How to Write AI Supervision Procedures for a Small RIA

Does a small RIA need written procedures for AI use?

In practice, yes, and they belong in your RIA compliance manual, even though no SEC rule mentions AI. Advisers Act Rule 206(4)-7(a) requires an SEC-registered adviser to adopt and implement written policies and procedures reasonably designed to prevent violations of the Act by the firm and its supervised persons. When staff use AI to draft client emails, summarize meetings, research securities or write marketing copy, that work touches rules your manual already has to cover: marketing, books and records, privacy and fiduciary duty. The rule is technology-neutral, so AI use belongs inside the manual you already have.

The SEC did propose an AI-specific rule for advisers in 2023, aimed at conflicts of interest in predictive data analytics. It withdrew that proposal in June 2025 and said it does not intend to finalize it. The examination program has kept going without one. The Division of Examinations' fiscal year 2027 priorities describe registrants using generative AI tools to support research, drafting, coding and client communications, and list policies and procedures for monitoring that technology among the Division's priorities. Our look at what the exam priorities signal for RIAs has more context.

Why do the procedures matter more than the AI policy?

Procedures matter more because the law measures supervision by established procedures and a system for applying them. Advisers Act Section 203(e)(6) lets the SEC sanction a firm or person that "failed reasonably to supervise" someone who commits a violation. It also says no person is deemed to have failed if "there have been established procedures, and a system for applying such procedures, which would reasonably be expected to prevent and detect, insofar as practicable, any such violation," and the supervisor reasonably carried out those duties.

A one-page AI policy that says "use approved tools only" states a rule. It does not describe how anyone would know the rule was broken. The procedures are where the firm says who checks, how often, and what they do when they find something.

Supervision also covers what the firm says about AI. In March 2024 the SEC settled charges against two advisers over false and misleading statements about their use of AI. Marketing Rule 206(4)-1(a)(1) and (a)(2) prohibit untrue statements of material fact and material statements of fact the adviser cannot substantiate. If your website or pitch deck describes AI-driven research, the procedures should require someone to confirm it is true.

What should the AI section of an RIA compliance manual cover?

The AI section of an RIA compliance manual should cover seven topics: approved tools, data rules, human review, records, monitoring, escalation and public statements. Each one maps to an obligation the firm already has.

• Approved tools. Name each tool and the account type (a business plan with data protections, never a personal account), who approved it and when. Include AI features built into software you already use, such as CRM assistants, notetakers and Microsoft 365 Copilot. Everything else is prohibited.
• Data rules. State what client information may go into each approved tool, and tie this to your written safeguards policy under Regulation S-P, 17 CFR 248.30. Account numbers and Social Security numbers are the usual hard stops.
• Human review. Say who reviews AI drafts before they reach a client. AI-drafted marketing goes through the same Marketing Rule review as anything else.
• Records. Rule 204-2(a)(7) requires advisers to keep written communications relating to advice and recommendations, whoever drafted them, and Rule 204-2(e)(1) sets a five-year retention period. The procedures should say where AI-assisted client emails and meeting summaries are stored. See our guide to Rule 204-2 recordkeeping for the detail.
• Monitoring. Describe how the CCO checks actual use: for example, a monthly review of the AI activity report and new app sign-ups, with a sample of prompts per employee.
• Escalation. Say what happens when monitoring finds client data in an unapproved tool: who is told, how fast, and when the event moves into your Reg S-P incident response program.
• Public statements. Require a periodic check that descriptions of AI in Form ADV, on the website and in marketing match current practice.

Who should own AI supervision at a small firm?

The chief compliance officer should own AI supervision, because Rule 206(4)-7(c) requires the firm to designate one supervised person responsible for administering its policies and procedures. At a ten-person RIA the CCO often also runs operations, so the procedures should split the work clearly. The CCO owns the policy, reviews the monthly results and signs off on follow-up. An internal IT lead or outside provider runs the technical controls and delivers the reports. Each adviser remains responsible for reviewing AI output before it goes to their clients.

Naming a vendor in the procedures does not move responsibility to the vendor. The CCO is still the person an examiner will ask to walk through the evidence.

How do you write a procedure an examiner can test?

Write every procedure as who does it, what they do, how often, and what record it leaves. Compare two versions of the same control:

• Hard to test: "Employees must use AI responsibly and protect client information."
• Testable: "By the tenth business day of each month, the CCO reviews the AI activity report for the prior month, samples ten prompts per employee, and records findings and follow-up in the compliance log."

Only commit to a frequency you will keep. Examiners compare written procedures to practice, and a monthly review that happened twice a year is a finding of its own. If quarterly is realistic, write quarterly.

Then build AI into the annual review. Rule 206(4)-7(b) requires a review of the adequacy and effectiveness of your policies at least annually, and Rule 204-2(a)(17)(ii) requires records documenting that review. The FY2027 priorities say examiners will typically analyze the annual review and will look at whether advisers adapted their compliance programs after changes to their business. A firm that rolled out AI tools since its last review should be able to show the manual changed with it.

Dual-registered firms have a second layer: FINRA Rule 3110 supervision applies to the broker-dealer side, and the written supervisory procedures should line up with the adviser manual. Our article on supervising generative AI under FINRA Rule 3110 covers what to log.

What should a small RIA do this quarter?

Start with what staff actually use, then write procedures around it. A practical sequence:

1. Inventory every AI tool in use, including features inside existing software and personal accounts staff have signed up for.
2. Pick the approved list and the data rules for each tool, then block the rest on firm devices.
3. Draft the AI section in who, what, how often and what record format.
4. Turn on logging and retention for approved tools so the monitoring step has data to review.
5. Compare Form ADV, website and marketing statements about AI with current practice.
6. Train staff on the new section and collect signed acknowledgments.
7. Run the first monitoring review, file the record, and add AI to the agenda for the next annual review.

How does s90 help?

s90 runs the controls that make AI procedures testable. AI guardrails keep staff on the approved tools, DLP stops account numbers and Social Security numbers from leaving in a prompt, and prompt monitoring produces the activity report your CCO reviews each month. When an examiner asks for the evidence, we produce it within 24 hours. If it would help to see what that monthly report looks like, we are glad to walk you through one.