Wealth managers and RIAs are one of the four groups Torque AI works with, and the first question in every conversation is the same: can we use this at all? The answer is yes, and the firms that are using it well are not more daring than the rest. They are more organized. This article is general education about how firms are deploying AI, not legal or compliance advice. Your compliance consultant or counsel has the final word on your firm's program.
Why does AI feel riskier for an RIA than for other businesses?
Because the rules already in place were written for every communication, not just the ones a human typed. An adviser's fiduciary duty, the SEC Marketing Rule, Regulation S-P on client privacy, the books and records requirements, and the supervision obligations under the Advisers Act all apply to AI-assisted work exactly as they apply to a memo or an email. Nothing about a chatbot suspends them. For broker-dealer affiliated advisers, FINRA's communications rules sit on top of that.
The practical consequence is simple. AI does not create new obligations. It creates new ways to violate old ones faster, at volume. That is why the firms getting this right start with the data and the review process, not with the tool.
What are the five AI uses that pass a compliance review?
- Meeting notes and follow-up. An AI note-taker records the client meeting, produces a summary, drafts the follow-up email and creates the tasks in the CRM. The adviser reads the summary, edits it, and approves the email before it is sent. This is the most common first use at the firms I work with, and the time savings are immediate: a one-hour review meeting used to generate 30 to 45 minutes of writing afterward.
- Research and reading. Summarizing a 60-page fund document, a new tax provision or a custodian's updated procedures. The output is an internal starting point, not a client deliverable, and the adviser checks the source before relying on it.
- Client service drafts. First drafts of routine responses: how to update beneficiaries, what a form asks for, when a statement will arrive. A person reviews and sends. Nothing goes out automatically.
- Intake and scheduling. An assistant that answers the phone and website, collects a prospect's basic situation and goals, and books a discovery call with the right adviser. It gathers facts and schedules. It does not describe strategies or discuss suitability. This is the same pattern I laid out for law firms using AI for client acquisition: the lead is won or lost in the first ten minutes after it arrives.
- Document preparation. Pre-filling account forms from data the firm already holds, assembling meeting packets, and checking that a financial plan document has every required section before an adviser reviews it.
What these five have in common: a person who is licensed and supervised stands between the AI and the client every time, and the AI never sees more client data than the task requires.
Which three uses should wait?
- Unreviewed client communication. Any message, portfolio commentary or market note that reaches a client without a human approval step. The Marketing Rule and your supervision procedures do not care who wrote it.
- Recommendations. Letting an AI tool tell a client what to buy, sell or hold, or produce a plan that is delivered as-is. The adviser can use AI to prepare, but the recommendation is the adviser's, with the adviser's reasoning and records behind it.
- Client data in consumer tools. Pasting statements, account numbers, tax returns or anything personally identifiable into a free, consumer-grade chatbot. This is the single most common mistake, and it is a privacy problem before it is an AI problem. Use business accounts with data protection terms, or tools inside your existing custodian, CRM or planning platform.
How do you handle the SEC Marketing Rule with AI-drafted content?
Treat an AI draft like a draft from a junior associate. It goes through the same review, the same substantiation of any claims, the same performance-presentation rules if it mentions returns, and the same recordkeeping. Many firms add one step: a note of which tool produced the first draft, so a reviewer or an examiner can see the chain. If you already have a marketing review process that works, you do not need a new one. You need to route AI drafts into it.
What goes in the AI policy?
One page is enough to begin, and a one-page policy that staff actually read beats a 20-page policy that nobody does. The sections below cover what an examiner would expect to see.
One-page AI policy for an RIA: the sections
Approved tools. The named tools, the account type (business, not personal), and who approves additions.
Prohibited data. Client names tied to account details, account numbers, Social Security numbers, tax documents, statements, and anything that identifies a client, unless the tool is one the firm has vetted for that purpose.
Review requirements. Every client-facing output and every advertisement is approved by a licensed person before use. Every investment-related output is treated as research input, never as the recommendation.
Records. Where AI-assisted client communications and marketing are stored, and for how long, consistent with the firm's existing retention schedule.
Disclosure. When the firm tells clients an AI tool is in use, for example before recording a meeting.
Ownership and review. The named person who owns the policy and the date it is next reviewed, at least annually.
Where the firm is also defending against impersonation, add a line on verification. The deepfake cases I have covered on FOX 5 include voice clones of clients requesting wire transfers, and a verification step that does not rely on the voice on the phone belongs in the same document.
What does a 30-day rollout look like?
Week one. Write the policy. Pick one use from the five above, usually meeting notes. Choose a vendor whose terms say client data is not used for training and is stored in a way your compliance consultant accepts.
Week two. Run it with two advisers on internal meetings only. Review every output. Note where it was wrong.
Week three. Extend to client meetings with consent. Keep the human review step visible and logged.
Week four. Measure. Minutes saved per meeting, follow-up emails sent within 24 hours, and CRM tasks created without manual entry. Then decide whether use number two is intake or document preparation.
That sequence is how a revenue engine gets built in a regulated firm: one reliable step at a time, with the review process designed in from the start. I have helped a five-person team produce $32 million in revenue using AI-driven processes, and the lesson that carried over to advisory firms is that the discipline matters more than the tool.
If you want the policy, the first deployment and the review process built together, the AI Clarity Sprint does all three in three weeks. Details are on the engagements and FAQ page. For the prompts and procedures behind this kind of work, see ChatGPT for Profit, Volumes 1 and 2.
Frequently asked questions
- Can an RIA use ChatGPT or similar tools at all?
Yes, with rules. Most firms allow general-purpose AI tools for internal work such as drafting, summarizing and research, as long as no client personal or account information is entered, the firm uses a business account where prompts are not used for training, and every client-facing output is reviewed and approved by a licensed person before it goes out.
- Does AI-generated content count as advertising under the SEC Marketing Rule?
If it is sent to more than one person and offers advisory services, it is treated like any other advertisement, regardless of who or what wrote it. The rule looks at the content and the audience, not the authoring tool. AI drafts should go through the same review, substantiation and recordkeeping steps as human drafts.
- Do we need to keep records of AI prompts and outputs?
Keep records of any AI output that becomes a client communication, an advertisement, or part of an investment decision, the same way you keep the final human version. Many firms also log the prompt for client-facing work so they can show a reviewer how the output was produced. Confirm the specifics with your compliance consultant or counsel.
- Can AI help with client meeting notes?
This is one of the most common first uses. An AI note-taker records and summarizes the meeting, drafts the follow-up and creates tasks in the CRM. The firm needs client consent for recording where required, a vendor that stores data securely and does not train on it, and a human review of the summary before it is filed or sent.
- What should an RIA's AI policy say?
One page is enough to start: which tools are approved, what data may never be entered, which uses require review by a licensed person, how outputs are stored, who owns the policy, and how often it is reviewed. The policy should sit alongside the firm's existing compliance manual, not replace any part of it.
Want the policy, the first deployment and the review process built together?
The AI Clarity Sprint gives mid-market companies, law firms, wealth managers and insurance agencies an AI audit, deployment recommendations with ROI models, and a 90-day plan in three weeks.