How to Supervise AI Use by Remote and Independent Advisers

Why is AI harder to supervise when advisers work remotely?

AI supervision is harder for remote advisers because the adviser, the device and the AI tool can all sit outside the systems your supervisors already watch. In a home office or an independent branch, an adviser can open a free AI account in a browser tab, paste in a client's holdings, and send the result as an email. Nothing in that chain has to touch the firm's archive or a principal's review queue.

Firms built their remote supervision around email, trading and complaints. AI adds a new channel that produces drafts of client communications, meeting summaries and research, often from tools the firm never approved. For a CCO, the exposure is familiar: a supervisory gap an examiner can find, client information leaving firm control, and records the firm cannot produce on request.

Independent advisers raise the stakes. Independent contractors often buy their own software, run their own small offices and sometimes employ their own assistants. Each of those choices can bring an AI tool into the business that the home office does not know about.

What do FINRA and SEC rules require for remote AI use?

Neither regulator has an AI-specific supervision rule, and both say existing obligations apply. FINRA Regulatory Notice 24-09, published June 27, 2024, says its rules are intended to be technology neutral and "apply when member firms use AI, including Gen AI or similar technologies, in the course of their business."

For broker-dealers, FINRA Rule 3110 requires a supervisory system "reasonably designed to achieve compliance" and written procedures to supervise the types of business each associated person does. Correspondence review must be done by a registered principal and evidenced in writing. Those duties do not change because a representative works from home or a two-person branch. Communications sent or received relating to the business must also be preserved under Exchange Act Rule 17a-4(b)(4), whichever tool drafted them.

For investment advisers, Advisers Act Rule 206(4)-7 requires written policies and procedures reasonably designed to prevent violations, reviewed at least annually. Rule 204-2(a)(7) requires advisers to keep written communications relating to advice and recommendations. Under Advisers Act Section 203(e)(6), a defense to a failure-to-supervise charge depends on established procedures and a system for applying them.

Both channels also fall under Regulation S-P, which requires written policies and procedures to safeguard customer information. Client data pasted into an unapproved AI tool is a safeguards question, wherever the adviser happens to be sitting.

Exam attention is already pointed here. The SEC Division of Examinations' fiscal year 2027 priorities, released October 23, 2026, say registrants are using "generative SI tools to support research, drafting, coding, and client communications" and list advisers "operating from multiple geographically dispersed branch offices" as a compliance program focus. (The document uses super intelligence, or SI, where most firms would say AI.)

Which controls make AI supervision work for remote advisers?

The controls that work move AI use onto firm systems where it can be logged, sampled and retained. Policy alone does not reach a home office, so AI governance has to show up as technical controls. A practical set looks like this:

• An approved tool list. Name the AI tools advisers may use, the business accounts they must sign in with, and the client data each tool may receive.
• Firm identity for every approved tool. Require sign-in with firm credentials and multi-factor authentication so access can be removed when an adviser leaves.
• Blocks on personal AI accounts. On firm-managed devices and browsers, restrict sign-in to the firm's AI workspace so a personal account cannot be used for client work. Our guide to blocking personal AI accounts on firm devices covers the settings.
• Data loss prevention on prompts and uploads. Detect or block account numbers, Social Security numbers and client files headed to unapproved AI sites.
• Prompt and output logging. FINRA's 2026 Annual Regulatory Oversight Report lists "storing prompt and output logs for accountability and troubleshooting" and tracking "which model version was used and when" among effective practices.
• Capture of AI-drafted communications. Make sure anything an AI tool drafts reaches clients through firm email or messaging that is archived and reviewed. The same off-channel communications risk applies to AI note-takers and chat tools.
• A managed device standard. Remote and independent advisers should do firm business on devices the firm can configure, monitor and wipe.

If an adviser can reach client data from a device the firm does not manage, none of the controls above can be shown to apply on that device. That is usually the first gap to close.

How should branch inspections and risk assessments cover AI?

Add AI to what inspectors ask and test at every location, and to the risk factors that decide how closely a location is supervised. Rule 3110(c) requires annual inspection of every OSJ and supervising branch, inspection of non-supervising branches at least every three years, and inspection of non-branch locations on a regular periodic schedule.

Firms using the Remote Inspections Pilot under Rule 3110.18, which runs from July 1, 2024 through June 30, 2027, must document a risk assessment for each location and describe in their procedures "the methodology, including technology," used for remote inspections. For a residential supervisory location under Rule 3110.19, the associated person's electronic communications must go through the firm's electronic system, and the firm's surveillance and technology tools must be appropriate for the risks each location presents.

In practice, an inspection can now include a few concrete AI checks:

• Which AI tools are installed or used on devices at this location, and are they on the approved list?
• Do sign-in logs show the adviser using the firm's AI workspace, or no AI use at all where some is likely?
• Have any DLP alerts fired for this location, and how were they resolved?
• Do the location's assistants or unregistered staff use AI tools, and who supervises that use?

A location where an adviser has repeated DLP alerts or uses unapproved tools is a reasonable candidate for a closer look, including an on-site visit instead of a remote one.

If you inspect remotely, the pilot also expects your technology to produce specific evidence. Our article on the FINRA remote inspection pilot lists what that evidence looks like.

What about independent advisers who bring their own tools?

Treat a tool an independent adviser buys as a vendor the firm has to approve before client data goes in. FINRA Regulatory Notice 21-29 reminds member firms that they remain responsible for supervising activities they outsource to vendors. The same reasoning applies when an adviser adds an AI note-taker or drafting assistant to a branch's workflow.

Independent contractor models make that harder, because the adviser may pay for the software and expect to choose it. One workable approach is a short intake process: the adviser requests the tool, the home office reviews its data handling and retention terms, and an approved tool gets connected to firm identity and logging. A tool that cannot meet those terms stays off the list.

Put the expectation in writing before an issue arises. The independent adviser's agreement and the firm's procedures should say that AI tools used for firm business must be approved, that AI-assisted communications are firm records, and that the firm may review AI activity on systems used for firm business.

What should a CCO do this quarter?

Start with visibility, then close the largest gap. A realistic sequence for the next 90 days:

• Inventory. Pull sign-in and web traffic data to see which AI tools remote and independent advisers already use.
• Decide. Publish a short approved list with the data each tool may receive.
• Enforce. Block personal AI accounts and unapproved AI sites on managed devices, and turn on DLP for client identifiers.
• Log. Confirm approved tools keep prompts and outputs in a form principals can sample. See what to log for GenAI under Rule 3110.
• Inspect. Add the AI questions above to the branch inspection checklist and to each location's risk assessment.
• Train. Cover AI use at the next annual compliance meeting under Rule 3110(a)(7), which FINRA allows to be held remotely.

Each step should leave a dated record. When an examiner asks how the firm supervises AI use outside the main office, those records are the answer.

How does s90 help?

s90 is a compliance-focused managed IT provider for financial services firms in Los Angeles and Orange County. We set up the identity, device management, AI access controls, DLP and prompt monitoring that let a CCO supervise AI use at every location, and we produce the evidence reports examiners ask for. Our agreements include a 72-hour breach notification commitment and 24-hour evidence production. If you want a second look at how your remote advisers use AI, we are happy to talk it through.