Reg S-P AI vendor due diligence checklist: what to check before client data goes in

A CCO approving a new AI tool now has to show an examiner how that decision fits Reg S-P. This AI vendor due diligence checklist covers what the amended rule requires before client data goes in, what to collect from the vendor, and which records to keep.

Does Reg S-P apply when client data goes into an AI tool?

Yes, when the data is customer information. Amended Regulation S-P requires written policies and procedures that protect customer information, plus an incident response program that includes oversight of service providers (17 CFR 248.30). An AI tool that receives client records sits inside the same safeguards as any other system that holds them.

Customer information is any record containing nonpublic personal information about a customer of a financial institution, whether the firm holds it or it is handled on the firm's behalf, according to the SEC's small entity compliance guide. For an RIA or broker-dealer, that covers account statements, financial plans, meeting notes with account details, and the spreadsheet a staff member pastes into a chat window to summarize. Both compliance dates have passed: December 3, 2025 for larger entities and June 3, 2026 for smaller entities. Every covered firm now operates under the amended rule.

When is an AI vendor a service provider under Reg S-P?

When it receives, maintains, processes, or otherwise is permitted access to customer information through services it provides directly to your firm. That is the service provider definition in Rule 248.30, and it does not depend on whether a product is marketed as AI. A firm-licensed AI assistant, a notetaker that records client calls, a CRM add-on that drafts follow-up emails, and a document tool that summarizes statements all fit once they touch client records.

The harder case is a tool an employee signed up for on a personal account. Whether that relationship meets the definition is a question for counsel. Either way, the firm's safeguards policy and incident response program still apply to client data that left approved systems. Our article on responding when someone pastes client data into an AI tool covers that path.

What belongs on an AI vendor due diligence checklist under Reg S-P?

The checklist follows Rule 248.30(a)(5), which requires written policies and procedures reasonably designed to require oversight of service providers, including due diligence and monitoring. The oversight must be designed so the vendor takes appropriate measures to protect against unauthorized access to or use of customer information, and notifies your firm as soon as possible, and no later than 72 hours, after becoming aware of a breach in security that results in unauthorized access to a customer information system it maintains.

For an AI vendor, due diligence usually starts with the terms for the exact plan the firm is buying. Many firms add a short AI vendor questionnaire to cover what the terms leave open. The points that matter most for Reg S-P:

• Whether prompts, uploaded files and outputs are retained, for how long, and how deletion works.
• Whether customer data is used to train or improve models, and whether that setting is controlled firm-wide or left to each user.
• Which subprocessors, including the underlying model provider, receive the data.
• Whether the vendor commits to breach notice inside the 72-hour window.
• Whether disposal at the end of the relationship fits the firm's own obligations under Rule 248.30(b), which now covers customer information as well as consumer information.

The rule does not require a written contract with each service provider. It does let a firm agree in writing for a vendor to notify affected individuals on the firm's behalf, while the firm keeps responsibility for making sure notice is given. Without written terms, most firms have little evidence that an AI vendor agreed to any of the points above. Our guide to vetting AI vendor retention and training terms walks through the documents to collect.

Do AI features inside software you already use need a new review?

Often, yes. When an existing vendor adds an AI feature, client data may start flowing to a new subprocessor under new terms. The oversight requirement covers monitoring as well as onboarding, so a material change in how a current provider processes customer information is a reasonable trigger for a fresh look.

At advisory firms, the usual places this happens are CRM platforms, email and productivity suites, financial planning software, and portfolio reporting tools that add drafting or summarization features. A short change log, reviewed whenever a vendor announces an AI release, keeps the vendor inventory current between annual reviews.

What records should show the decision?

The records your recordkeeping rule already names. SEC-registered advisers must keep records of their Reg S-P policies and procedures and their service provider contracts under Rule 204-2(a)(25), generally for five years, the first two in an appropriate office of the adviser. Broker-dealers keep written policies until three years after their use ends and service provider contracts until three years after termination under Rule 17a-4(e)(14).

For each AI vendor, a file an examiner can follow typically holds the dated terms and data processing addendum, the due diligence notes, the approval and who gave it, the categories of client data the tool may receive, and the dates of later monitoring reviews. Dual-registered firms should confirm the file satisfies both rules.

What are SEC examiners focused on in FY2027?

Safeguards, customer notification procedures, and oversight of service providers. The Division of Examinations' FY2027 examination priorities, announced October 23, 2026, list those items under the Reg S-P review. A separate cybersecurity section says examiners will assess risks associated with registrants' increased use of third-party service providers. The same document notes that registrants are using generative tools to support research, drafting, coding and client communications, and says the Division will look at whether firms continue to meet existing, technology-neutral obligations.

Put together, an examiner asking about Reg S-P is likely to ask which vendors hold customer information. AI vendors belong on that list and in the firm's wider third-party risk management program.

What should your firm do this quarter?

Five steps bring AI vendors inside the Reg S-P program the firm already has:

• Inventory every AI tool with access to client data, including features inside existing software and notetakers on client calls.
• Classify each tool as approved, under review, or blocked, and record which client data each approved tool may receive.
• Collect current terms for each approved tool and confirm retention, model training, subprocessors and 72-hour breach notice.
• Add AI releases from existing vendors to the monitoring calendar, with a named reviewer.
• Run one tabletop exercise in which an AI vendor reports a breach of a system holding client records, and confirm the firm would track the customer notice deadline of no later than 30 days in Rule 248.30(a)(4).

If a vendor review turns up client data already sitting with an unapproved tool, our guide on requesting deletion from an AI vendor covers the next step.

How does s90 help?

s90 manages IT for RIAs, broker-dealers and other financial firms in Los Angeles and Orange County, with Reg S-P compliance built into the service. We help firms find the AI tools already in use, block the ones that are not approved, and keep the vendor evidence an examiner asks for. Our own agreements commit to breach notification within 72 hours and evidence production within 24 hours. If you want a second look at your AI vendor list, talk to our team.