AI policy template for RIAs

1. Purpose and scope

• This policy governs how [Firm name] ("the Firm") and everyone who works for it use generative AI tools such as ChatGPT, Microsoft Copilot, Claude and Gemini.
• It applies to all employees, investment adviser representatives and contractors, on Firm devices and personal devices used for Firm business.
• It forms part of the Firm's compliance policies and procedures under Advisers Act Rule 206(4)-7 and is reviewed with them.

2. Who is responsible

• The Chief Compliance Officer, [name], owns this policy, approves tools and grants exceptions.
• [Role, e.g. Operations lead] keeps the Approved Tools Register (section 3) current.
• Each user is responsible for what they enter into an AI tool and for any AI-assisted work they send or rely on.

3. Approved Tools Register

Only tools listed here may be used for Firm business. Approval is for a specific plan, not a brand: a business tier and a personal plan of the same product are different tools.

• For each tool, record: tool and plan (e.g. "ChatGPT Business", not "ChatGPT"); approved uses; highest data category allowed (section 4); account type users must sign in with; owner; date of last due-diligence review.
• A tool is added only after the vendor due-diligence review in section 8 and written CCO approval.
• Personal and free plans are not approved for any client information.

4. What data may go into an AI tool

Classify information before entering it.

• Never, in any tool: Social Security numbers, full account numbers, passwords or login credentials, government ID numbers, [other].
• Client personal information (names, contact details, holdings, financial circumstances): only in tools on the Register approved for client data, signed in with the Firm account, and only what the task needs. Remove anything else.
• Firm confidential information (strategy, pricing, personnel): only in tools on the Register approved for it.
• Public information: any approved tool.

5. Permitted and prohibited uses

• Permitted, subject to this policy: drafting emails and letters, summarizing meeting notes, research on public information, first drafts of educational content, internal process documentation, [other].
• Prohibited: sending AI-generated content to a client without human review; making or changing investment recommendations based solely on AI output; using AI to generate testimonials, endorsements or performance figures; entering client data into a tool not on the Register; [other].

6. Human review before anything reaches a client

• A qualified person reviews and edits all AI-assisted client communications before they are sent, and is accountable for them as if they had written them.
• AI-assisted advertisements and marketing go through the Firm's usual review under the Marketing Rule (Advisers Act Rule 206(4)-1) before use.
• Users check facts, figures and citations produced by AI against a reliable source. AI output can be wrong while sounding certain.

7. Recordkeeping

• AI-assisted communications and documents are records like any others and are kept under the Firm's books-and-records procedures (Advisers Act Rule 204-2) for [retention period].
• Where an AI tool drafts a client communication, the final version sent is retained in [system, e.g. CRM or email archive]. [Optional: note in the CRM that AI assisted.]
• Users do not rely on an AI tool's chat history as the Firm's record.

8. Vendor due diligence

• Before approval, and at least annually after, the Firm reviews each vendor for: whether it trains on Firm data and on which plans; data retention and deletion; security certifications such as SOC 2 Type II; access controls and single sign-on; where data is stored; breach notification terms; and contract terms.
• Vendors that receive client information are overseen as service providers under the Firm's Regulation S-P procedures, including how quickly they must report a breach to the Firm.
• Results are recorded with the tool's entry in the Register.

9. Mistakes and incidents

• Anyone who enters client information into a tool not approved for it reports it to the CCO within [24 hours], without deleting anything first.
• The CCO assesses it under the Firm's Regulation S-P incident response program, which requires notifying affected clients as soon as practicable and no later than 30 days after learning of certain incidents.
• The CCO also checks [your state]'s data breach notification law (and that of any state where affected clients live), which sets its own deadlines for notifying clients and, in some cases, the state.
• Reporting a mistake promptly is expected and will not on its own lead to discipline.

10. Training and attestation

• Everyone covered by this policy completes AI training [on joining and annually] and attests in writing that they have read and will follow this policy.
• The CCO keeps the attestations and training records.

11. Review and exceptions

• The CCO reviews this policy at least annually, as part of the Rule 206(4)-7 annual review, and whenever an approved vendor changes its data terms or a regulator issues relevant guidance.
• Exceptions are granted in writing by the CCO, for a stated period, and recorded.
• Adopted [date]. Last reviewed [date] by [name].