Examiners do not need a rule with "artificial intelligence" in the title to write a deficiency letter. They need a written policy, an observed practice, and daylight between the two. The hooks are already in place: Regulation S-P, described in American Banker's account as the primary rule requiring advisors to protect private client data [11], and the books-and-records rule, which requires accurate records of a firm's finances, operations and dealings with clients [12]. Neither was drafted with model inputs in mind, and both now cover them.
The vendor gap is where the arithmetic gets uncomfortable. More than two thirds of the firms in ACA Group's survey have no policy at all governing third parties' AI use [17]. The same reporting says advisory firms have largely adopted internal controls to keep client data out of a public large language model, while many have not asked their outside providers to do the same [9]. That leaves a firm with a rule for its own staff and no rule for the systems those staff send files to. ACA Group president Carlo di Florio's framing is that vendors are a major potential source of AI risk, because they may be using a firm's information to train their models [10]. The remedy the consultants describe is documentary: policies stating whether outside firms may use AI at all and what they must do if a breach puts client information online [5], plus cybersecurity policies tight enough that data shared with a model cannot leak to the wider internet or to other users of the same system [4].
The notetaker question is smaller and sharper. Di Florio says it remains unsettled whether the client-meeting summaries many advisors now generate with AI are books and records at all [13]. The asymmetry favors keeping them. Retaining summaries that turn out not to be records costs storage and handling; discarding summaries that turn out to be records is a failure no firm can cure after the fact.
Di Florio says the wealth managers he speaks with are not asking for a comprehensive AI governance rule, but want to know how the rules already on the books apply and how to build controls against expectations they cannot read [15]. That vacuum has a cheap floor. Telling current and prospective clients in marketing material exactly how the firm uses AI costs drafting time [6]. Putting one person or team in charge of AI use costs a line on an org chart [7]. His blunt version of the gap: "over 50% don't have that formal policy in place, and we know that AI hallucinates and there's biases and there's errors" [16].
