Regulation S-P and AI Vendors: A Small RIA's Due Diligence Checklist

The amended Regulation S-P requires a small registered investment adviser to oversee any AI vendor that can touch client information. That means written due diligence, monitoring, a vendor promise to tell you of a breach within 72 hours, and your own client notice within 30 days. Smaller advisers had to comply from 3 June 2026.

Which advisers count as "smaller"? Those with under $1.5 billion in assets under management; larger ones were due on 3 December 2025. The amendments cover investment advisers registered with the SEC, so a firm registered only with a state regulator should check which privacy and safeguards rules apply to it instead. The rule asks for policies, not a particular contract. This is a working checklist, not legal advice: confirm each point with your compliance consultant or counsel.

Follow me on Instagram@sagnikteaches

What the amended rule says, in the words a small firm needs

The text sits in 17 CFR 248.30, which the eCFR publishes in full. Four parts matter when AI is in the picture.

Connect on LinkedInSagnik Bhattacharya

1. Safeguards policy. Written administrative, technical and physical safeguards for customer information, aimed at security, protection against foreseeable threats, and protection against unauthorised access that could cause substantial harm or inconvenience.
2. Incident response programme. Procedures to assess the nature and scope of an incident, contain and control it, and notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorisation.
3. Customer notification. Notice as soon as practicable and no later than 30 days after you become aware of an incident, unless an investigation shows the information is not reasonably likely to be used in a way that causes substantial harm or inconvenience.
4. Service provider oversight. Written policies and procedures reasonably designed to require oversight, "including through due diligence and monitoring", of service providers, so that they protect customer information and tell you of a breach as soon as possible and no later than 72 hours after they become aware of it.

A service provider is any person or entity that receives, maintains, processes or is otherwise permitted access to customer information through services provided directly to the adviser. Read that against your software list. A transcription app, a CRM with a summarising feature, an email assistant and a chatbot on a business plan all fit if client information reaches them. The responsibility for notifying clients stays with you even when the vendor offers to send the notices (rule 248.30(a)(5)(iii)).

Subscribe on YouTube@sagnikteaches

One change from the proposal helps small firms: the SEC did not adopt a requirement for a written contract with each provider mandating safeguards. It adopted a requirement for written oversight policies. The adopting release still suggests firms consider whether a written contract recording both sides' expectations is appropriate, and many will use one as evidence, but the obligation you must be able to show is the oversight itself.

The amendments also add a recordkeeping duty, which is where an AI vendor file earns its keep. The records the release lists include your written safeguards and incident response policies, your assessment and containment of any incident, the notices you sent or the basis for deciding notice was not needed, your service-provider oversight policies, and any written contract or agreement with a provider. If an AI tool is involved in an incident, that trail has to exist for it too.

Is this AI tool a service provider? A five-question test

Do this before any scoring. Ask of each AI tool, add-on or feature:

1. Can anyone in the firm paste, upload or connect client data to it (names, account numbers, statements, meeting audio, email)?
2. Does it connect to a system that holds client data, such as the CRM, email, file store or portfolio system?
3. Is the vendor, not you, running the servers where that data lands?
4. Does it keep inputs, transcripts or outputs after the session ends, even briefly?
5. Could a sub-processor, such as a model provider behind the app, see the content?

A "yes" to question 1 or 2 puts the tool in scope for oversight. Questions 3 to 5 decide how deep the due diligence goes. A model running only on your own machine with no connection to client files is a different risk class from a cloud transcription service, and your inventory should show why you placed each tool where you did.

Illustration: a four-adviser firm lists nine tools. Six are obviously in scope (CRM, custodian portal, e-signature, email, meeting recorder, ChatGPT Business). Two are in scope only because of an add-on (the CRM's AI notes feature, the email platform's reply suggestions). One, a design tool for the newsletter, never touches client data and is recorded as out of scope with a one-line reason. That inventory page is the document the rest of the file hangs from.

The due-diligence checklist, grouped by what you are proving

Each item gives the question, the evidence to keep, and a pass mark. Keep evidence in one folder per vendor.

Group A: what the vendor does with the data

Group B: what happens when something goes wrong

Group C: your side of the relationship

1. Named internal owner for the vendor (usually the chief compliance officer, or the firm principal in a very small firm).
2. Accounts limited to named staff, with multi-factor sign-in and admin rights held by two people.
3. A written rule on what staff may enter, with examples of banned content (full account numbers, tax ID numbers, dates of birth together with names).
4. A review date. Annual is a sensible floor for each in-scope vendor, with a trigger review when the vendor changes terms, adds a sub-processor or suffers a publicised incident.
5. An exit note: how to export and delete your data if you leave.

Group C is the part vendors cannot supply. A pristine vendor file and no internal rule is a weak position; a modest vendor and a firm internal rule is often a stronger one.

Scoring one AI meeting recorder against the checklist

Say a five-person advisory firm wants to use an AI meeting recorder for client reviews. The firm asks for the vendor's terms, security page and sub-processor list, and fills in the checklist.

