Treat AI as a first-draft writer and your compliance officer as the approver. Give it only facts the firm has already cleared, ban performance figures, testimonials and "AI-powered" claims from its drafts, and keep the prompt, the draft, the edits and the sign-off together. The rules apply to the published text, whoever or whatever drafted it.
That is a workflow, not a loophole. Nothing here replaces your compliance officer or counsel, and which rules apply depends on how your firm is registered. The SEC Marketing Rule and NASAA's guidance on AI are the working examples below; if your firm answers to a different regulator, swap in that rulebook and keep the steps.
What counts as an advertisement, and why an AI draft is one
The Marketing Rule (Rule 206(4)-1 under the Advisers Act) defines an advertisement as a communication the adviser makes to more than one person, or to even one person if it includes hypothetical performance, that offers advisory services for securities. A newsletter, a LinkedIn post, a website page, a webinar deck and a video script all fit. Extemporaneous live oral communications and information in required regulatory filings are carved out, and an email to a single person generally falls outside the definition unless it carries hypothetical performance, though your compliance officer decides that, not a chatbot.
The definition says nothing about authorship. The firm that publishes the piece owns it, whether a person, a template or a chatbot wrote the first draft. FINRA says the same about brokerage communications: its content standards apply, in its words, "whether member firms' communications are generated by a human or technology tool" (Regulatory Notice 24-09). If your firm or its advisers are also registered through a broker-dealer, its communications rules can apply as well, and the FINRA checklist for AI-written content covers that side in more detail.
The seven prohibitions, rewritten as rules for your prompt
Paragraph (a) of the rule lists seven things an advertisement may not do. Each maps to a failure that AI drafts produce readily, and each can become one line in your prompt and one line on the reviewer's checklist. The left column paraphrases the rule; the rule's text and your compliance officer have the last word.
| An advertisement may not... | How an AI draft breaks it (illustrative) | Rule for the prompt and the review |
|---|---|---|
| State an untrue material fact, or leave out one needed to avoid misleading | Invents "25 years of experience" or "$300 million under advice" | Only the approved facts sheet counts as fact; anything else becomes [ADD FACT] |
| State a material fact the firm has no reasonable basis to believe it can substantiate | "Most of our clients retire earlier than they expected" | No statistical or comparative claims unless a named record in the substantiation file backs them |
| Imply something untrue or misleading about a material fact | "So you never need to worry about money again" implies an outcome no adviser can promise | Describe the process and what client and adviser do together, never the outcome |
| Discuss benefits without fair and balanced treatment of material risks or limitations | "Diversification protects your savings" | Every benefit sentence travels with its limitation, in the same piece, in plain words |
| Refer to specific investment advice that is not presented fairly and in a balanced way | "Why we are buying [a named fund] for clients this quarter" | No named securities, funds or trades in AI-drafted content; compliance handles any exception |
| Include or exclude performance results, or present time periods, unfairly | "Our model returned 12% last year" | No performance figures in drafts; compliance builds any that appear from an approved template |
| Otherwise be materially misleading | A smooth, confident sentence that survives every other check but leaves a false impression | Someone who did not write the piece reads the finished version once, cold |
The prompt makes the first six failures less likely, the reviewer checks all seven, and only a person can judge the seventh, which is the overall impression. That division of labour is the whole design.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowWhat NASAA's AI guidance asks you to be able to show
NASAA, the association of state securities regulators, publishes a compliance article on using AI: risks and compliance considerations, written by its investment adviser section's publications group; the page notes that it does not necessarily represent NASAA's own views and is not legal advice. Its marketing section is short and direct. Advisers who use AI to generate social media posts, website articles or advertisements must make sure all of it is accurate, carries adequate disclosures and is reviewed by a designated compliance officer. Hypothetical performance reports, which the article says AI tools often generate, must include proper disclosures. And some jurisdictions restrict testimonials or require extra disclosures for them. The compliance section then asks for written policies on four things: a compliance officer reviews all AI output (marketing, client communications and investment recommendations) for accuracy before it goes out; staff are trained on AI's limits and on data protection, not only on how to use the tools; AI vendors get due diligence; and the review of AI-generated content is documented for examinations. The vendor checks it names are data security, regulatory compliance support, transparency about the AI's algorithms, and support and updates, with contracts that include indemnification, service levels and clear terms for cybersecurity incidents. It also warns against "fake AI", meaning a service marketed as AI-powered when it runs on simple algorithms, preset rules or manual work.
