AI compliance for investment advisers

There is no SEC rule written specifically for advisers' use of artificial intelligence. The rules that already apply govern it: what an adviser says about AI must be true and substantiated, records an AI tool produces or handles are still records, vendors that touch client data still need oversight, and the compliance program has to cover how the firm uses the tools. The SEC has brought enforcement cases on the first point and names AI in its examination priorities.

The one AI-specific proposal for advisers is gone. In 2023 the Commission proposed rules on conflicts of interest from the use of predictive data analytics by broker-dealers and advisers (published at 88 FR 53960, 9 August 2023). On 12 June 2025 it withdrew that proposal, along with the 2022 proposal on outsourcing by investment advisers, in Release 33-11377 (IA-6885), effective 17 June 2025. The release says that if the Commission pursues either area again, it will issue a new proposal.

The enforcement cases: AI washing

"AI washing" is the SEC's term for claiming to use AI in ways a firm does not. The adviser cases so far are about marketing claims, not about AI going wrong.

• Delphia (USA) Inc. and Global Predictions Inc. On 18 March 2024 the SEC announced settled charges against both (Press Release 2024-36). According to the orders, Delphia said from 2019 to 2023, in its SEC filings, a press release and on its website, that it used AI and machine learning that incorporated client data in its investment process, when it did not have those capabilities. Global Predictions claimed in 2023, on its website and social media, to be the "first regulated AI financial advisor" and to provide "expert AI-driven forecasts." Both were charged under the Marketing Rule among other provisions. Delphia agreed to a civil penalty of $225,000 and Global Predictions $175,000.
• Rimar Capital. On 10 October 2024 the SEC announced settled charges against Rimar Capital USA, Rimar Capital LLC, Itai Liptz and Clifford Boro over statements that the adviser had an AI-driven platform for automated trading, together with misrepresentations about assets under management and returns (Press Release 2024-167). The parties agreed to $310,000 in total civil penalties.

All the respondents settled without admitting or denying the findings.

What the examiners say they will review

The Division of Examinations' priorities for fiscal year 2026, published 17 November 2025, say the Division will review for accuracy registrant representations about their AI capabilities, and will assess whether firms have adequate policies and procedures to monitor or supervise their use of AI, including for fraud prevention and detection, back-office operations, anti-money laundering and trading, as applicable.

For automated investment tools and algorithms, the priorities say reviews will generally consider whether representations are fair and accurate, whether operations and controls match disclosures, whether algorithms produce advice consistent with investors' profiles or stated strategies, and whether controls confirm the advice meets the firm's obligations, including to retail and older investors. The cybersecurity section adds training and controls for new risks associated with AI.

Marketing claims about AI

Statements about technology in an advertisement are statements of material fact under the Marketing Rule, Rule 206(4)-1. The general prohibitions in paragraph (a) apply directly:

• (a)(1): no untrue statement of a material fact, and no omission that makes a statement misleading
• (a)(2): no material statement of fact the adviser lacks a reasonable basis to believe it can substantiate on demand by the Commission
• (a)(3): nothing reasonably likely to create an untrue or misleading implication
• (a)(4): no discussion of benefits without fair and balanced treatment of material risks and limitations

In practice:

1. Describe what the tool actually does. "We use AI to draft meeting summaries, which an adviser reviews" can be substantiated. "Our AI picks winning stocks" invites a demand nobody can meet.
2. Avoid superlatives. "First regulated AI financial advisor" is the claim the SEC singled out against Global Predictions. "Only" and "most advanced" carry the same risk.
3. Do not repeat a vendor's claims as your own without knowing they are true. A statement in your advertisement is yours.
4. Keep the substantiation file for every AI claim: what the tool is, where it is used in the process, and who reviews its output.
5. Check the brochure too. Delphia's statements were in its SEC filings as well as its marketing. Form ADV Part 2A must describe the methods of analysis and investment strategies the firm actually uses.

The same reasoning applies in reverse. An advertisement that presents a model or tool as a benefit must, under (a)(4), give fair and balanced treatment to its material risks and limitations.

Records of AI use and AI output

Rule 204-2 does not ask what tool produced a record. It asks what the record is.

