AI for RIA Compliance: What a Small Firm's CCO Can Automate

A small RIA's CCO can safely automate the collecting, chasing, drafting, logging and first-pass flagging: attestation reminders, the annual review checklist, the gifts and entertainment log, marketing pre-checks and email-sampling summaries. Every determination, approval and sign-off stays with the CCO personally, and the firm should record that rule in its policies.

The test for each task is simple. If a person could do it with a spreadsheet and a calendar, AI can probably prepare it. If the task ends with "decide whether this is acceptable", AI can only put the evidence in front of you. That distinction matters because the compliance rule puts the responsibility on the firm and its named officer, not on the software, and a regulator who asks "who decided?" needs a person's name.

Follow me on Instagram@sagnikteaches

The sort: prepare, flag or decide

Throughout, remember the firm may be registered with the main national adviser regulator or with state securities authorities, and the rule numbers below apply to the former. State-registered firms have similar duties under state rules, so confirm which applies to you.

Connect on LinkedInSagnik Bhattacharya

What the rules ask for, in plain terms

Three adviser rules shape most of this work. The summaries below are from the rule text as published in November 2026; read the current text, or ask your compliance counsel, before changing your procedures.

Subscribe on YouTube@sagnikteaches

• The compliance rule (206(4)-7) requires written policies and procedures designed to prevent violations, a review at least annually of their adequacy and effectiveness, and a designated chief compliance officer. The rule does not set a date for the annual review.
• The marketing rule (206(4)-1) covers advertisements, testimonials, endorsements, third-party ratings and performance presentations. It took effect in May 2021, and firms had to comply from November 2022. Gross performance may appear only alongside net performance shown with at least equal prominence, and a testimonial or endorsement needs clear disclosure of whether the person is a client, whether they were paid and any material conflicts. Firms usually build a pre-use review step for it.
• The code of ethics rule (204A-1) requires a written code covering standards of business conduct, compliance with the securities laws, access persons' holdings reports (on joining and at least once every 12 months) and quarterly transaction reports (due within 30 days of quarter end), pre-approval before access persons buy into IPOs or limited offerings, prompt reporting of violations to the CCO, and a written acknowledgement from each supervised person that they received the code. Many firms put the gifts and entertainment policy in or beside the code.

None of these says "use AI" or "do not use AI". They say the firm must supervise, test and document. That is why a tool is acceptable when it makes the work more consistent and the CCO can show how it is controlled.

Annual review checklist: the best first project

The annual review is a project with a deadline, many small items and a final report. AI is useful for planning it, because most of the work is organising.

1. Build the checklist from your own manual. Paste the section headings of your compliance manual (not client data) and ask for a table: policy area, what to test, evidence to collect, owner, due date.
2. Track status. Keep the table in a shared sheet; update it weekly. AI can draft a status email to the people who owe evidence.
3. Test controls. The CCO samples, reads and judges. AI can pull a random sample of records if your system exports them.
4. Draft the report. Provide your test notes and ask for a first draft of the findings section in a fixed structure: area, test performed, result, action, owner, date. The CCO rewrites any finding they do not agree with.

An illustrative extract of the checklist, as the model might produce it and as the CCO should check it:

What you would fix: the model will add generic areas you do not have (a trading desk, a private fund) and omit the ones you do. Strike the first, add the second, and compare against the headings in your manual. Also check any rule numbers it cites against the rule text. The compliance calendar tutorial shows how to put the recurring dates in a tracker so nothing depends on memory.

Attestation reminders

Quarterly or annual attestations (code of ethics acknowledgements, outside business activities, political contributions where relevant) are chasing work. The data is simple: who owes what by when. A spreadsheet plus an email template does most of it, and AI can write the reminder in an appropriate tone and escalate it.

Write three reminder emails for staff who have not yet completed their quarterly compliance attestation.
Reminder 1 (due in 5 days): friendly, two sentences.
Reminder 2 (due tomorrow): direct, mention it is a firm requirement.
Reminder 3 (overdue by 2 days): copy the CCO, state the next step in plain terms, no threats.
Use [first name], [attestation name] and [due date] placeholders. Do not invent consequences.

The CCO writes down what the next step actually is (for example, a note on the file and a meeting) before sending reminder 3; the model must not invent a penalty. Log every reminder and completion with dates; that log is the evidence the control ran.

Gifts and entertainment log

Staff report gifts and entertainment by email, form or in conversation. The weak point is incomplete entries and missed pre-approvals. A form with required fields fixes most of it. AI can help in two ways: converting free-text emails into log rows, and flagging entries near your thresholds.

An illustrative input: "Took two clients to a football match last Saturday, tickets were about 180 each, the client's firm hosted so I didn't pay." An illustrative output row: date, donor/recipient, description, estimated value (two tickets, $360 total), counterparty, who paid, pre-approved yes or no (flag: not recorded). The model should not decide whether it is allowed. It should show "value exceeds the $250 pre-approval threshold in policy section 4.2; no approval on file" if you give it the threshold, and the CCO decides. Note that the $250 is an example; use your own policy figure.