Turn those expectations into four things you can produce on request:
- The name of the designated reviewer, and who covers when they are away.
- The checklist the reviewer actually used, in the form the firm adopted.
- A record per published piece: prompt, AI draft, edited draft, reviewer's marks and approval.
- A short due-diligence note on each AI tool the marketing team uses, covering where the data goes, who can see it and what the contract says if there is a security incident. The AI governance checklist for small advice firms has a template for that note.
One newsletter through the review workflow, step by step
An illustration for a four-adviser independent firm that sends a monthly client newsletter of about 700 words. The topic this month is reviewing a retirement plan after a life change. Every step has an owner, and the numbers are people-time, not elapsed time.
- Brief (marketing lead, 10 minutes). Topic, audience, three points to make, and the approved facts sheet attached.
- Draft (AI, 5 minutes). The locked prompt from the next section. Paste the output straight into a shared document, so the draft is kept where compliance can see it.
- Author edit (marketing lead, 25 minutes). Add the firm's voice, delete anything not on the facts sheet, resolve every [CHECK] and [ADD FACT] marker.
- Claims pass (marketing lead, 10 minutes). Highlight every sentence that mentions a benefit, a result, a number, a named product or the firm's own use of AI, and hold each against the seven-line table above.
- Compliance review (designated reviewer, 15 minutes). Reads the clean copy and the highlights, approves or returns it, and initials the sign-off sheet.
- Archive (marketing lead, 5 minutes). Prompt version, AI draft, edited draft, reviewer's marks, approval and the published copy go into the compliance folder.
That is 70 minutes of people-time, 15 of them the reviewer's. A returned piece adds about ten minutes for the fix and a second look. The reviewer's quarter-hour is short because the author has already done the claims pass, and because the prompt kept the riskiest material out of the draft in the first place.
A drafting prompt with the guardrails inside it
This prompt goes into a ChatGPT Project or Claude Project as standing instructions, so every chat starts inside the limits. Compliance should approve the prompt itself, not only each output, and the approved version should carry a version number that gets logged with each piece.
ROLE: You draft marketing copy for [firm name], an independent investment advisory firm. You write first drafts only. A person and our compliance officer review everything.
APPROVED FACTS (the only facts you may state about the firm):
- Services: [as described in our regulatory brochure]
- Fee description: [exact approved wording]
- Team: [names, roles and credentials exactly as approved]
- How to book: [details]
If a sentence needs any other fact about the firm, write [ADD FACT].
NEVER WRITE:
- Any performance figure, return, yield, rate, ranking or comparison.
- Any projection, hypothetical example, growth illustration or "what if" calculation.
- Any named security, fund, manager or trade.
- Any testimonial, client story, award or third-party rating.
- Any statement about whether or how we use AI.
- Any promise or implied promise of an outcome ("never run out", "retire earlier", "protect", "secure").
- The words: guarantee, safe, risk-free, best, top, proven, outperform.
ALWAYS:
- Put the main limitation next to any benefit, in plain words.
- Describe what the client and we do together, not what the client will get.
- Mark any sentence you are unsure about with [CHECK: reason].
- End with the approved disclosure line: [firm's approved disclosure].