• Rule 204-2(a)(7) requires originals of written communications received and copies of those sent relating to recommendations or advice, receipts and deliveries of funds or securities, and orders, among other things. A client email drafted with AI is a written communication like any other, and an AI chat feature that answers clients' questions about their accounts is likely to produce communications the rule reaches.
• Rule 204-2(a)(11) requires a copy of each advertisement. An advertisement written with AI is kept like any other.
• Rule 204-2(a)(16) requires the records supporting performance in an advertisement, whatever generated the calculation.
• Rule 204-2(a)(17) requires the compliance policies in effect and records documenting the annual review, which should now include how the firm reviews its AI use.

Whether an internal AI meeting summary or a prompt history is a required record depends on its content, and the rule has no AI-specific answer. Firms that treat AI notetaker summaries of client meetings as communications relating to advice, and archive them, avoid having to decide case by case.

Records are generally kept for five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser (Rule 204-2(e)(1)), and advertisements for five years from their last dissemination (Rule 204-2(e)(3)). Electronic records must meet Rule 204-2(g).

Vendor diligence

Most advisers buy AI rather than build it. The withdrawal of the outsourcing proposal removed a specific rule for service providers, not the obligations that already apply:

• Regulation S-P. Since the 2024 amendments, an SEC-registered adviser must oversee, through due diligence and monitoring, each service provider with access to customer information, and the oversight must be designed to ensure the provider notifies the adviser within 72 hours of becoming aware of a breach affecting customer information systems it maintains. Larger entities had to comply from 3 December 2025 and smaller ones from 3 June 2026. Our Regulation S-P checklist covers the detail.
• Fiduciary duty. An adviser that relies on a tool for advice remains responsible for that advice. Know how the tool reaches its outputs well enough to stand behind them.
• Recordkeeping. If the vendor holds required records, the adviser still needs them to be retrievable and producible to the SEC under Rule 204-2(g).

Questions worth asking any AI vendor: what client data it receives, whether it trains models on that data, where the data is stored and for how long, who at the vendor can see it, how it will tell you about a breach and how fast, and whether you can export everything it holds on your behalf.

Policies and procedures

Rule 206(4)-7 requires written policies and procedures reasonably designed to prevent violations, reviewed at least annually. For AI, that usually means:

1. An inventory of the AI tools in use, including features inside existing software, and what each is used for.
2. Approval before use. No new tool touches client data or client communications without compliance review.
3. Rules on data. What may and may not be entered into a tool, especially public tools with no contract behind them.
4. Human review of AI output before it reaches a client or goes into an advertisement.
5. Marketing review of every AI claim, with substantiation kept.
6. Records. Which AI outputs are retained, where, and for how long.
7. Conflicts. Whether any tool steers recommendations toward products that benefit the firm, and how that is disclosed.
8. Training and testing in the annual review, with the results kept.

Common questions

Is there an SEC rule on AI for investment advisers?

No. The 2023 predictive data analytics proposal was withdrawn in June 2025. Advisers' use of AI is governed by the Advisers Act's antifraud provisions, the Marketing Rule, Rule 204-2, Regulation S-P and the compliance rule.

What is AI washing?

Claiming to use AI in ways the firm does not, or overstating what its AI does. The SEC charged Delphia and Global Predictions in March 2024 and Rimar Capital in October 2024 for it.

Can advisers use ChatGPT?

Nothing in the rules prohibits it. The questions are what client information is entered, whether the provider's terms protect it, whether the output that reaches clients is reviewed, and whether required records are kept.

Do AI meeting notes have to be archived?

If they are written communications relating to advice, Rule 204-2(a)(7) reaches them. Many firms archive them all rather than sort them.

Do state-registered advisers face the same rules?

The Marketing Rule, Regulation S-P and Rule 204-2 apply to SEC-registered advisers. State-registered advisers follow their state's equivalents, and the antifraud provisions of the Advisers Act apply to all advisers.

Where to start

The vendor oversight policy template covers diligence on AI providers, and the compliance manual template has a place for the AI use policy. Luna's marketing review checks advertisements against the Marketing Rule before they go out, including claims about technology. For the performance side of advertising, see the Marketing Rule performance guide.