Decision rule used by the firm: no "fail" on training or breach notice for any tool that sees client data. The firm writes to the vendor:

Subject: Regulation S-P service provider questions

Hello [vendor contact],

We are a registered investment adviser and expect to use your product for client meetings. Our written oversight procedures need two confirmations:

1. Will you notify us as soon as possible, and no later than 72 hours after you become aware, of a breach in security that results in unauthorised access to a system holding our customer information? Please point us to the contract term or policy that says so, or confirm in writing.
2. How long do you retain recordings and transcripts after we delete them or close the account, and can we shorten it?

Thank you,
[your name]

Possible outcomes: the vendor confirms 72 hours in an addendum (pass; file it), confirms only "promptly" (the firm records the gap, sets a decision date and keeps the tool off client meetings until it is resolved), or declines (the firm uses the recorder only for internal calls, or chooses another vendor). Whatever happens, the file shows a decision made with reasons, which is what oversight looks like on paper.

The incident response programme when the vendor is an AI tool

Most firms already have an incident plan of some kind. The amended rule asks for three specific abilities: assess, contain, notify. AI vendors change the detail of each.

Assess

You need to know what customer information could have been in the tool. That is why the inventory and the "what may be entered" rule matter. If staff paste client emails into a chatbot, the scope of an incident is every email that went in. If your policy and your checks say only anonymised text went in, scope is small. A simple log, even a spreadsheet noting which tools hold which data types, saves days.

Contain

Containment steps for an AI tool: revoke API keys and connected-app permissions, suspend accounts, remove integrations from the CRM or email, change shared passwords, and request deletion of retained content. Write the steps per vendor on one page, with the admin login owner's name. Nobody wants to find out during an incident that the only admin left in March.

Notify

Client notice is due as soon as practicable and within 30 days of becoming aware, and has required content: a description of the incident and the type of sensitive information, the date or date range if it can be determined, contact details (telephone, email, postal address and a named office), a recommendation to review account statements and report anything suspicious, and the identity-protection guidance the rule lists (fraud alerts, free credit reports and the consumer protection agency's identity-theft guidance). Sensitive customer information has a definition in the rule: items such as government ID numbers, account numbers combined with authenticating details, or biometric records. A client's first name in a transcript is not, on its own, sensitive customer information. A transcript containing a name, account number and date of birth is.

Your 30-day clock runs from when you become aware of the incident, which may well be the moment the vendor's notice arrives, and the rule says that on receiving such a notice you must start your incident response programme. Record the time and date you receive it. Keep the investigation notes if you decide no notice is required; the rule expects a reasonable investigation behind that determination, and you should be able to show it.

Four situations small RIAs actually meet

A staff member used a personal AI account

An associate pastes a client's custodial statement into a free consumer chatbot to summarise it. No firm-approved vendor exists here, so there is no oversight to evidence. Treat it as an incident-assessment question: what went in, whose data, does the consumer plan retain it, and can it be deleted? Then fix the cause: provide an approved tool, and write the rule down. Consumer plans typically allow switching off model training in settings, but a setting a staff member controls is not firm oversight.

A vendor adds AI to a tool you already use

The CRM announces "AI notes" for every client record. The vendor was already approved; the new feature is a new data flow. Re-run questions 3 to 5 for the feature, check whether it is on by default, and decide whether to enable it firm-wide, for some users or not at all. Put the decision date in the file.

The vendor will not give hours

Large vendors sometimes cannot negotiate with a five-person firm. The rule asks that your policies be reasonably designed to ensure the notification; it does not tell you to find a vendor who signs anything. Options in order of preference: use a plan or addendum that states a time; use the vendor's published security commitments if they include hours; limit what goes into the tool so that a breach would not touch sensitive customer information; or choose another vendor. Record which option you took and why.

An examiner asks about AI

Be ready to answer questions like these: list the AI tools used by the firm; which see customer information; show the oversight file for one; show the policy staff follow; show training or attestation records. If you can lay hands on an inventory, one vendor file and the staff rule in ten minutes, you are well placed.

Writing the policy pages

Three short documents are enough for most small firms.

1. AI and vendor inventory: tool, owner, in scope (yes/no and why), data types allowed, plan or tier, last review date.
2. Vendor oversight procedure: how a new vendor is approved (the checklist above), how often it is reviewed, who signs off, and what triggers an early review.
3. Staff rule: what may and may not be entered into AI tools, which tools are approved, and who to tell if something goes wrong.

Here is a filled-in staff-rule excerpt, illustrative only:

Approved AI tools: [tool A] (business plan, firm login), [tool B] (CRM feature, enabled for advisers only).
Never enter: full account numbers, tax ID or national ID numbers, dates of birth with names, login details, scanned ID.
Allowed with care: client first names, meeting topics, anonymised figures.
If you pasted something you should not have: tell [compliance owner] the same day. Do not delete the chat first.

You can have AI draft the first version of these pages, then edit them against the checklist. If you do, give it your tool list and the rule text, not client information. The AI governance checklist for small advice firms covers the wider policy set, and the tutorial on whether financial advisers can use ChatGPT covers what to keep out of general chatbots.

