AI Adoption Is Accelerating. For SEC-Registered Investment Advisers, Compliance Must Keep Pace
Artificial intelligence is quickly moving from experimentation to everyday use across the investment management industry. Registered investment advisers (RIAs) are using AI to support investment research, portfolio construction, trading, compliance monitoring, data analysis, and client communications. As the technology matures, firms are also beginning to explore agentic AI systems that can execute increasingly complex workflows with less direct human involvement.
For U.S. Securities and Exchange Commission (SEC)-registered investment advisers, adopting AI does not change their regulatory obligations, but it does require firms to consider how existing requirements around fiduciary duty, conflicts of interest, privacy, disclosures, books and records, marketing, and policies and procedures apply to AI-enabled activities. The question is not simply, “Can we use AI?” but “How do we use it while continuing to meet our regulatory obligations?”
Integrate AI Into Your Compliance Program
An adviser’s fiduciary obligations do not change when AI contributes to an investment decision. Firms remain responsible for acting in investors’ best interests and should apply greater oversight as AI moves closer to investment recommendations, portfolio construction, rebalancing, or execution.
A good starting point is understanding where AI is already being used. Employees may be using AI for research, meeting summaries, emails, marketing content, coding, or document review, sometimes without formal approval or compliance oversight. Firms should inventory these use cases and assess their risk. An AI tool used to summarize an internal document may require different controls than one used to analyze client portfolios or recommend securities.
For higher-risk applications, firms should understand:
What the tool is designed to do and how it is being used
What data it can access
Its material limitations
How its output affects investment or business decisions
Where human review and approval are required
Policies and procedures should clearly outline which tools are permitted, what information employees may enter, who approves new applications, and how AI use will be monitored. Just as RIAs document how day-to-day activities are performed and supervised, they should clearly document how AI is used within those activities, including the processes, controls and oversight that apply.
Protect Client and Firm Information
One of the most immediate AI risks involves sensitive data. Before approving an AI tool, firms should understand how it handles confidential client information, material nonpublic information (MNPI), proprietary research, and other sensitive data, including where that information is stored, who can access it, how long it is retained, and whether it can be used to train models.
These issues also overlap with advisers’ broader privacy and cybersecurity responsibilities. The SEC’s amended Regulation S-P requirements reinforce the importance of understanding where customer information resides and how third-party providers protect it. AI applications that access client information should therefore be incorporated into the firm’s information security, incident response, and vendor oversight processes.
Review Recordkeeping and Vendor Oversight
As AI becomes more integrated into the investment and operational processes of hedge funds, private equity firms, and other private fund managers, advisers should consider how existing books and records requirements apply. If investment professionals use AI to conduct research, evaluate investments, support investment committee materials, analyze portfolio companies, or prepare investor communications, firms should assess whether prompts, outputs, and related materials are subject to their recordkeeping obligations. Policies should define which AI-generated records must be retained, how they will be captured, and where they will be stored.
Vendor oversight is particularly important given the sensitive information private fund managers routinely handle. AI providers should be incorporated into the firm’s existing vendor due diligence and third-party risk management processes, with particular attention to security controls, data handling and retention practices, model limitations, incident response capabilities, and protections for confidential information and material nonpublic information (MNPI). Firms should also understand whether information entered into an AI platform may be retained or used to train models and what happens to that data when the relationship ends.
Oversight should continue after a tool is approved. AI platforms can change rapidly through model updates, new integrations, or expanded functionality. Firms should periodically reassess approved providers and use cases to determine whether changes in how a tool accesses, processes, or retains information create new compliance risks or require updates to policies, controls, or vendor agreements.
Make Sure AI Claims and Disclosures Match Reality
The SEC has already taken enforcement action against investment advisers for false or misleading statements about their use of AI. For RIAs, the takeaway is straightforward. If your firm makes claims about its AI capabilities, it should be able to substantiate them.
Marketing teams should be particularly careful about describing automation or traditional analytics as proprietary or sophisticated AI. Claims about AI-driven investment capabilities, performance benefits, or technology should go through the same compliance review as other material statements under the SEC Marketing Rule.
The same applies when AI creates the content itself. Generative AI can produce polished copy quickly, but it can also generate incorrect facts, statistics, citations, or claims. AI-generated marketing materials should therefore remain subject to normal compliance review before publication.
Firms should also consider whether AI has become material enough to their investment process to require changes to Form ADV or other disclosures. If AI plays a significant role in investment analysis or portfolio management, disclosures should accurately describe that role and any associated material risks.
Train Employees and Test Your Controls
Written policies are only effective if employees understand how to apply them. AI training should address practical situations employees are likely to encounter, such as entering confidential information into an unapproved chatbot, relying on AI-generated research without verifying it, or using generated content in client or marketing communications.
Because AI tools and employee practices evolve quickly, firms should revisit training and controls periodically rather than rely solely on an annual policy acknowledgment. Compliance testing can also help determine whether actual AI use aligns with the firm’s policies.
Where RIAs Should Focus Now
Firms do not need an entirely separate regulatory framework for AI. They do need to make sure their existing compliance program accounts for how AI is actually being used. As a starting point, RIAs should:
Inventory current AI tools and use cases
Establish approved and prohibited uses
Assess higher-risk applications and require appropriate human oversight
Set clear rules for confidential, client, and MNPI data
Review AI vendors and contractual protections
Evaluate books and records requirements
Review AI-related marketing claims and disclosures
Train employees and periodically test compliance with AI policies
The Bottom Line
AI is becoming part of the technology investment advisers use every day. Firms that understand how AI is being used, establish appropriate controls, document their decisions, and maintain adequate oversight will be better positioned to capture the benefits of the technology while managing regulatory risk.
Pillar Compliance Group can help RIAs evaluate how AI fits within their existing compliance programs, develop practical policies and controls, review disclosures and vendor oversight, and prepare for SEC examinations as regulatory expectations continue to evolve. Reach out to a member of our team for practical use cases of how firms are incorporating AI use into their compliance programs.