AI Compliance for Financial Advisors: Navigating SEC and FINRA Requirements

You want to use AI. Your competitors already are. But every time you open ChatGPT, the same question stops you cold: Am I allowed to do this?

The answer is yes — with conditions. Neither the SEC nor FINRA has banned financial advisors from using AI tools. But both regulators have made clear that the existing rules apply to AI-generated content the same way they apply to content you write yourself. The advisor who pastes a ChatGPT-generated market commentary into a client email without review is taking the same compliance risk as one who sends an unreviewed letter drafted by a junior associate — except the AI version may be faster, more confident-sounding, and more subtly wrong.

This guide lays out the current regulatory landscape, the specific rules that apply, and the practical framework you need to use AI without putting your registration at risk.

This article provides general guidance based on publicly available regulatory positions as of 2026. It is not legal advice. Consult your compliance department or a securities attorney for guidance specific to your practice.

The Regulatory Landscape: Where Things Stand

The SEC's Position

The Securities and Exchange Commission has not issued a standalone rule governing AI use by investment advisers. Instead, the SEC has signaled consistently — through enforcement actions, risk alerts, and staff guidance — that existing regulations apply fully to AI-generated content.

The core principle: you are responsible for everything that leaves your practice, regardless of how it was produced. An AI tool is a productivity instrument, not a compliance shield. If your AI drafts a misleading performance claim, the violation is yours.

Three existing SEC rules carry the most weight for advisors using AI:

The Marketing Rule (Rule 206(4)-1): Adopted in 2021 under the Investment Advisers Act, this rule governs all adviser advertisements and applies to AI-generated marketing content — social media posts, blog articles, email campaigns, website copy, and client-facing newsletters. AI-generated content must meet the same standards as human-written content: no untrue statements of material fact, no unsubstantiated claims, no misleading implications. The rule's requirement for a "reasonable basis" for claims means that AI hallucinations — plausible-sounding but fabricated statistics or performance data — are a direct compliance risk.

The Books and Records Rule (Rule 204-2): This rule requires advisers to maintain certain records. AI-generated content used in client communications, marketing, or investment decision documentation falls under these requirements. The practical implication: you need to retain both the final output and sufficient records to demonstrate supervisory review.

The Compliance Rule (Rule 206(4)-7): This rule requires advisers to adopt and implement written compliance policies and procedures. If your practice uses AI, your compliance manual should address it. An examiner who finds AI tools in active use with no corresponding policy will flag it.

FINRA's Guidance

For broker-dealers and registered representatives, FINRA's framework adds additional layers:

Communications with the Public (Rule 2210): FINRA classifies communications as retail, correspondence, or institutional. AI-generated content distributed to more than 25 retail investors within a 30-day period is classified as "retail communication" requiring principal pre-approval. This means an AI-drafted newsletter blast or social media post targeting retail investors must go through your firm's review process before distribution — no exceptions.

Suitability and Regulation Best Interest: If AI tools are used to generate investment recommendations, portfolio suggestions, or financial plans, the output must still meet suitability (for broker-dealers) or fiduciary (for RIAs) standards. The AI cannot perform the suitability analysis for you. It can draft the documentation, but the professional judgment must be yours.

Supervisory Requirements (Rule 3110): Firms must establish and maintain a supervisory system reasonably designed to achieve compliance. If advisors in your firm use AI, the supervisory system must account for it — including how AI-generated content is reviewed, who reviews it, and how review is documented.

Specific Compliance Requirements

Record-Keeping for AI-Generated Content

The record-keeping obligation is where most advisors underestimate the requirements. Best practice includes retaining:

The final output — the actual content sent to clients or published
The review record — documentation that a qualified person reviewed and approved the content before distribution
The prompt (where practical) — while not explicitly required by current rules, retaining the prompt that generated the content provides an audit trail that demonstrates intent and context
Edits and modifications — records of changes made between the AI's raw output and the final approved version

Store these records for the same retention period as equivalent non-AI communications — generally five years for investment advisers under SEC rules, with the first two years in an easily accessible location.

Supervisory Review Procedures

A compliant supervisory framework for AI-generated content includes:

Pre-use approval: Before any AI-generated content reaches a client, prospect, or the public, it must be reviewed by a qualified supervisor. For FINRA-registered firms, this means principal approval for retail communications.

Fact verification: AI tools hallucinate. They generate plausible-sounding statistics, cite nonexistent studies, and fabricate performance data with complete confidence. Every factual claim in AI-generated content must be independently verified against primary sources. This is non-negotiable.

Compliance screening: AI-generated content must be screened for the same issues you'd flag in human-written content — performance guarantees, promissory language, cherry-picked data, misleading comparisons, and testimonial violations.

Documentation: The review itself must be documented. A timestamp, the reviewer's identity, and the disposition (approved, approved with modifications, rejected) should be recorded for each piece of AI-generated content.

Disclosure Obligations

Current SEC and FINRA guidance does not explicitly require advisors to disclose AI use in content creation to clients. However, consider two factors:

First, your fiduciary duty includes a duty of honesty. If a client asks whether you wrote their financial plan yourself, answering truthfully is not optional.

Second, the regulatory trend is toward greater AI transparency. The SEC has proposed rules (though not yet adopted as of this writing) that would require investment advisers to disclose certain uses of predictive data analytics and AI in investor interactions. Building transparency into your practice now positions you ahead of likely future requirements.

Advertising and Marketing Compliance

AI is particularly useful for content marketing — and particularly risky. Common compliance traps in AI-generated marketing content:

Performance claims: AI will readily generate statements like "our clients averaged 12% returns" without any basis. Every performance claim must be supported by actual data and comply with the Marketing Rule's requirements for performance advertising.