• Have the model quote the policy section it is applying, so you can check it exists.
• Keep the original message in the log, with the extracted row beside it.
• Review the log quarterly for patterns, such as the same counterparty appearing often just under the limit.

Marketing review queue

This is the highest-value task for many small firms, and the one most worth controlling. A pre-check against your own written marketing checklist catches the routine errors before the CCO reads the piece.

1. Write your checklist as plain questions: Is there a performance figure? Is net or gross stated? Is there a testimonial or endorsement and is the required disclosure present? Is a hypothetical example labelled? Are claims such as "best" or "guaranteed" substantiated?
2. Paste the draft (a web post, a social post, a newsletter) with the checklist and ask for an itemised pass/fail with the sentence quoted for each issue.
3. The author fixes the obvious items; the CCO reviews the revised draft and records the approval, the date and the version.

An illustrative flag from a draft web post that says "Our clients have earned strong returns": the tool lists "claim of returns without period or basis; no performance disclosure present". The CCO may agree, or may decide the sentence must go entirely. The record shows the draft, the issues listed, the changes and the CCO's decision. Keep that record with the rest of your advertising files for the period your books-and-records policy specifies.

What not to do: let the tool publish. The final step is a person pressing publish after the CCO's approval is on file, and the approved version is the one that is published. If a scheduling tool allows edits after approval, switch that off or check the published text against the approved text.

Email sampling summaries

Firms often sample a percentage of staff emails to look for problems: promises, complaints, off-channel communication, unapproved marketing. Reading a sample is slow; AI can summarise and flag it, which makes the sample larger for the same hour.

Confidentiality comes first: emails contain client data. Use a business setup with no training on your content, tell your team in the policy that sampled mail may be processed by an approved tool, and keep the sample to the minimum text. Then:

1. Pull the random sample with a documented method (for example 25 emails per adviser per quarter).
2. Ask the tool for a one-line summary per email and a flag against a list of keywords and themes you supply: "guarantee", "complaint", "personal account", "can't put that in writing", unapproved performance claims.
3. The CCO reads every flagged email in full, and a handful of unflagged ones at random, to check the tool is not missing things.
4. Record the sample size, the flagged count, the CCO's conclusions and any follow-up.

The failure mode is false comfort. A summary that says "routine" is only as good as the instructions; the CCO's random read of unflagged items is what tests it. The tutorial on reviewing transcripts uses the same sample-and-check method for calls.

Policy updates after a rule change

When a rule changes or a regulator publishes new guidance, the CCO has to work out what it means for the manual. AI can do the comparison work: paste the old policy paragraph and the new rule text and ask what differs. It cannot say what the rule requires of you.

Below are (A) our current policy paragraph and (B) the new rule text I have copied from the official source.
List each requirement in (B) as a bullet. For each, say whether (A) addresses it, partly addresses it, or does not, and quote the words in (A) that you relied on.
Do not tell me what the rule means for us and do not draft new policy text yet.

(A) [policy paragraph]

(B) [rule text]

An illustrative output lists seven requirements, marks four as addressed with quotes, two as partly addressed and one as missing. The CCO reads the original rule for the three gaps, decides whether the rule really requires them, and only then asks for a draft of new wording, which gets read and edited before adoption. Record the date, the source you copied the rule from and the approval.

A marketing checklist filled in for one draft

A blank checklist is easy to write; the useful part is seeing it applied. An illustrative pass over a draft newsletter item announcing a new service tier:

The pre-check took the tool seconds; the CCO's column took six minutes. The reasoning in the right-hand column is the compliance record, so write it yourself, in your own words, and keep the draft versions.

Questions for any tool vendor

Vendor oversight is part of a compliance programme. Before a tool touches firm data, ask in writing and keep the replies:

1. Is our content used to train models, now or under any default setting?
2. How long is it kept, and can we delete it?
3. Who can access it, including support staff and subprocessors?
4. How will you tell us about a security incident, and how quickly?
5. Can you give us the audit or security reports you hold?
6. What happens to our data when we leave?

Treat a vague or evasive answer as a reason to use the tool only on public material. Re-ask yearly, as terms and subprocessors change.

A week in the life: a four-person firm

An illustration with invented numbers. A firm with two advisers, an administrator and a part-time CCO who also advises clients sets aside three hours a week for compliance.