TASK: Write a LinkedIn post of 900 to 1,200 characters about [topic] for [audience].Two lines in it carry most of the weight. "Any statement about whether or how we use AI" keeps the model from describing the firm's tools, which it does not know and may flatter. And "write [ADD FACT]" stops the most common invention, the credential or the asset figure that sounds plausible. Nothing in the prompt is clever; it is simply the table above, written as instructions. If you use a general-purpose chatbot, what compliance allows with ChatGPT covers data handling for the rest of your work.
A retirement post, before and after compliance
First, what a plain request produces. The prompt was only "Write a LinkedIn post about retirement planning for people in their fifties." An illustrative draft:
Retirement shouldn't be a guessing game. Our AI-powered planning process stress-tests your savings against thousands of market scenarios, so you never run out of money. Clients who plan early typically retire two years sooner. A balanced portfolio has historically returned around 7% a year. Book your free review today.A reviewer would mark five things. "AI-powered" and "thousands of market scenarios" describe a capability the firm may not have (prohibition 1 and the AI-washing point below). "So you never run out of money" implies an outcome (3). "Typically retire two years sooner" is an invented statistic with no substantiation file (2). "Historically returned around 7%" is a performance-type statement with no period, source or risk language (6, and the balance requirement in 4). And nothing in the post mentions that investments can lose value (4). The same topic through the guarded prompt gives something a reviewer can sign:
A retirement plan starts with questions, not numbers. How much do you want to spend each year? What could change? What would you do if markets fell in your first years of retirement?
In a planning meeting we work through those questions using your own figures, and we show how the answer shifts when the assumptions change. Any plan rests on assumptions that can turn out wrong, and investments can lose value.
If you would like to start with the questions, book a 30-minute introduction: [link]
[Firm's approved disclosure line]The second version is less exciting, and that is the trade. It makes only claims the firm can stand behind, puts the limitation next to the benefit, and ends on an action. The reviewer's job shrinks from rewriting to checking.
Growth illustrations count as hypothetical performance
AI assistants volunteer illustrations: "$100,000 growing at 6% a year for 20 years." The Marketing Rule defines hypothetical performance as results not actually achieved by any portfolio of the adviser, and the definition covers model portfolios, back-tested results and targeted or projected returns. An advertisement that includes hypothetical performance can be an advertisement even when it goes to one person. The rule then requires three things: policies and procedures reasonably designed to ensure the performance is relevant to the intended audience's likely financial situation and objectives; enough information for that audience to understand the criteria and assumptions behind it; and enough information to understand the risks and limitations of relying on it. NASAA's article flags the same point from the AI side.
The arithmetic itself is easy: 1.06 to the power of 20 is about 3.207, so the illustration comes to roughly $320,700. The danger is not the sum, it is the assumption. The 6% was a number the AI picked, which makes the whole illustration a projection that would need the conditions above. Recalculate any figure in a spreadsheet (=100000*1.06^20) rather than trusting a chat, since long tables of compounded figures are where chatbots slip. For a small firm, the simpler rule is to keep illustrations out of AI-drafted social content altogether. If one is genuinely needed, compliance builds it from an approved calculator with the assumptions and limitations attached, and the AI never touches the numbers.
Testimonials, ratings and the awards an AI will invent
Testimonials and endorsements carry their own conditions under the rule. The advertisement has to state clearly and prominently whether the speaker is a current client or someone else and whether any compensation, cash or non-cash, was paid, along with a brief statement of material conflicts. The adviser also needs a reasonable basis for believing each one complies, and a written agreement with anyone paid more than de minimis compensation, which the rule defines as $1,000 or less in total over the preceding 12 months. Third-party ratings need a reasonable basis for believing the underlying survey was not designed to produce a predetermined result, and the advertisement must disclose the date and period of the rating, who created and tabulated it, and any compensation paid to obtain it.
AI breaks all of this in two ways: it invents recognition, and it improves real quotes. A realistic miss: the About page draft said the firm was "recognised as a top-rated adviser by clients and peers." No rating existed, so the reviewer's question about date, period and the third party that tabulated it had no answer, and the line came out. The second failure is quieter. Asked to tidy a client's kind words, a model smooths them into something the client never said, which turns a real testimonial into an unapproved one. So the prompt bans testimonials, ratings and awards outright, and compliance handles any that the firm genuinely uses. For service pages and bios, where these claims tend to live, see AI website copy for financial advisers.
