AI Errors in Client Advice: Liability and E&O Coverage

Advisers using AI for financial plans, meeting notes and client letters ask two things: who answers for a wrong figure, and whether the errors and omissions policy covers it. The duties are ones advisers and broker-dealers already have, and the review steps that meet them are the same steps that make AI output worth using.

The adviser's duty of care

The SEC set out the standard in its Commission Interpretation Regarding Standard of Conduct for Investment Advisers (Release IA-5248, effective July 12, 2019). The duty of care includes "the duty to provide advice that is in the best interest of the client," the duty to seek best execution where the adviser selects broker-dealers, and "the duty to provide advice and monitoring over the course of the relationship."

Three parts of it apply directly to AI-assisted work.

• Knowing the client. For a retail client, an adviser "should, at a minimum, make a reasonable inquiry into the client's financial situation, level of financial sophistication, investment experience, and financial goals." A plan built from an AI summary of a meeting depends on that summary being right, so check it against what the client said.
• Checking the facts. A reasonable belief that advice is in the client's best interest "also requires that an adviser conduct a reasonable investigation into the investment sufficient not to base its advice on materially inaccurate or incomplete information." When figures come from a model, checking them against the source is part of meeting this.
• No waiver. The SEC says "an adviser's federal fiduciary duty may not be waived, though its application may be shaped by agreement." It also says there are "few (if any) circumstances" in which a hedge clause in an agreement with a retail client would be consistent with the antifraud provisions, where the clause purports to relieve the adviser from liability for conduct as to which the client has a non-waivable cause of action. Any clause about AI errors in an advisory agreement belongs in front of counsel for that reason.

CFP Board's Generative AI Ethics Guide makes the same point for CFP professionals. It says generative AI "cannot replace" a professional's "care, skill, prudence and diligence," and that professionals using it "remain responsible for their final work product." It names hallucinations directly, with the example of an outdated forecast presented as actual performance.

Broker-dealers: Reg BI and supervision

When a broker-dealer makes a recommendation to a retail customer, Regulation Best Interest's Care Obligation requires "reasonable diligence, care, and skill" to understand the potential risks, rewards and costs of the recommendation and to have a reasonable basis to believe it is in that customer's best interest, based on the customer's investment profile.

FINRA Rule 3110 requires a supervisory system "reasonably designed to achieve compliance with applicable securities laws and regulations," and written procedures to supervise the types of business the firm engages in. In Regulatory Notice 24-09 (June 27, 2024), FINRA says its rules are "intended to be technology neutral" and apply to generative AI, including use "through embedded features in existing third-party products." For a firm using generative AI as part of its supervisory system, FINRA says policies and procedures "should address technology governance, including model risk management," and "data privacy and integrity, reliability and accuracy of the AI model."

FINRA's 2026 Annual Regulatory Oversight Report defines hallucinations as "instances where the model generates information that is inaccurate or misleading, yet is presented as factual information." Among practices firms may consider, it lists "validation and human-in-the-loop review of model outputs, including performing regular checks for errors or bias."

Supervision at an advisory firm

Rule 206(4)-7 requires written policies and procedures "reasonably designed to prevent violation" of the Advisers Act, and a review "no less frequently than annually" of their adequacy and the effectiveness of their implementation.

Section 203(e)(6) of the Advisers Act lists failing "reasonably to supervise, with a view to preventing violations" as a ground for SEC action against an adviser. The same paragraph says no person is deemed to have failed to supervise if there were "established procedures, and a system for applying such procedures, which would reasonably be expected to prevent and detect, insofar as practicable," the violation, and the supervisor reasonably carried out those duties. Written AI review procedures, and evidence that staff follow them, are what a firm would point to under that paragraph.

E&O and cyber coverage: questions for the carrier

The NAIC describes professional liability or errors and omissions insurance as "coverage for wrongful practices by professional service providers," and notes that a standard commercial general liability policy does not cover "Professional liability for errors and omissions such as failure to provide appropriate advice." The NAIC's guides on small business insurance and on cyber insurance do not say how policies treat work prepared with AI, so the answer is in each policy's wording.

The NAIC's general advice applies: "Check to see what is and is not covered so you are fully protected," and "Review all insurance policies annually." Questions to put to the E&O carrier or broker, with the answers in writing:

1. Does the policy's definition of professional services include advice and documents prepared with AI tools?
2. Does any exclusion or endorsement mention artificial intelligence, automated tools, algorithms or software errors?
3. Does the application or renewal form ask about AI use, and how should the firm describe the tools it uses?
4. If a claim involves an error in a vendor's AI tool, how does the policy treat it, and does the vendor contract affect coverage?
5. Are regulatory investigations and defense costs covered, and does the policy include a duty to defend?
6. What notice does the policy require when the firm finds an AI-related error before any client complains?

For cyber coverage, the NAIC's cyber insurance guide, developed with the FTC, says to make sure a policy covers "Cyberattacks on your data held by vendors and other third parties," and to consider whether the insurer will "Defend you in a lawsuit or regulatory investigation." Ask whether client data held by an AI vendor, such as a notetaker or a CRM assistant, counts as data held by a vendor under the policy.

Take these questions to each renewal along with the firm's AI tool inventory, so the carrier's answers match the tools in use.

Controls that reduce AI errors

• Review before anything reaches a client. A named reviewer checks every figure against the system of record. CFP Board's checklist asks professionals to evaluate output for accuracy, completeness ("such as ensuring that an automated Client meeting summary did not omit important information"), material conflicts of interest and inappropriate bias, and to review "any underlying sources cited in the Generative AI output to ensure they exist."
• Evidence of review. For broker-dealers, FINRA Rule 3110.07 says evidence of review must "clearly identify the reviewer," along with what was reviewed, the date of review and the actions taken on any significant regulatory issues found, and that opening a communication does not count as review. Advisers can keep the same evidence for AI-assisted client documents.
• Testing before rollout. CFP Board suggests confirming accuracy "by testing the Generative AI platform using a sample data set." FINRA's 2026 report names privacy, integrity, reliability and accuracy as testing areas.
• Written policy. AI provisions belong in the compliance manual under Rule 206(4)-7. The AI policy page has sample language for human review and incident reporting, and the compliance page has four annual review tests for AI controls.
• Records. Keep the output, the reviewed version and the evidence of review where the firm's records rules require. The AI records guide maps each AI record type to Rule 204-2 and Rule 17a-4.

When an error reaches a client

Correct it with the client, document what happened and what changed, and report it to the chief compliance officer under the firm's incident procedure. Read the notice provisions in the E&O and cyber policies and follow them, and ask counsel whether the facts require anything further. Then fix the step that let the error through: a review that was skipped, a source document that was out of date, or a tool used outside its approved purpose. Log each fix with the incident record, so the next annual review can test whether it held.