Staff trained and attested
Baseline evidence that the policy exists in practice, not only on paper.
Financial advisory firms · AI usage policy and governance
An AI policy that lets advisors use the tools without inviting an exam finding
Advisors and staff are already using AI, whether or not the firm has decided they should. Someone pastes a client email into a free chatbot to draft a reply, an advisor tries a note-taker on a phone call, an associate summarizes a trust document. Each raises questions regulators have signaled interest in: what client data went where, whether records were kept, and how the use was supervised.
How it often works today
- Staff use personal ChatGPT or similar accounts for client emails and summaries, with no record of what client data was shared.
- Advisors trial AI note-takers on their own, sometimes without client consent or archiving, because no approved option exists.
- The compliance manual does not mention AI, or mentions it only in a broad prohibition that nobody actually follows.
- Vendor due diligence questionnaires do not ask about AI features, model training on client data or data retention.
AI usage policy and governance for advisory firms means deciding which tools are approved and for what, writing rules on client data and recordkeeping, setting up vendor due diligence, training staff and checking that the policy is followed. It is written with your CCO and fits into your existing compliance manual. A policy that bans everything tends to be ignored, so the aim is a usable set of approved paths.
The improved workflow
Inventory current use
A short anonymous survey and a review of software subscriptions show which AI tools staff already use and for what, without putting anyone on the defensive.
Decide approved uses and tools
With the CCO, define approved tools and uses, such as an enterprise assistant for internal drafting or an advisor-focused note-taker, and what is prohibited, such as client data in consumer accounts.
Write the policy and procedures
Add a plain-language AI section to the compliance manual covering client data, recordkeeping, supervision, disclosures and vendor due diligence, with examples staff will recognize.
Train and attest
Run a short training using real examples from the firm's work, then collect attestations alongside the annual code of ethics cycle.
Monitor and review
Check usage and vendor terms periodically, log new tool requests through one form, and review the policy at least annually as tools and guidance change.
How we deliver this: AI automation for small business or fractional CTO leadership, scoped in writing and run over 90 days. See pricing or the sample scope.
What we would measure
Unapproved AI tools in use
Measured through surveys and subscription reviews, it should fall as approved options appear.
Days to evaluate a new tool request
A slow process pushes staff toward workarounds, so speed keeps governance usable.
Vendors with AI due diligence on file
Shows whether the vendor register covers AI features and data terms.
Where people stay in control
- The CCO approves the policy and every tool added to the approved list; InTheory drafts and organizes but does not give legal or regulatory advice.
- Client nonpublic personal information is used only in tools with enterprise data terms, no model training on firm data and retention settings agreed by compliance.
- Any AI-generated content that reaches a client is reviewed by a person, and the firm's disclosures about AI use are decided by compliance.
Example
From quiet workarounds to approved tools
For example, a survey at a 20-person RIA shows half the staff use consumer AI tools for drafting, two advisors are trialing different note-takers, and the compliance manual is silent on AI. Over 60 days the firm approves an enterprise assistant for internal drafting and one note-taker with archiving, writes a four-page AI policy, trains everyone in an hour and adds attestations to its annual cycle. A follow-up survey checks whether unapproved use has dropped. Illustrative, not a template for your firm.
Tools typically involved
What the first 30 days look like
In the first 30 days we would survey current AI use, review your compliance manual and vendor contracts, and meet with your CCO to agree principles. Then we draft the AI policy section, propose two or three approved tools with due diligence notes, and plan a short staff training.
Common questions
Do we need an AI policy if we don't officially use AI?
Usually yes, because staff are likely using it anyway, and a policy that addresses that use is more defensible than silence. Even a firm that prohibits AI with client data should say so clearly, train staff and check it. Most firms find that approving a few safe options reduces risky workarounds more than a ban does.
What do regulators expect from advisers on AI?
Regulators have signaled interest in how advisers use AI, including disclosures, supervision, recordkeeping and client data protection, and the rules continue to evolve. We would not advise on what is required. We help your CCO turn their reading of current guidance into a policy and procedures staff can follow, and keep evidence that they are followed.
Does the Colorado AI Act apply to advisory firms?
Colorado's SB 26-189, effective January 1, 2027, addresses automated decision-making technology used in consequential decisions, and financial services fall within its general scope. Whether it applies depends on how your firm uses AI and on the law's current status and effective dates. That question belongs with counsel. Recording where AI touches client decisions makes the analysis easier.
The business case
Does it pay for itself?
Illustrative defaults for a financial advisory firm. Replace them with your numbers.
What this workflow costs today
a month in staff time, before any lost sales
Monthly fee + assumed tools +
Break-even: new clients a month (at first-year value)
Or: staff hours recovered and redeployed
Break-even additional revenue
Value of +1 point of win rate
First 90 days, service fee
Worth a closer lookTest the assumptions
Illustration only, not a forecast or guarantee. Recovered staff time becomes a cash saving only if spending actually declines or the time goes into paid work. Tool costs are an assumption; we replace every number here with yours before recommending a scope.
AI usage policy and governance in other industries
Accounting and CPA firmsArchitecture firmsLaw firmsMedical and specialty clinicsNonprofit organizationsTax preparation offices
AI usage policy and governance: full guide
Related guides
Questions to ask a fractional CTOAI consultant red flagsGetting staff to adopt new toolsMicrosoft Copilot for small business
Terms used here
Next step
Bring one expensive workflow. Leave with a clear next step.
In 30 minutes we look at one recurring workflow, what it costs you today and whether there is a credible case to improve it. If there is not, we will say so.
Book a 30-minute workflow review
Not ready to talk? Take the 3-minute check
30 minutes with Phil or Martin. No technical brief, no pitch deck. Phil or Martin replies personally, usually within one business day.