Describing your own use of AI without AI washing
In March 2024 the SEC announced settled charges against two investment advisers over what they had said about their use of AI. One had misrepresented its AI and machine-learning capabilities in filings, a press release and on its website; the other had called itself the "first regulated AI financial advisor" and advertised "Expert AI-driven forecasts". The firms paid $400,000 between them, and the SEC found Marketing Rule violations. The SEC's chair at the time said investment advisers "should not mislead the public by saying they are using an AI model when they are not." NASAA's article makes the same point under the heading of fake AI and says such claims could break securities law.
The lesson for an adviser using AI for drafting is narrow and practical: do not describe your process as AI-driven unless you can document what the AI does. Three common lines and how to handle them:
| Line an AI draft may add | What to check | Wording you can defend if it is true |
|---|---|---|
| "Our AI-powered planning engine" | Is a model actually doing the planning, or is it a spreadsheet and an adviser? | "Our advisers prepare each plan using [the planning software's name]." Say nothing about AI unless it is the point. |
| "AI analyses your portfolio around the clock" | What does the tool do, how often, and who reviews its output? | Leave it out. Describe the review schedule the firm actually keeps. |
| "We use AI to give you more time with your adviser" | Is it true, and measurable? Which tasks, and does an adviser review them? | "We use AI tools to draft meeting notes. An adviser reviews every note before it is filed." |
The sign-off sheet, filled in
One page is enough. This is an illustrative sheet for three pieces in the same month, showing what the reviewer saw and decided. The columns mirror the four things above: who reviewed, what was checked, what was found and what was decided. Once a month, the reviewer also pulls two published pieces at random and re-reads them against the checklist. If a piece contains something the sheet did not flag, the fix goes into the prompt and the facts sheet, not only into that piece.
| Piece | Channel | Flagged by the author | Reviewer's finding | Decision |
|---|---|---|---|---|
| Retirement questions post | Benefit sentence, disclosure line | Limitation sits next to the benefit; approved disclosure present | Approved | |
| Monthly newsletter | One named fund in the "what we read" block | Named fund removed; block rewritten as a process note | Returned, then approved | |
| Team page update | Website | A new credential in one bio | Credential matches the approved facts sheet and the registration record | Approved |
What to keep, and for how long
The books-and-records rule (Rule 204-2) requires an adviser to keep a copy of each advertisement it disseminates, directly or indirectly, and a copy of other communications sent to ten or more persons. Those records are generally kept for at least five years from the end of the fiscal year in which the piece was last used, with the first two years in an appropriate office of the firm. Records substantiating testimonials and third-party ratings are covered separately in the same rule. NASAA's article adds the AI-specific habit: document the review of AI-generated content.
In practice, one folder per piece holds six files: the prompt version, the AI draft, the edited draft, the reviewer's marks, the approval and the published copy. Your compliance manual sets the retention schedule and the filing system, and your compliance officer should confirm that the AI drafting files are inside it. If the firm uses an archiving service for social media, ask whether it keeps edits and comments, because the published copy alone does not show what the review changed.
When the author and the approver are the same person
Many small firms have one person who writes the marketing, runs compliance and is also the principal. A review by the author is a weak control, and an examiner will see that. Three arrangements improve it without hiring anyone. First, bring in an outside reader for a monthly batch: a compliance consultant or your counsel. Second, approve the prompt and the facts sheet once, with that outside reader, so most of the risk is settled before any single piece is drafted. Third, put a 24-hour hold between finishing a piece and approving it, and note the hold in the record, because the same person reads differently the next morning.