• Monday (30 minutes). The tracker shows two attestations overdue; the reminder prompt drafts the emails; the CCO adds a line and sends.
• Tuesday (40 minutes). Three marketing drafts in the queue. The pre-check flags six items across them; the CCO agrees with five, overrules one, and records the approvals.
• Wednesday (25 minutes). The G&E log has four new entries; one is over the pre-approval threshold with no approval; the CCO follows up with the adviser.
• Thursday (45 minutes). Quarterly email sample of 50 messages summarised; 6 flagged; the CCO reads those 6 and 8 random others, finds nothing needing action, and writes the note.
• Friday (20 minutes). Update the annual review tracker; draft next week's list.

Total about two hours forty minutes, which the CCO estimates would have been closer to five hours without the drafting and summarising help. The estimate is the CCO's own, which is the point: measure it for your firm instead of trusting anyone else's.

Starting small: a 30-day plan for the CCO

Nobody needs to automate everything at once. A sensible order puts the lowest-judgement tasks first, so the firm learns how the tools behave before they touch anything sensitive.

1. Days 1 to 7. Update the policy manual to list approved tools and permitted uses. Choose the account and confirm the privacy settings. Nothing is automated yet.
2. Days 8 to 14. Run the attestation reminders from the tracker. Compare the drafted emails with what you would have sent, and record the time taken.
3. Days 15 to 21. Move the gifts and entertainment log to a form with required fields, and use AI only to tidy free-text entries.
4. Days 22 to 30. Try the marketing pre-check on three past pieces you have already approved. If the tool misses a problem you caught, improve the checklist wording before using it on live drafts.

At day 30, write a half-page note for the compliance file: what was tried, what was caught, what was missed, what changed in the policy. That note is useful evidence at the annual review, and it tells you whether to extend to email sampling next.

Controls around the tools themselves

Using AI adds a vendor and a process to supervise. Write these into your policies, and test them in the annual review.

On cost: ChatGPT Business lists at $25 per user per month ($20 on annual billing) and Claude Team is similar; both need at least two seats, so a one-person compliance function pays for two or uses an individual plan with training off. Check the vendor pages, as prices change. The governance checklist for advice firms and the human-review tutorial go deeper on the controls.

Where CCOs trip up

• Treating a flag-free result as approval. No flags only means the tool found nothing against your instructions. The CCO's judgement is what approves.
• Outsourcing the reasoning. A drafted annual review report with generic findings reads as boilerplate, which is the opposite of evidence that you tested anything. Write the findings yourself from your own tests.
• Undocumented use. Using a tool in practice but not in the policy. Update the manual before you start.
• Pasting client data into a personal account. Use the firm's approved account only.
• Stale rule knowledge. A model's account of a rule may be out of date or wrong. Read the current rule text.

If you want a second view on which of these tasks suit your firm, that is what my AI implementation consultation covers. For the adviser-facing side, the tutorial on advisers and chatbots explains what compliance allows in the front office.

Small-firm CCO questions about AI

Can AI approve marketing materials?

No. It can check a draft against your own written rules and list likely problems, such as performance claims without required context or testimonials without disclosures, but the CCO or a designated reviewer makes and records the approval. The responsibility stays with the firm and the named officer.

Is it safe to feed client emails to an AI tool for sampling?

Only on a business setup with written no-training and confidentiality terms, and after checking your privacy notice and policies cover it. Use the minimum text needed, keep the output in your compliance files, and have the CCO read the flagged items rather than the summary alone.

Does using AI create something I must disclose or document?

Document it in your policies: what tools you use, for which tasks, who reviews the output and how you test it. Check whether your disclosure documents, client agreements or privacy notice need updating, and ask your compliance counsel if you are unsure. Regulators generally expect a firm to supervise the tools it uses.

What should a CCO automate first?

Start with tasks that are mostly reminders and collection: attestations, the gifts and entertainment log, and the annual review checklist. They have clear inputs, low judgement and an obvious human check, so they build confidence in the method before you touch anything that involves a determination.

Further reads

• AI Literacy Requirements: What Your Staff Need to Know — What every member of staff should know about AI.
• How to Review an AI Tool After 90 Days: Keep, Fix or Cancel — Keep, fix or cancel a compliance tool after 90 days.
• AI Note Takers for Financial Advisers: Compliant Meeting Records — Meeting records that stand up to review.
• AI Email Triage for Professional Firms: Sort, Summarise, Draft — Sorting and summarising firm email.
• How Advisers Use AI to Prepare for Annual Client Reviews — The client-facing side of the annual review cycle.
• AI Compliance Checklist for Small Businesses: What Applies to You — A wider AI compliance checklist for small firms.
• AI Marketing for Financial Advisers: Content That Clears Compliance — Prompt rules built from the SEC Marketing Rule and NASAA's AI guidance, a review workflow, and a before-and-after post a compliance officer can sign.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: official rule text (eCFR) for the compliance rule (206(4)-7), marketing rule (206(4)-1) and code of ethics rule (204A-1), and the regulator's marketing rule release page and press release, read 4 November 2026; OpenAI's ChatGPT Business pricing page and Claude's pricing page, checked the same day.