AI Use and Oversight: Key Considerations for Financial Services Firms

 

Artificial intelligence is becoming part of the everyday technology financial services firms use, often without a firm making a formal decision to “adopt AI.”  This article applies to investment advisers, broker-dealers, and other financial services firms.  We discuss areas a firm should address today and have made available an AI Usage Policy Template to help you with the process.

Employees may be using generative AI to assist with research, prepare internal or client-facing materials, summarize meetings, conduct research, or support other day-to-day tasks.  At the same time, software providers are incorporating AI functionality into products that advisers already use.  These applications raise the important question: Does the firm know where AI is being used, what information is being provided to AI tools, and how AI-generated output is being used?

That question has also become increasingly relevant from a regulatory perspective. The U.S. Securities and Exchange Commission (SEC)’s Division of Examinations identified AI as an area of focus in its Fiscal Year 2026 Examination Priorities.  Among other things, the Division indicated that it will assess whether firms have adequate policies and procedures to monitor and supervise their use of AI and whether firms are accurately representing their AI capabilities and use.[1]  While formal guidance has not yet been issued by the regulators, it is clearly on their examination agenda.

Start With How AI Is Actually Being Used

Before implementing an AI policy, firms should understand how AI is being used across the organization so that the policy can be tailored to the firm’s business and risks.  That exercise may be broader than it initially appears.  A firm may not have purchased a standalone AI platform, but employees may be using publicly available tools or AI functionality embedded in meeting transcription tools, research platforms, CRM systems and other software.  Create a survey and ask employees to share how they currently use AI in their work and also identify areas where they would like to use it.  It is important to gain that understanding not only to appropriately drive business forward, but understand how to address regulatory considerations at your firm.

Given the increasing use of AI across business functions and the SEC’s focus on the area, firms should proactively understand how AI is being used within their organizations.

Once those uses are identified, firms should consider the risks associated with them.  Using AI to format an internal document, for example, raises different considerations than using it to prepare investment research, generate client communications, or support investment decisions.  Sophisticated users are now using bots and agents to automate or assist with key functions across a firm including operations, compliance and fundraising, including other business functions.  Firms should pay particular attention to AI agents that can take actions rather than simply generate content. Depending on their configuration, AI agents may access systems, retrieve data, initiate workflows, communicate with third parties, or perform other tasks with limited user involvement.  These use cases may warrant heightened oversight and controls given the potential operational and compliance risks

Particular attention should be paid to the type of information employees provide to AI tools. Client information, personal information, proprietary research, portfolio information, and other confidential information should not be entered into an AI tool without understanding how that information will be retained, protected, and used.  Not all AI tools provide the same level of data protection or confidentiality, and protections may vary depending on the provider, account type, and how the tool is configured.

Human review remains essential.  The level of review should reflect how the AI is being used and the potential consequences if the output is inaccurate.  While AI input can save considerable time and provide valuable insights, it makes mistakes that can be costly and embarrassing.  Uses involving clients, investment decisions, performance, marketing, or other higher-risk activities will generally warrant greater oversight than routine administrative uses. AI-generated information should be independently verified before it is relied upon or distributed.  Firms should document the results of this assessment, including significant AI use cases identified and any related risks or controls.

Existing Compliance Obligations Still Apply

AI does not necessarily require an entirely new compliance framework.  Its use often implicates obligations that advisers already have relating to fiduciary duty, privacy and information security, marketing, books and records, cybersecurity, vendor oversight, and supervision.  For example, using AI to summarize a client meeting does not eliminate the need to confirm that the resulting record is accurate.  Using AI to assist with investment research does not eliminate the investment professional’s responsibility to understand and evaluate the information before relying on it.  And using AI to draft client communications does not change the firm’s obligations to appropriately review and retain those communications.  A firm must also consider its recordkeeping obligations with such use and AI outputs. Firms may also wish to review contractual provisions addressing data ownership, confidentiality, security, AI model training, and the vendor’s rights to use firm or client information.