Three more vendor cases, briefly

An AI email drafting add-on

The add-on reads the inbox to suggest replies. Its reach is wide: every client email, attachment and thread is in scope. Questions to settle first: does it read all mail or only the message you open; does it store copies; can it be limited to named mailboxes? A firm might enable it only for the operations inbox, where messages rarely carry account numbers, and keep it away from adviser inboxes. See AI email triage for professional firms for how firms split that decision.

A chatbot on the firm's website

Prospects type questions, sometimes including their circumstances. Those prospects are not yet customers, but the chat log may hold personal and financial details. Decide whether the bot may collect any identifying details, whether chats are kept, and who can read them. If the vendor stores transcripts, put it in the inventory with a note on who is permitted to see them.

An outsourced paraplanner using their own AI tools

A freelancer who prepares reports for you is a service provider, and so are the tools they use on your clients' data. Ask which AI tools they use, whether client data enters them, and whether they accept the same 72-hour term. Put the answer in their engagement terms, and review it each year with the rest of the file. The first-90-days plan for a small law firm has a rollout sequence that adapts well to an advisory practice.

A quick sum for the cost of doing this

Illustratively, a firm with eight in-scope tools spends about 45 minutes per vendor on the first file (find terms, request the breach-notice confirmation, save evidence): roughly six hours. The annual refresh is closer to 20 minutes per vendor, under three hours. Add a half-day to write the three policy pages the first time. Compared with the cost of an incident with no file behind it, that is small, and whether your business insurance covers AI mistakes is worth checking alongside it, but it does need an owner and a date in the diary.

Mistakes that show up under review

• Marketing pages as evidence. A "bank-grade security" banner proves nothing. Keep terms, data-processing pages and written replies.
• One-off diligence. A 2024 screenshot of terms that have since changed. Put review dates in the inventory and set calendar reminders.
• Treating the 72 hours as your deadline. It is the vendor's deadline to tell you. Yours is 30 days to tell clients.
• Forgetting add-ons and browser extensions. Staff install grammar and summary extensions that read every page, including the client portal.
• No exit plan. You cannot show deletion if you never asked for it.

Checking it worked: a half-hour self-test

Once a quarter, pick one in-scope AI vendor and try to answer these without searching your inbox: who owns the relationship; when was it last reviewed; what do the terms say about training, retention and breach notice; where is the evidence; what would you do in the first hour of an incident; who would write the client notice. If you stumble on two or more, fix the file, not the answer. Also sample a week of staff activity for approved-tool use, with the staff member's agreement and in line with your own monitoring policy.

If you would like help turning your tool list into a vendor map before the next exam, that is the kind of thing my AI implementation consultation covers, alongside your compliance adviser.

Regulation S-P and AI vendor questions

Is an AI note taker a service provider under Regulation S-P?

If it receives, maintains, processes or is permitted access to customer information through services it provides to your firm, the rule's definition of a service provider covers it. A meeting recorder that hears client names, accounts and balances meets that description. Treat it like your custodian portal or CRM: due diligence, monitoring and a breach-notice term.

Does the rule require a written contract with every vendor?

No. The SEC dropped the proposed written-contract requirement and instead requires written policies and procedures for oversight, due diligence and monitoring. The adopting release still suggests firms consider whether a contract recording both sides' expectations is appropriate, and a contract or terms clause is the easiest way to evidence the 72-hour notice you expect.

Do the amendments apply if I use only ChatGPT or Claude on a business plan?

Yes, if client information goes into it. Using a business plan that does not train on your content is a good control, but the vendor is still a service provider handling customer information. Your policy should say what may be entered, who has accounts, and how you would learn of a breach at the vendor.

What if I never enter client names into AI tools?

Then the exposure is smaller, but 'never' needs evidence: a written rule, staff attestation and a check of what actually gets pasted. Meeting transcripts, email assistants and CRM features can touch customer information without anyone typing a name. Record the decision, because examiners ask how you know.

Further reads

• AI Governance Checklist for Small Financial Advice Firms — A wider AI governance checklist for small advice firms.
• Can Financial Advisers Use ChatGPT? What Compliance Allows — What compliance allows when advisers use ChatGPT.
• AI Security Risks for Small Businesses and How to Close Them — The security risks behind a vendor's breach-notice promise.
• AI Compliance Checklist for Small Businesses: What Applies to You — The general compliance checklist for any small firm.
• Can AI Draft a Suitability Report That Passes Compliance Review? — AI drafting inside client reports, and what review it needs.
• Can Lawyers Use AI Note Takers in Client Meetings? — Note takers raise the same confidentiality questions.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: SEC final rule release 34-100155 (Regulation S-P amendments, adopted 16 May 2024, published in the Federal Register 3 June 2024), including its compliance-period section and larger-entity table; eCFR 17 CFR 248.30 (current text); OpenAI and Anthropic pages on business-plan data use. This is not legal advice.