An AI governance policy for an advisory firm

There is no rule that says "adopt an AI policy" by name. There is a rule that says your compliance program has to work. Advisers Act Rule 206(4)-7 requires SEC-registered advisers to adopt and implement written policies and procedures reasonably designed to prevent violations of the Act, to review them at least annually, and to designate a chief compliance officer responsible for administering them.

Once AI touches client data, client communications, or the way advice is prepared, the existing program has to address it. Whether that is a standalone policy or a set of amendments to the ones you already have is a matter of house style. A standalone document is usually easier to show an examiner.

The chief compliance officer owns the policy. Someone else, usually whoever runs technology or operations, owns the inventory of tools and the technical review that feeds into it. Write both names down. A policy with no named owner is reviewed by nobody.

For smaller firms where those are the same person, say so explicitly rather than leaving the reader to infer it. Examiners read absence as ambiguity.

Wider than the tools you bought. The policy should cover AI features inside software you already use and did not think of as AI purchases, and it should cover consumer chatbots that staff can reach from a browser without asking anyone.

That second category is where most firms are actually exposed. Someone pasting a client email into a general-purpose assistant to get help with a reply has sent client information to a third party without a contract, a data processing agreement, or a record. The policy has to say plainly whether that is permitted, and if it is not, the firm needs a sanctioned alternative that is easier than the unsanctioned one. A prohibition with no substitute gets ignored.

By what the output touches, not by how impressive the technology is. A workable three-tier split:

• Internal only: the output never leaves the firm and never reaches a client. Summaries for internal preparation, research notes, drafting scaffolding. Lightest review.
• Client-facing: the output reaches a client, in writing or in a meeting. Requires named human review before it goes, and a record of who reviewed it.
• Advice-bearing or transactional: the output informs a recommendation, or touches money, holdings, or account instructions. Highest scrutiny, and the tier where you should be slowest to adopt.

The tiers matter because they let you approve the low-risk uses quickly. A policy that treats meeting-note summarization with the same ceremony as an allocation model will be routed around within a month.

Set the line explicitly and set it once. The defensible version is that anything leaving the firm, and anything consequential inside it, passes through a named person who is accountable for it. "Reviewed" has to mean a person made a decision, not that a person had an opportunity to object.

Then make the review evidenceable. If the reviewer’s name and the time of approval are not captured somewhere, the control exists in the policy and nowhere else.

Write down the path, keep it short, and make it the fastest route to a yes. A workable one: a requester describes the use case and the data it touches; the technology owner runs vendor diligence; the CCO assigns a risk tier and approves, refuses, or approves with conditions; the decision and its date go into the inventory with a review date attached.

The diligence step is the substantive one. It is worth using the same questionnaire every time so the answers are comparable across vendors and across years.

Treat it as a supervision question rather than a disciplinary one, at least at first. Say what is permitted, say what is not, tell people where to ask, and make the approved path genuinely usable. Then check: most firms discover the answer by asking, not by monitoring.

Cover it in training, and repeat the training when the tools change, which is roughly annually at the current pace.

It depends on what the AI does. If it materially affects how advice is formulated, that is a different disclosure question from a tool that drafts an internal meeting summary. Your Form ADV describes your advisory business and your practices, and whether AI use rises to a material fact is a judgment for your counsel.

A related and often overlooked question: if meetings are being recorded or transcribed, consent obligations vary by state and some require the consent of all parties. Decide the firm’s standing practice, put it in the policy, and make it the default in the tooling rather than something a person has to remember at the start of each call.

One row per tool, and enough on the row to answer an examiner without a follow-up:

• What the tool does, in a sentence.
• What data it receives, and whether client personal information is among it.
• Whether that information reaches an AI model, and what happens to identifiers before it does.
• Its risk tier, and the human review the tier requires.
• Who approved it, when, and on what conditions.
• Which vendor documents are on file, and where they are.
• The next review date.

Two kinds, and firms usually plan for only the first. The outputs may be records under Rule 204-2 if they relate to recommendations made or advice given. Separately, the policy generates its own evidence: approvals, the inventory, training attendance, the annual review, and any exceptions granted.

Decide where each lives before you need it, and prefer places that keep the history rather than the current state.

Sample. Pick a handful of client-facing outputs the tools produced and check that the review actually happened and left a trace. Pick a tool from the inventory and confirm the access it has still matches what was approved. Ask a few people what they use, and compare the answers to the inventory.

Record what you tested and what you found, including when you found nothing. A test with no artifact is indistinguishable from a test that did not happen.

Only what it can evidence. The Advisers Act marketing rule prohibits untrue or misleading statements of material fact in an adviser’s advertisements, and the Commission has brought enforcement actions against advisers for overstating their use of artificial intelligence.

The practical control is to route public statements about technology through the same review as any other advertisement, and to hold each claim to the standard of being supportable from a vendor contract or a document the vendor provided. Where a vendor hedges a claim, hedge it identically.

At least annually, alongside the rest of the compliance program, because Rule 206(4)-7 requires the annual review. In practice this area moves faster than the calendar, so it is worth also triggering a review on events: a new tool, a vendor changing its processing arrangements or sub-processors, an incident, or a change in the applicable rules.

Date the document, keep the prior versions, and note what changed and why. The version history is often more useful to an examiner than the current text.