Can an RIA use AI to email clients?

Yes, when the firm supervises it. The common design is that AI drafts, a named person approves, and the draft, approval and send are all recorded. Confirm the specifics with your compliance officer.

Do AI meeting notes have to be kept?

It depends on their content, but treating them as records under Rule 204-2 is the safer assumption. Store them in your CRM or archive with your other client records.

Does amended Regulation S-P apply to small RIAs?

Yes. Smaller advisers had until June 3, 2026 to comply, so the incident response, notification and service provider oversight requirements now apply to all registered advisers.

Is this legal advice?

No. It is a summary written by an automation engineer. Your compliance officer and counsel decide how each rule applies to your firm.

Blog

AI and automation compliance for RIAs: the four rules to design around

How Regulation S-P, the Books and Records Rule, the Marketing Rule and SEC scrutiny of AI claims shape what an advisory firm can automate, with a checklist.

By Daniel Lubin. Published November 9, 2026. 6 minute read.

The short version

Amended Regulation S-P now applies to every registered adviser and requires oversight of any vendor that can see client information.
Treat AI drafts and summaries as records, and write them back to your CRM or archive.
Automated review and referral requests need the Marketing Rule disclosures and a compliance sign-off.
Describe your AI use accurately. The SEC has already fined two advisers for overstating theirs.

A registered investment adviser can use AI and automation for client communication and operations, provided the firm supervises it, keeps the records it produces and oversees the vendors involved. Four areas of SEC regulation do most of the shaping: Regulation S-P, the Books and Records Rule, the Marketing Rule, and the SEC's attention to how firms describe and supervise AI.

I am an automation engineer, not a lawyer. Read this as a builder's summary to take to your compliance officer.

Regulation S-P: who can see client information?

The SEC adopted amendments to Regulation S-P in May 2024. Larger advisers had to comply by December 3, 2025 and smaller advisers by June 3, 2026, so the requirements now apply to every registered adviser. The amended rule asks for three things that bear on automation:

A written incident response program for unauthorized access to customer information.
Notice to affected individuals as soon as practicable, and no later than 30 days after the firm becomes aware of a breach involving their sensitive information.
Oversight of service providers, including making sure a provider tells the firm about a breach within 72 hours.

For automation, that makes every tool and contractor that can see client information a service provider you have to account for. Keep a list of each one and what it can see, put the 72-hour notice in your contracts, and prefer designs where client data stays in accounts the firm owns. I wrote out 20 questions to ask a vendor for exactly this.

Books and Records Rule: is the output a record?

Rule 204-2 requires advisers to keep specified records, including many written communications about advice, generally for five years, with the first two in an office of the adviser. Whether an AI meeting summary or a drafted email is a required record depends on what it contains. A JD Supra analysis of AI notetakers argues for treating their output as records, and that is the safer assumption to design around.

In practice, every draft, approval and send should be written back to your CRM or archive. The automation tool itself should hold nothing that exists nowhere else, because a run log that expires after 30 days is a poor place to find a record in year four.

Marketing Rule: can you automate review and referral requests?

Yes, with conditions. Rule 206(4)-1 has applied since November 4, 2022 and permits testimonials and endorsements. An adviser has to disclose clearly and prominently whether the person is a client and whether they were compensated, along with any material conflicts. The adviser must oversee compliance, and a written agreement is required when compensation passes $1,000 over 12 months.

An automated request for a review is still an advertisement activity. Build the disclosures into the message, route each campaign through your compliance officer for sign-off, and keep copies of what was sent and what came back.

AI claims and supervision: what is the SEC looking at?

On March 18, 2024 the SEC announced settled charges against two advisers, Delphia (USA) and Global Predictions, for false and misleading statements about their use of AI. The penalties totaled $400,000. In both cases the firm had described AI capabilities it did not have.

For a small firm the practical steps are modest. Describe your AI use accurately on your website and in your Form ADV, keep a one-page description of what the system does and does not do, and have a named person approve every message a client will read.

What should every automation have in place?

A named person approves every client-facing message.
Client data stays in accounts the firm owns.
Every draft, approval and send is written back to the CRM or archive.
Each vendor and AI provider is listed, with the data it can see.
Vendor contracts require breach notice within 72 hours.
AI providers are used through API access, with training on your data turned off.
Nothing automated can log in to a custodian, trade or move money.
A one-page description of the system is on file with your compliance officer.

These eight are how Advisor Ready builds by default. The detail is on the security page.