How to Respond When Someone Pastes Client Data Into an AI Tool

AI data leakage at a financial firm rarely starts with an attacker. It starts with a busy employee and a public chatbot. When client nonpublic personal information goes into an AI tool the firm does not control, amended Regulation S-P expects the firm's incident response program to handle it like any other incident.

What does AI data leakage look like at an RIA?

A client service associate at an RIA has a long account statement to summarize before a review meeting. She opens a personal ChatGPT account on her laptop, pastes in the statement with the client's name, account number and holdings, and asks for a summary. An hour later she mentions it to her supervisor, who calls the CCO. The scenario is hypothetical, and it plays out the same way with any public AI tool.

The steps below follow the incident response program that amended Regulation S-P now requires of every covered adviser and broker-dealer: assess, contain, decide on notice, and document. Both compliance dates have passed (December 3, 2025 for larger entities and June 3, 2026 for smaller ones), so this is the program an examiner will expect to see working. If you have not reviewed that program yet, start with the first annual review of your Reg S-P incident response program.

What should happen in the first hour?

Stop further use, capture what happened, and open an incident record. Speed matters because Regulation S-P's 30-day notice clock runs from when the firm becomes aware of the incident.

• Ask the employee to stop using the tool for client work and not to delete anything yet.
• Capture the conversation: a screenshot or export showing exactly what was pasted, the date and time, and the account used.
• Record whether it was a personal account or a firm-managed business account, and whether the chat was shared by link.
• Open an incident record with a timeline, starting from when the employee pasted the data and when the firm learned of it.
• Tell the employee clearly that reporting quickly was the right call. Staff who fear blame report late, or not at all.

Is this a Regulation S-P incident?

Treat it as one until your assessment says otherwise. The rule requires the incident response program to assess "any incident involving unauthorized access to or use of customer information," and customer information includes any record containing nonpublic personal information about a customer, in any form, that the firm holds or that is handled on its behalf.

Whether an employee's disclosure to an unapproved AI vendor counts as unauthorized use is a judgment the firm makes with its counsel, based on its own policies and the facts. The incident response program exists so that judgment is made deliberately and written down. Skipping the assessment because the person involved was an employee is the decision most likely to look weak in an exam.

How do you assess the scope?

Under 17 CFR 248.30(a)(3)(i), the program must assess the nature and scope of the incident and identify the systems and types of customer information involved. For an AI paste, that means answering a short list of questions:

• Which data elements were pasted: names, account numbers, Social Security numbers, balances, addresses, dates of birth?
• How many clients are affected, and can you identify each one?
• Which tool and which plan: a consumer account, or a business plan under a firm contract?
• What were the account's settings at the time, including any option that allows conversations to be used for model training?
• Was the conversation shared, or connected to plug-ins or other apps?
• Has the same person, or anyone else, done this before? Browser, DLP or AI monitoring logs can answer that.

The answers drive the notice decision. Sensitive customer information is any component of customer information whose compromise could create a reasonably likely risk of substantial harm or inconvenience, and the rule's examples include Social Security numbers and account numbers combined with information that allows access to the account.

How do you contain it?

Rule 248.30(a)(3)(ii) requires appropriate steps to contain and control the incident. Once the evidence is captured:

• Delete the conversation and revoke any shared links.
• Turn off any setting that allows the account's conversations to be used for training.
• If the account was firm-managed, have an administrator confirm the deletion and export the audit record.
• Send the vendor a written deletion request through its privacy process, and keep the confirmation.
• Close the path that allowed it, for example by blocking personal AI accounts on firm devices and adding DLP rules for account numbers and Social Security numbers.

Deletion does not mean the data is gone at once. OpenAI's help center says a deleted chat is scheduled for permanent deletion from its systems within 30 days, unless it was already de-identified or OpenAI must keep it longer for security or legal reasons. Record that in the incident file so the assessment reflects how long the data may persist.

Do clients have to be notified?

Possibly. Rule 248.30(a)(4) requires notice to each affected individual as soon as practicable, and no later than 30 days after the firm becomes aware of the incident, unless the firm determines after a reasonable investigation that the sensitive customer information has not been, and is not reasonably likely to be, used in a way that would result in substantial harm or inconvenience.

The SEC described the amended rule as reflecting a presumption of notification in its 2024 adopting release, and said an inconclusive investigation does not excuse notice. If the firm cannot tell which clients' sensitive information was involved, the rule requires notice to everyone whose sensitive information was in the affected system, except those it reasonably determines were not affected. Whichever way the decision goes, write down the facts, the reasoning and who approved it. Our guide to documenting a no-notice decision covers what that record should hold.

Is the AI vendor a service provider?

It depends on the relationship. If the firm contracted for a business AI plan, the vendor likely receives customer information through its service to the firm, and Rule 248.30(a)(5) requires written policies for oversight of service providers, including notice to the firm within 72 hours of a breach affecting a customer information system they maintain. Check whether your vendor contracts are updated for the 72-hour notice.

A personal consumer account has no contract with the firm at all. That gap is a large part of why the incident matters: the firm has no contractual safeguards, no admin console and no audit log to rely on.

What records should you keep?

Rule 204-2(a)(25) requires SEC-registered advisers to keep records of their Regulation S-P policies, documentation of any detected unauthorized access to customer information and the response, and any determination not to notify, generally for five years. Broker-dealers have a parallel requirement under Rule 17a-4(e)(14). For the full list, see Reg S-P recordkeeping under Rule 204-2.

For this incident, the file should hold the timeline, the captured conversation, the scope assessment, the containment steps, the vendor's deletion confirmation, the notice decision with its reasoning and approver, and the corrective actions.

What should your firm do this quarter?

• Add an "AI paste" scenario to your written incident response program.
• Run it as a tabletop with compliance, operations and your IT provider, and time how long each step takes.
• Move staff onto firm-managed AI accounts and block personal ones on firm devices.
• Add DLP rules that warn or block when account numbers or Social Security numbers are pasted into AI sites.
• Pre-write the vendor deletion request so nobody has to draft it under pressure.
• Remind staff how to report a mistake, and that early reporting is expected.

How does s90 help?

s90 sets up prompt monitoring and DLP rules that flag client identifiers before they reach an AI tool, and supports the incident response steps when one gets through, from evidence capture to the record an examiner will ask for. Our agreements include 72-hour breach notification and 24-hour evidence production commitments. If you would like to test your program against this scenario, we can run the tabletop with your team.