Firms should also be careful about how they describe their use of AI.  In 2024, the SEC brought enforcement actions against two investment advisers for false and misleading statements regarding their purported use of AI, resulting in $400,000 in combined civil penalties.[2]  In each case, the firms made claims about AI capabilities or uses that were not supported by its actual practices.  Advisers should confirm that statements about AI in websites, marketing materials, regulatory filings, DDQs, and other communications accurately reflect how the technology is actually being used.

What Should Investment Advisers Be Doing Now?

As AI becomes more integrated into advisers’ day-to-day operations, firms should consider establishing a written AI policy that reflects how the technology is actually being used and sets clear expectations for employees. In developing their approach to AI oversight, firms should consider the following:

1. Build an inventory of AI use: Identify standalone AI tools, employee use of publicly available AI, and AI functionality embedded in existing systems. Survey your employees to ensure you have the full picture.
2. Assess AI use cases: Distinguish lower-risk administrative uses from activities involving clients, investments, trading, marketing, performance, or confidential information.
3. Establish an AI policy and practical guardrails: Establish expectations around approved tools and uses, the types of information that may be entered into AI tools, appropriate human review and oversight, and employees’ responsibility for reviewing and, where appropriate, independently verifying AI-generated output. The AI Usage Policy Template accompanying this article can serve as a starting point and should be tailored to reflect the firm’s actual AI use, business practices, and risks.
4. Review relevant vendors: Consider AI-related risks as part of the firm’s due diligence and ongoing oversight of relevant service providers. Depending on the provider and how its AI functionality is used, firms may want to understand how firm and client information is retained, protected, used, and shared, including whether that information may be used to train or improve AI models.  For example, an adviser could ask: “Does your organization use any firm or client data submitted through AI-enabled features to train or improve AI models?  If so, please describe how that data is used, retained, protected, and whether customers can opt out of such use.”
5. Review external statements about AI: Confirm that websites, marketing materials, Form ADV disclosures, DDQs, and other communications accurately describe the firm’s actual practices. Be careful with “AI washing.”
6. Train employees: Employees should understand the firm’s expectations regarding AI use, including approved tools, restrictions on confidential information, expectations for reviewing AI-generated output, and when additional review or approval may be required. Follow this up with email reminders most tailored to your firm and its use of AI.
7. Periodically review AI use and controls: Consider AI use and oversight as part of the firm’s ongoing compliance monitoring and, as appropriate, its annual compliance review. Firms should consider whether AI use has changed, whether employees are following the firm’s policies, whether new AI functionality has been introduced through existing vendors, and whether existing controls remain appropriate in light of the firm’s actual practices.  Conduct testing in this area.  As always, advisers should make sure that these assessments, their findings, and any follow-up steps are documented and retained.

AI presents significant opportunities for financial services firms, but those opportunities should be accompanied by appropriate governance and oversight. Firms do not need to eliminate AI-related risks, but they should understand how AI is being used, establish reasonable controls, and ensure that employees remain accountable for the work product generated with the assistance of AI.  FiSolve assists financial services firms with assessing AI use, tailoring and implementing the accompanying AI Usage Policy Template, reviewing vendor diligence and data-handling practices, providing employee training, reviewing AI-related disclosures, and incorporating AI into the firm’s compliance monitoring and annual review process.  We will be glad to assist you.

Have questions about how AI fits into your firm’s compliance program? FiSolve can help! Please reach out at Info@FiSolve.com for more information.

Article written by Megan Druss, Regulatory and Compliance Specialist

AI Usage Policy Template written by Megan Druss, Regulatory and Compliance Specialist and Solomon Reichbach, Regulatory and Strategic Solutions Analyst

[1] https://www.sec.gov/newsroom/press-releases/2024-36

[2] https://www.sec.gov/files/2026-exam-priorities.pdf