What RIAs Need To Know About Using AI | Alyra

No AI-specific rule exists for investment advisers. Five rules written before any of this are being applied instead, and the gaps are where examinations land.

No AI-specific regulation has arrived. Five rules written before any of this existed are being applied instead, and the gaps between them are where examinations land.

Eighty-five percent of firms named artificial intelligence their top compliance topic for 2026 in the Investment Management Compliance Testing survey, and seventy-two percent reported increasing their testing around it. Those are large numbers for a subject with no dedicated rule.

That is the actual situation. No AI-specific federal regulation has been enacted. The SEC and FINRA are applying what already exists: supervision, recordkeeping, communications, fiduciary duty and the marketing rule. Most firms hear that as a reprieve, because it sounds like nothing has changed. It is closer to the opposite. Those rules were written without this in mind, and the gaps are where enforcement tends to land.

The five rules already doing the work

Supervision comes first. An adviser is responsible for the conduct of its people and its systems, and a tool that drafts client communication is now part of what has to be supervised. That obligation did not need updating to apply.

Books and records is next, and it is the one with an open question at its centre, below. Then the marketing rule, which governs any AI-generated claim about performance or capability, including the ones a tool phrases for you. Then fiduciary duty, which does not care how a recommendation was produced. And finally vendor oversight, which is where most firms are quietly exposed.

None of these were written with generative systems in mind. All of them apply anyway. The question an examiner asks is not whether you used AI. It is whether you can show what it did.

The open question about records

It remains unsettled whether AI-drafted client communications, marketing pieces and investment analyses must be retained under the Advisers Act books and records rule. In May 2026 the Investment Company Institute and the Investment Adviser Association formally asked the SEC to modernise that rule, citing this directly.

Read that twice. Two of the largest bodies in the industry went to the regulator because nobody can say with confidence what has to be kept. If your plan is to wait for clarity before deciding what to retain, you are waiting on a process with no deadline attached to it.

What a record is for

A more useful route is to stop asking what the rule requires and start asking what a record is for. A record exists so somebody who was not in the room can reconstruct what happened and why. By that test a saved copy of an AI-drafted letter is a weak record. It shows what went out. It does not show what the system was given, which version of it answered, or what the person who sent it actually checked.

The stronger version keeps three things: the output, the inputs it was derived from, and the name of the person who approved it. None of that is exotic. All of it is the difference between producing a document and being able to defend one.

Firms are bracing for a rule that may never arrive, while a rule that already arrived sits unaddressed because the tool came bundled.

The deadline that already passed

While the retention question stays open, a dated one has already landed. The Regulation S-P compliance date for advisers under one and a half billion dollars in assets was June 3, 2026. It requires documented oversight of vendors handling client data, which now includes AI tools, and the supporting documentation has to be kept for five years.

A great many smaller firms adopted AI during 2026 without running it through vendor diligence, because it did not arrive as a purchase. It arrived as a feature inside software they already licensed. That is the most common gap we see, and it is also the cheapest one to close.

Three things worth doing now

Write down every place AI touches client data or client communication, including the features that appeared inside tools you already had. Most firms underestimate that list by about half.

Decide, for each use, whether the output is AI-generated or AI-assisted, and record who reviews it. The distinction matters more than the label, because it names the person who is accountable.

Keep the inputs, not only the output. If your system cites its sources this is nearly free. If it does not, that is worth discovering now rather than during an examination.

None of this needs a regulator to tell you what to retain. It needs a decision that you would rather be able to answer the question than find out afterwards what the answer was supposed to be.

Start a conversation