.
FINRA Notice 26-14, and why it does not change anything yet.
FINRA has proposed replacing the prescriptive principal pre-use approval standard in Rule 2210(b)(1) with a risk-based supervisory standard, motivated in part by the volume of individualised content AI makes possible. It is a proposal. The comment deadline was September 2026 and it is not in effect.
Several write-ups describe it as though the change has happened. Comply with 2210 as it stands today, and build your review process so that a move to risk-based tiering is a configuration change rather than a rebuild.
Do not describe AI you do not have.
In March 2024 the SEC settled charges against two advisers for overstating their AI use, with penalties of $225,000 and $175,000. This is the one part of the AI compliance landscape with a clear enforcement record behind it.
The test is simple and worth running today: take every AI claim on your website, your ADV and your pitch materials, and ask whether you could substantiate it this afternoon. Claims that describe a roadmap rather than a running system are the ones that fail.
Testing AI under 206(4)-7.
The annual review is a testing obligation, not a document refresh, and almost every published annual-review guide predates AI or ignores it. Four tests that produce evidence rather than assertions:
- Pull the inventory and confirm every tool in it is still approved and still in use. Shadow tools show up here.
- Sample AI-assisted client communications and check that the review step actually happened, with a name against it.
- Take one AI-produced artifact and try to retrieve it from your archive the way an examiner would. Most retention failures are retrieval failures.
- Ask one person who uses a tool daily to explain what it does with client data. If they cannot, the training record is decorative.
Get the next one.
Field notes from real deployments, written the way this one was. No schedule promised and nothing sold to you. Unsubscribe whenever.
Sources and standing.
Rules named above are cited by number so they can be checked at source. Last reviewed: September 2026. FINRA Regulatory Notice 26-14 is proposed and not effective; everything else described here is in force as at that date.
- 17 CFR 275.206(4)-1, Investment adviser marketing (the Marketing Rule) (checked 2026-10-27)
- 17 CFR 275.206(4)-7, Compliance procedures and practices (checked 2026-10-27)
- 17 CFR 275.204-2, Books and records to be maintained by investment advisers (checked 2026-10-27)
- 15 U.S.C. 80b-6, Advisers Act section 206 (prohibited transactions by investment advisers) (checked 2026-10-27)
- SEC Release IA-5248, Commission Interpretation Regarding Standard of Conduct for Investment Advisers (2019) (checked 2026-10-27)
- FINRA Rule 2210, Communications with the Public (checked 2026-10-27)
- FINRA Rule 3110, Supervision (checked 2026-10-27)
- 17 CFR 240.17a-4, Records to be preserved by brokers and dealers (checked 2026-10-27)
- 17 CFR 240.15l-1, Regulation Best Interest (checked 2026-10-27)
- FINRA Regulatory Notice 26-14, request for comment on changes to Rule 2210 (July 2026) (checked 2026-10-27)
This is not legal advice, and it is not a substitute for your compliance counsel. It is how a practitioner who implements these systems reads the rules, written down so you can check it. If something here is wrong, tell me and it gets corrected.
Keep reading
Build with us in Milwaukee.
Thirty minutes, one real constraint, and a written description of what could be built. No pitch decks, no small talk.