How to Use AI to Draft Client Reviews Without Exposing Portfolio Data

Quarterly review season means a letter for every household, each built from that client's holdings, balances and goals. AI can shorten the writing, and it also puts the most detailed client data your firm holds into a prompt your compliance program has to account for. Here is how to use AI as a financial adviser for review letters while keeping portfolio data where it belongs.

Can financial advisers use AI to draft client reviews?

Yes, if the firm controls the tool and the data that goes into it. No SEC rule bans AI for client communications. Regulation S-P does require written policies and procedures with administrative, technical and physical safeguards for customer information, and a client's holdings, balances and account details are customer information. Those safeguards apply when an adviser pastes them into a prompt.

Examiners already expect this use. The SEC Division of Examinations' fiscal 2027 priorities, released October 23, 2026, say registrants are using generative tools "to support research, drafting, coding, and client communications" and that the Division is intensifying efforts to see whether firms still comply with existing, technology-neutral obligations. The same document lists Reg S-P safeguards and service provider oversight as an exam focus.

Review letters and meeting summaries are a natural fit for AI, and they are also where the most client detail sits in one place. The aim is a workflow where the AI does the writing and the firm's systems hold the numbers.

Which portfolio data creates the most risk in a prompt?

Direct identifiers combined with account details. Reg S-P defines sensitive customer information to include identifiers such as a Social Security number, and an individual's account number in combination with authenticating information. Unauthorized access to sensitive customer information is what can trigger client notice under the amended rule.

For a review letter, sort the data into three groups:

• Keep out of every AI tool: Social Security numbers, full account numbers, dates of birth, custodian logins, and anything used to verify identity.
• Keep in firm-approved tools only: client names, household details, holdings, balances, transactions and performance figures.
• Fine in a de-identified prompt: the asset allocation as percentages, a description of the strategy, the market commentary for the quarter, and the client's goals described generically.

A useful habit is to draft with placeholders. The adviser writes "[CLIENT], [YTD RETURN], [ALLOCATION TABLE]" and lets the AI shape the narrative around them, then the figures come from the reporting system. Our article on DLP rules for account numbers and SSNs in AI prompts covers how to enforce the first group with technology.

Which AI tool should the review be drafted in?

One the firm has approved, contracted and connected to its identity provider. A vendor that receives or processes customer information through services to the firm is a service provider under Reg S-P, and the firm's incident response program must include written policies for overseeing it, including notice to the firm within 72 hours of a breach. A personal ChatGPT or Claude account gives the firm none of that.

For firms on Microsoft 365, Copilot is often the practical choice because client files already live there. Microsoft states that under enterprise data protection prompts and responses are not used to train foundation models, and that specific controls vary by plan. Vendor terms change, so record the date you reviewed them. If the firm uses ChatGPT or Claude business plans instead, the same oversight applies; our guide to ChatGPT for financial advisers compares the plans.

Copilot also reads whatever the adviser can open. Before advisers ask it to summarize a household's files, check that file permissions and sensitivity labels keep one client's documents away from another's review.

How can a financial adviser use AI to draft a client review, step by step?

Use AI for the language and keep every number in the system of record. A workflow most RIAs can adopt:

1. Run the quarterly performance report from the portfolio management or reporting system. That report is the source of truth for every figure.
2. Open the firm's approved AI tool, signed in with firm credentials, and start from a saved prompt template the compliance team has reviewed.
3. Give the AI the strategy, the market context and the client's goals in general terms, with placeholders for names and figures.
4. Ask for structure and tone: a plain-language summary, what changed in the portfolio, and the topics for the next meeting.
5. Do not ask the AI to calculate returns, fees or projections. Pull those from the report.
6. Fill in the placeholders, then check every number and claim against the source report before the letter leaves the firm.
7. Route the letter through the firm's normal review process and send it from the firm's email or client portal, where it is archived.

The verification step matters because AI tools can produce confident, wrong figures. A review letter that misstates performance is the adviser's error, regardless of who typed it.

Does a review letter fall under the Marketing Rule or FINRA Rule 2210?

Usually not the Marketing Rule, though the antifraud provisions still apply. The Marketing Rule defines an advertisement as a communication to more than one person, or to one or more persons if it includes hypothetical performance. A review written for one client generally falls outside the first part of that definition. Two AI habits can change that: a template letter sent to many clients, and AI-generated projections or "what if" returns, which can be hypothetical performance. Firms should decide with counsel where their templates land.

For broker-dealers and dual-registered firms, FINRA's advertising FAQ D.8 says firms are responsible for their communications whether a human or AI generated them, including supervision, recordkeeping and the content standards in Rule 2210. FAQ B.4 points to Rule 3110(b)(4), which requires written procedures for reviewing outgoing correspondence. Our article on Rule 2210 and AI-generated communications goes further.

Which records should the firm keep?

The letter itself, at minimum. Rule 204-2(a)(7) requires advisers to keep written communications sent relating to recommendations or advice, and Rule 204-2(e)(1) sets a five-year retention period. Whether AI prompts and drafts must also be kept is a question to settle with counsel and write into the policy.

If the firm decides to keep them, Microsoft's retention for Copilot and AI apps documentation describes retention policies for Copilot prompts and responses, with separate settings for other enterprise AI apps. Our article on off-channel communications and AI notetakers covers the archive side.

What should a CCO do this quarter?

Set the workflow once, then make it the only way review letters get drafted.

• Name one approved AI tool for client communications and block personal AI accounts on firm devices.
• Write a short client-review prompt template with placeholders, and have compliance approve it.
• Add a rule to the written policies: AI does not calculate returns, fees or projections in client letters.
• Turn on DLP for Social Security numbers and account numbers in AI prompts and uploads.
• Review file permissions and labels before turning on Copilot for advisers.
• Add the AI vendor to the Reg S-P service provider inventory with its contract and breach notice terms.
• Keep a sample of reviewed letters and the policy in your exam file. Our guide to showing an examiner how you supervise AI use lists what to include.

How does s90 help?

s90 sets up AI guardrails and DLP for RIAs, broker-dealers and dual-registered firms: an approved AI tool tied to your identity provider, blocks on personal accounts, data loss rules for client identifiers, permission and label cleanup before Copilot, and the evidence an examiner asks for. Our agreements include 72-hour breach notification and 24-hour evidence production. If you want a quick look at how your advisers draft reviews today, we can start there.