Whatever you choose, write it down in the compliance manual as the firm's process. The guide to what a small firm's compliance officer can automate shows which review tasks AI can speed up and which should stay with a person. The sign-off itself is one of those. A drafting tool can save the author an hour, and it cannot take on the reviewer's accountability.
Questions advisers ask before publishing AI-drafted content
Does AI-drafted content need an AI label?
Neither the Marketing Rule text nor NASAA's AI article requires a general 'written by AI' label. The duties are that the content is accurate, balanced and approved, and that any statement about your own use of AI is true. Ask your compliance officer whether your firm's policy adds a label, and check each platform's own rules for AI-generated images or video.
Who signs off if I am the only adviser and the compliance officer?
Bring in a second reader. An outside compliance consultant or your counsel can act as the reviewer for a monthly batch. If that is not possible, use a checklist and a 24-hour hold between finishing the piece and approving it, and record that you did so.
Can AI write or tidy up a client testimonial?
No. A testimonial has to be the client's own statement with the required disclosures, and a rewrite can change its meaning. Do not let AI draft, edit or choose excerpts. Ask compliance to handle each one and keep AI away from client quotes, ratings and awards entirely.
How long should compliance review take for one piece?
With a locked prompt, an approved facts sheet and a one-page checklist, aim for 10 to 15 minutes for a short post or newsletter. Anything that mentions performance, a named security or a client story takes longer, which is another reason to leave those out of AI-drafted content.
Can I put a projected growth chart in a post?
A projection is hypothetical performance under the Marketing Rule, which brings extra conditions on policies, assumptions and risk disclosure. Most small firms keep growth illustrations out of social posts. If you use one, have compliance build it from an approved calculator and never let the AI produce the numbers.
Further reads
- Can You Use AI to Advertise a Professional Practice Within the Rules? — The same advertising questions across regulated professions.
- AI Lead Generation for Financial Advisers Without Cold Outreach — Lead generation that avoids cold outreach.
- AI Chatbot for an Adviser's Website: FAQs and Bookings, Not Advice — A website chatbot that books but never advises.
- How Can AI Help Financial Advisors Find and Keep Clients Compliantly? — Finding and keeping clients inside the rules.
- AI for Wealth Managers: Drafting Proposals With a Compliance Review — Proposal drafts with a compliance review step.
- AI Marketing for Small Law Firms: Content, Reviews and the Rules — How another regulated profession handles AI content.
- Claude for Financial Advisers: Plugin, Connectors and Plan Needed — What the Claude for Financial Advisors plugin does, which connectors come with it, why Anthropic recommends Enterprise for regulated firms, and the cost.
- AI for Wealth Management Firms: A 90-Day Rollout Plan for Small Firms — A week-by-week 90-day plan for a small wealth firm: policy first, a meeting-notes pilot, vendor checks, training, and measured hours and errors.
- AI Agents for Financial Advisers: What They Can Do Without Advising — A task-by-task map of what AI agents can do in an advice practice without advising, checked against vendor policies and backed by a supervision log.
- AI Content Creation for Professionals: Turning Expertise Into Posts — A weekly post workflow for accountants, solicitors and consultants: capture, draft, wording limits and a review before publishing.
- AI Tools for Asset Management: Factsheet Commentary With Sign-Off — A month-end workflow for factsheet commentary: source-only drafting, a check on every figure, and a named approver who signs a log.
- AI Tools for Life Insurance Agents: Follow-Up Within the Rules — A rule-first method for AI follow-up in life insurance: guard-railed prompts, replacement flags, recording consent and a pre-send gate.
- AI Agents for Financial Advisers: What to Delegate Under Compliance — A delegation map for adviser meeting prep, follow-ups and record updates, with approval and archiving gates.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: SEC Rule 206(4)-1 and Rule 204-2 text (eCFR), SEC staff Marketing Compliance FAQs (updated January 2026), SEC press release 2024-36, NASAA's investment-adviser compliance article on using AI, and FINRA Regulatory Notice 24-09, as checked in November 2026.