The RIA's AI Compliance Obligations

The short version

An adviser using AI in 2026 carries four distinct obligations: keep the records the AI produces, supervise the model as you would supervise a person, describe the capability accurately in disclosure and marketing, and diligence the vendors whose models you rely on. None of these are new rules. They are existing rules whose application to AI has now been stated explicitly by both the SEC and FINRA.

What has changed is examiner attention. AI is the single most dominant compliance topic recorded in the twenty-one year history of the Investment Management Compliance Testing Survey, named by 85% of the 411 adviser compliance professionals surveyed in April and May 2026 — up 28 points year over year, with cybersecurity a distant second at 37%, per InvestmentNews' reporting on the IAA and ACA Group survey.

1 · Books and records

AI-generated transcripts and summaries can be records under Advisers Act Rule 204-2, whether or not a firm meant to create one. The rule defines a record by what it is and what it is used for, not by the tool that produced it.

Cooley's analysis for registered advisers is the clearest treatment available, and its conclusion is that the definition captures AI-generated transcripts whether firms realise it or not — and that "the analysis is more complex than most firms have recognized." A summary that informs a recommendation is doing the work of a record. Retention, indexing and production obligations follow from that, not from a decision to designate it.

The practical consequence is that a firm cannot reason about retention tool by tool. It has to reason about output by output: what was produced, what it was used for, and whether it can be produced on request in the form it existed at the time.

2 · Supervision of the model itself

Supervision obligations attach to the AI system, not only to the people operating it. The FINRA 2026 Annual Regulatory Oversight Report states that Rule 3110 supervision applies to the AI model, and that AI-generated client communications are books and records subject to the SEC Rules 17a-3 and 17a-4 baseline.

The report describes an expectation of "ongoing monitoring of prompts, responses, and outputs" and of "storing prompt and output logs for accountability and troubleshooting; tracking which model version was used and when."

That last clause is the one most firms are not positioned for. Model version tracking is a capability question before it is a policy question: if a vendor silently upgrades a model, and the firm cannot say which version produced a given output on a given date, the log is incomplete in a way no policy language repairs.

3 · Disclosure and the AI washing priority

The SEC's 2026 examination priorities name AI washing explicitly, and examiners will test the policies and procedures a firm has for supervising AI. Per Goodwin's summary of the 2026 priorities, firms are required to ensure that marketing, Form ADV disclosures and client communications accurately describe AI's "extent, nature, and limitations."

Two points follow that compliance officers tend to separate but examiners do not. First, the marketing site is in scope — capability claims made to prospects are the same claims examined. Second, AI oversight has become a component of effectively all examinations rather than a specialist module, so the absence of an AI-specific exam does not mean the topic is not being tested.

4 · Third-party vendor diligence

A firm is expected to test whether its vendors can actually meet the recordkeeping obligations the firm carries. The FINRA 2026 report describes simulated regulatory examinations as a means of testing third-party vendors' ability to meet Rules 17a-3 and 17a-4 obligations.

This is a different exercise from a security questionnaire. A vendor can hold SOC 2 Type II and still be unable to produce, on request, every output it generated for a named client between two dates, in the form it existed at the time, with the model version attached. Those are the questions a simulated examination asks.

Where firms are actually exposed

The survey data describes a market that has adopted the tools and not the controls. Against 80% adoption:

Source: 2026 Investment Management Compliance Testing Survey, Investment Adviser Association and ACA Group, 411 adviser compliance professionals, April–May 2026, as reported by InvestmentNews and NAPA.

The third-party line is the one worth sitting with. Most firms did not decide to adopt four AI systems. They adopted a CRM, a planning tool, a custodian portal and a meeting platform, and those vendors added AI. The governance question is not which AI tool should we buy but what is our evidence for the AI already running inside the tools we bought years ago.

A note on what this page does not say

FINRA's 2026 report addresses generative AI broadly. It does not single out meeting-notetaking software, and published commentary that attributes notetaker-specific guidance to FINRA is drawing an inference rather than quoting the regulator. We have kept that line visible here deliberately: in a year when the SEC is examining for overclaiming, content that overstates what a regulator said is the same category of error as a product that overstates what it does.