Testimonials and endorsements: The 2021 Marketing Rule now permits testimonials and endorsements, but with conditions including disclosure requirements and oversight obligations. AI-generated fake testimonials are a clear violation.

Promissory language: AI frequently generates phrases like "guaranteed results," "risk-free," or "proven returns." These are compliance violations in virtually all contexts.

Third-party ratings: If AI-generated content references ratings or rankings, those references must comply with the Marketing Rule's specific requirements for third-party ratings.

AI as a Tool vs. AI as an Advisor

This distinction carries critical fiduciary implications.

AI as a tool means the advisor uses AI to increase efficiency — drafting communications, summarizing research, generating documentation templates, analyzing data. The advisor exercises professional judgment on all outputs. This is permissible under current regulations with appropriate supervision.

AI as an advisor means AI is making or materially influencing investment decisions, suitability determinations, or fiduciary judgments. This raises fundamental questions about whether the advisor is fulfilling their professional obligations or delegating them to a machine.

The line matters. Using ChatGPT to draft a retirement analysis summary based on data you've analyzed is using AI as a tool. Asking ChatGPT "Should my client retire at 62 or 65?" and forwarding the answer is using AI as an advisor — and it exposes you to liability if the recommendation is wrong, because the professional judgment was never exercised.

The rule of thumb: AI can draft, organize, analyze, and summarize. The advisor must decide, recommend, and take responsibility.

Building an AI Policy for Your Practice

Every advisory practice using AI should have a written AI policy. This isn't optional paranoia — it's what Rule 206(4)-7 requires when you adopt new tools that affect how client-facing work is produced.

Essential Policy Components

Scope: Which AI tools are approved for use, and which are prohibited. Specify by name — "ChatGPT (OpenAI), Claude (Anthropic)" — rather than by category, since new tools launch constantly and generic policies create ambiguity.

Permitted uses: List specific use cases that are approved: drafting client communications, summarizing meeting notes, generating marketing content, analyzing data sets. Be explicit.

Prohibited uses: List specific uses that are not permitted: generating investment recommendations, creating performance projections, producing compliance filings without full human review, inputting client PII into non-enterprise AI tools.

Data protection: Address what information can and cannot be entered into AI tools. Client names, account numbers, Social Security numbers, and portfolio details should never be entered into consumer-grade AI tools that may retain and train on inputs. Enterprise AI agreements with appropriate data processing terms are the standard for handling sensitive client data.

Review workflow: Document the step-by-step process for AI-generated content: who creates it, who reviews it, how review is documented, and who has final approval authority.

Training requirements: Specify that all personnel using AI tools must complete training on the policy before use, with annual refresher requirements.

Incident response: Define what happens when AI-generated content is distributed without proper review — the remediation steps, the reporting requirements, and the documentation obligations.

Common Compliance Mistakes

Mistake 1: Treating AI Output as Reviewed Content

The most dangerous mistake. AI generates polished, professional-sounding text that reads as if it's already been through compliance. It hasn't. Treat every AI output as a first draft requiring full review.

Mistake 2: Entering Client PII Into Consumer AI Tools

Consumer-grade AI tools (free ChatGPT, free Claude, Gemini) may retain your inputs for training purposes. Entering client names, account numbers, or financial details into these tools is a data protection violation. Use enterprise-grade tools with appropriate data processing agreements, or strip all identifying information before input.

Mistake 3: No Documentation of AI Use

If an examiner finds AI tools on your work computer with no corresponding compliance policy, no review records, and no supervisory procedures, you've created a deficiency that will appear in your examination findings. Document everything.

Mistake 4: Using AI for Regulatory Filings Without Expert Review

AI can help draft ADV disclosures, compliance manual sections, or regulatory responses. But regulatory filings require precision that AI cannot guarantee. Always have a compliance professional or securities attorney review regulatory documents, even when AI assisted in the drafting.

Mistake 5: Assuming AI Understands Fiduciary Duty

AI models have no understanding of fiduciary obligation. They optimize for plausible, helpful-sounding responses, not for your client's best interest. Never delegate fiduciary judgment to an AI tool.

What to Do If Regulators Ask About Your AI Use

During an SEC examination or FINRA audit, you may be asked about AI usage. Preparation is straightforward:

Have your policy ready. A written, board-approved AI policy demonstrates proactive compliance. Present it early in the examination process.

Show your review records. Documentation of supervisory review for AI-generated content demonstrates that your practice treats AI output the same as any other draft communication.

Demonstrate training. Records of staff training on AI policy and compliance requirements show that the policy isn't just a document — it's an operational reality.

Be transparent. If asked whether specific content was AI-generated, answer honestly. Attempting to conceal AI use from regulators is far more dangerous than disclosing it.

Know your tools. Be prepared to explain which AI tools you use, how they're configured, what data they can access, and what data processing agreements are in place.

The advisors who will face the most scrutiny are not those who use AI — it's those who use AI without controls. A well-documented, properly supervised AI practice is a strength, not a vulnerability.

Also read:

The Complete Compliance-First AI Framework

This article covers the regulatory essentials. AI for Financial Advisors goes deeper — 745 pages covering 66 SEC/FINRA-compliant prompts, 5 complete workflows with built-in compliance checkpoints, the CREA Method for turning any advisor task into an AI-optimized process, and a full chapter on building your practice's compliance infrastructure for AI. Every prompt designed with regulatory requirements in mind.

>>> Get the Book: AI for Financial Advisors <<<