How to Vet an AI Vendor's Data Retention and Model Training Terms

An adviser asks to use a new AI meeting summarizer. A portfolio manager wants an AI research assistant. Before either tool sees client information, someone at the firm has to read what the vendor does with the prompts, files and transcripts it receives: how long it keeps them, and whether it uses them to train its models. That review is the core of AI vendor due diligence for an RIA or broker-dealer. This checklist covers where those terms live, what they should say, and how to record the review so an examiner can follow it.

Why do an AI vendor's retention and training terms matter to an RIA or broker-dealer?

They matter because an AI vendor that receives client information is likely a service provider under Regulation S-P, and the firm has to oversee it. The 2024 amendments added 17 CFR 248.30(a)(5), which requires written policies and procedures for oversight of service providers, including making sure a provider notifies the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach affecting customer information it maintains.

Larger firms have been subject to the amended rule since December 3, 2025 and smaller entities since June 3, 2026, according to the SEC's small entity compliance guide. The Division of Examinations said in its fiscal year 2026 priorities that Reg S-P exams will focus on policies and procedures, internal controls and oversight of third-party vendors. Retention and training terms decide how much client data sits with a vendor, for how long, and in how many places. That is the exposure the oversight is meant to manage.

Broker-dealers have a parallel obligation. FINRA Regulatory Notice 24-09 reminds member firms that existing rules, including supervision under Rule 3110, apply when they use generative AI, including through third-party technology and features embedded in products they already license. Our article on FINRA Rule 3110 and generative AI supervision covers the supervisory side.

Which documents should AI vendor due diligence cover?

AI vendor due diligence should cover four or five documents, and the marketing page is rarely one of them. Collect these before anyone starts reading:

• The order form or enterprise agreement for the plan you are buying. Business and consumer plans of the same product often have different data terms.
• The terms of service that the order form incorporates.
• The data processing addendum, which typically covers retention, deletion, subprocessors and breach notice.
• The privacy policy and any AI-specific data use or trust page the vendor publishes.
• The current list of subprocessors, including any third-party model provider the tool relies on.

Save a dated copy of each. Vendors revise these documents, and the version in force on the day you approved the tool is the one your file should show. The FTC's technology staff warned AI companies in February 2024 that adopting more permissive data practices through a surreptitious, retroactive change to terms of service or a privacy policy may be unfair or deceptive. Your own check is a dated copy and a scheduled re-read.

What should the data retention terms say?

The retention terms should state, in writing, how long the vendor keeps each kind of data and how deletion works. Look for answers to these questions:

• How long are prompts, outputs, uploaded files, transcripts and recordings kept by default, and can an administrator shorten that period?
• Is there a separate retention period for abuse or safety monitoring, and who at the vendor can see that data?
• What happens to firm data when a user is removed or the contract ends, and how long until it is deleted from backups?
• Will the vendor confirm deletion in writing on request?
• Where is the data stored and processed, and does the answer change for the AI features?

Retention connects to a second Reg S-P duty. The amendments also expanded the disposal requirements in 17 CFR 248.30(b) so that they cover customer information as well as consumer information. Data your firm cannot get a vendor to delete is data your disposal procedures cannot reach.

What should the model training terms say?

The training terms should say that the vendor does not use your firm's prompts, files or outputs to train or improve its models, and they should say it for the plan you are buying. Read closely for these gaps:

• Training that is off by default for business plans but on for individual or free accounts that staff might sign up for on their own.
• An opt-out that each user must set, instead of a firm-wide setting an administrator controls.
• Exceptions for feedback. Some terms allow the vendor to use a conversation when a user rates a response or submits a report.
• Broad "service improvement" language that permits use of content in de-identified or aggregated form without defining either term.
• Human review of conversations by vendor staff or contractors, and the circumstances that trigger it.
• Third-party model providers. If the tool sends your data to another company's model, that provider's training and retention terms apply as well.

If a term is ambiguous, ask the vendor to answer in writing and keep the answer in the vendor file. A sales representative's verbal assurance does not belong in an examination record.

Do the terms cover breach notice and subprocessors?

They should. Because Regulation S-P requires oversight designed to ensure notice within 72 hours of a service provider becoming aware of a breach, check whether the data processing addendum commits the vendor to notify your firm within that window. The rule does not mandate a specific contract clause. A written commitment is still the clearest evidence that the vendor agreed to it. The SEC's adopting release explains how the Commission expects firms to approach service provider oversight, and our guide to Reg S-P service provider notice covers updating vendor contracts for it.

Check the subprocessor terms at the same time. You want advance notice of new subprocessors, the right to object, and a commitment that each subprocessor is bound to the same retention, training and notice terms.

How do you record the review so an examiner can follow it?

Keep one vendor file per AI tool that shows what you reviewed, what you decided and when you will look again. A useful file contains:

• The dated copies of every document listed above.
• A one-page summary of the retention, training, notice and subprocessor terms, with the reviewer's name and date.
• Screenshots of the administrator settings you turned on, such as training opt-outs or shortened retention.
• The approved plan, the approved user groups and the types of client data permitted in the tool.
• Written vendor answers to any open questions.
• A re-review date, and a trigger to re-review sooner if the vendor changes its terms.

FINRA's 2026 Annual Regulatory Oversight Report lists related effective practices for generative AI, including evaluating tools before testing and deployment, storing prompt and output logs, and tracking which model version was used and when. A vendor whose retention terms make those logs impossible to keep is worth knowing about before rollout.

What should your firm do this quarter?

• List every AI tool in use, including AI features inside software the firm already licenses.
• Pull the current terms for each and save dated copies.
• Confirm training is off at the firm level for every approved tool, and block personal accounts on firm devices.
• Ask each vendor in writing for retention periods, deletion on termination and 72-hour breach notice.
• Build a vendor file for each tool and set a re-review date.
• Add any tool that fails the review to your block list.

How does s90 help?

s90 keeps an inventory of the AI tools in use at your firm, sends new-app alerts when someone signs up for one, and sets AI guardrails so approved tools stay on firm-controlled accounts with training switched off. We also track vendor reviews in the 18-month technology plan we maintain with each client. If you are preparing for a Reg S-P exam and want a second set of eyes on your AI vendor files, we can walk through them with you.