The AI build checklist for RIAs.
Last updated October 25, 2026 · 31 questions
Presented byYour company here · Sponsor this pageAI makes it possible for anyone at an advisory firm to build a tool, automate a workflow or write a week of content in an afternoon. Being able to make something isn't the same as knowing it's safe to use. These are the questions to answer before you build, buy or roll out an AI tool at your firm, especially one that touches client data.
You don't need every answer to be perfect. You need to have asked. If you can't answer one, that's the thing to fix, or the sign you should buy a tool built for regulated firms instead of building your own.
1. Client data: where does it go?
Most AI tools send what you type or upload to a model running on someone else's servers. That's fine when you know where it goes and what happens to it.
- If not, most of this section doesn't apply. If so, it's protected client information under Regulation S-P and your privacy policy.
- Look for a zero-data-retention or no-training commitment in writing, on the plan you're actually paying for. Consumer chat apps often differ from business plans.
- Often you can: initials instead of names, rounded numbers, no account numbers.
- Amended Regulation S-P requires advisers to have an incident response program, oversee service providers, and notify affected clients of a breach of sensitive information.
2. Books and records: does it create something you have to keep?
AI often produces things that count as business records without anyone noticing: meeting notes, client emails, summaries of recommendations.
- Written communications about recommendations and advice generally have to be kept under the SEC's books and records rule (Rule 204-2), however they were made.
- A meeting note that lives only in an AI notetaker's app, or a chat log on someone's laptop, isn't archived.
- Check you can export everything, in a format you can read without the tool.
- Don't build your own archive, trade blotter or client records system. Buy one built for regulated firms and connect AI to it.
3. Who checks the output before it matters?
AI is confident whether it's right or wrong. The question isn't whether it makes mistakes; it's who catches them.
- Name the person. "We'll look at it" isn't a review step.
- Summaries and calculations are where AI errors hide: a wrong year, a dropped account, a misread figure.
- Review only works if the reviewer knows the subject. An assistant checking tax math they don't understand isn't a check.
- It helps the reviewer, and it helps you answer an examiner who asks how something was produced.
4. Marketing: is it still advertising?
A blog post, social post, email or webpage an AI wrote is still your firm's advertising.
- The SEC's Marketing Rule applies to the content, not to who or what wrote it. Watch for performance claims, testimonials and anything it states as fact.
- AI fills gaps with plausible-sounding specifics: client counts, credentials, results. Check each one.
- The SEC has brought cases against advisers for overstating how they use AI ("AI washing"). Say what it really does.
5. If you built it yourself: is it secure?
AI coding tools make it easy to build an app that works. Making one that only the right people can use takes deliberate steps.
- A working app with a guessable link or no access rules can expose every record in it.
- Keys pasted into code end up in shared files, repositories and screenshots.
- One stolen password shouldn't open everything.
- You don't have to be an engineer to build it, but someone should check it who could spot what's missing.
- A tool only one person understands is a key-person risk.
6. If you're buying it: did you check the vendor?
Most firms should buy before they build. Buying still means doing your homework.
- Ask for it. A logo on their website isn't the report.
- Your vendor's AI provider is your data's provider too. Ask for the list of subprocessors.
- Plan the exit before you start.
- Exams ask how you oversee service providers, and AI vendors change fast.
7. When it's wrong, or breaks
Every tool fails eventually. Decide now what happens then.
- One named owner per tool.
- Keep the manual way written down for anything clients depend on.
- Write the steps down before you need them.
8. Your firm's AI policy
Small firms don't need a long policy, but they need one people actually follow.
- You can't oversee what you don't know about. Ask the team; the answer is usually longer than expected.
- "No client personal information in unapproved AI tools" is a good first line.
- A policy nobody's seen doesn't protect anyone.
- Put it on the calendar with your annual compliance review.
The short version
- Know where client data goes, and keep it out of anything that keeps or trains on it.
- Keep what you'd have to keep, wherever the AI made it.
- Name the person who checks every output before it reaches a client.
- Don't build your books and records. Buy those, and use AI around them.
- Write it down: the tools you use, who owns each, and what's allowed in them.
Go further
- Talk it through with advisors who build with AI every week in Advicers, including the live office hours.
- See which compliance, archiving and cybersecurity tools advisors use, and what they say about them, in AdvisorTech.
- Read what people who've used each tool would tell you before you start, on every tool's page.
This checklist is general information to help you ask good questions, not legal or compliance advice. Rules differ by registration and state, and change. Check with your chief compliance officer or compliance consultant before you rely on it. Suggestions? Email joe@advisortechbook.com.