Supervision, AI Washing, and What the Client Is Paying For

The governance question that comes before every other one is whether the tool sits inside or outside the firm's supervised environment, and most firms discover the answer late.

An advisory firm operates a supervisory system: communications are captured, records are retained for prescribed periods, and someone is responsible for reviewing them. That system was designed around email, telephone and approved messaging platforms.

A generative AI tool used for client work creates communications and work product that may fall within the same requirements. If an advisor works through a client's position in a chat window, that exchange concerns advice, involves client information, and lives somewhere the firm's retention system does not reach.

This is structurally the same problem as off-channel communications, which regulators have pursued firms over at significant scale. The difference is that off-channel messaging was obviously a channel. A chat window feels like a tool, more like a calculator than like a conversation, and the categorisation error follows from that feeling.

FINRA's Regulatory Notice 24-09 makes the position explicit: the supervision obligation under Rule 3110 applies whether the firm develops the tool itself or uses a third party's, including AI features embedded in existing products.

The practical consequence. The first decision is procurement, not usage. Which tools are approved, do they retain in a way the firm can access, and is the output reviewable. An advisor using a personal account for client work has created a supervision gap regardless of how good the output is.

The confidentiality problem in this profession is more acute than in most, because of what advisors hold.

A client file typically contains a complete financial picture: net worth, income, debts, tax position, account numbers, and identity documents. Alongside that sits information that is sensitive for entirely non-financial reasons: a diagnosis that changed a retirement plan, a divorce, an estranged child excluded from an inheritance, a business in difficulty.

That combination is unusually valuable to an attacker and unusually damaging if disclosed.

The regulatory frame in the United States includes Regulation S-P, which requires policies and procedures to safeguard customer records and information, and which the SEC amended in 2024 to add incident response and customer notification requirements. In Europe the GDPR applies with financial data attracting particular scrutiny.

The failure mode is mundane rather than dramatic. An advisor pastes a client's full position into a consumer chat tool to get a second view on the allocation. Nothing goes wrong visibly. The data has left the firm, may be retained, and under some consumer terms may be used to improve the service.

The practical controls, in order. Use firm-procured tools with terms that address retention and training use. Minimise what you paste: most analytical questions do not need names, account numbers or identity documents. And keep a hard category list of what never goes into any external tool, whatever its terms.

And note that this exposure is invisible. Nobody complains, and it accumulates quietly across a practice.

There is one area where regulators have already acted specifically on AI in this sector, and it is not about how firms use the technology. It is about what they claim.

On 18 March 2024 the SEC announced settled charges against two investment advisers, Delphia (USA) Inc. and Global Predictions, Inc., for false and misleading statements about their use of artificial intelligence. Delphia paid a civil penalty of 225,000 dollars and Global Predictions 175,000 dollars. The SEC's charges included violations of the antifraud provisions of the Advisers Act, the Marketing Rule, and the Compliance Rule for failing to implement policies reasonably designed to prevent the violations.

The conduct is instructive. Delphia was charged with advertising that it used AI to analyse client data and predict investment trends when, according to the SEC, it had not used client data in that way and had not built the algorithm described.

The pattern this establishes, often called AI washing, is that describing a capability you do not have is an ordinary misstatement case. No new rule was required. The Marketing Rule's prohibition on untrue statements of material fact and its substantiation requirement were sufficient.

The practical rule for a practice. You may say what you actually do. We use AI to prepare meeting documentation is fine if true. Our AI analyses market data to optimise your portfolio requires that something meeting that description exists and that you can substantiate it on demand.

And the inverse holds. Understating is safe. Overstating is an enforcement matter.

Advisors ask whether they must tell clients that AI is used in the practice, and the answer separates into cases that are frequently conflated.

Where disclosure is required or close to it. Recording a client meeting, which requires consent and in some jurisdictions the consent of all parties. Any system interacting directly with a client, which under Article 50 of the EU AI Act requires that the person be informed they are dealing with an AI system where that is not obvious, applying from 2 August 2026. And any material conflict of interest arising from how a tool is used, which is disclosable under the ordinary fiduciary duty of loyalty rather than under any AI rule.

That third one is the underrated case. If a tool's output is influenced by an arrangement between the vendor and a product provider, that is a conflict, and it is disclosable on exactly the same basis as any other conflict.

Where disclosure is not required. That drafting assistance was used in preparing a letter you reviewed and adopted. Clients do not expect an advisor to have personally typed every word of a review document, and the disclosure signals anxiety without informing anything.

The test that separates them. Would this change the client's assessment of the advice or the relationship. A conflict changes it. A recording changes it. A drafting tool the advisor reviewed does not.

And note the asymmetry with the previous step. You need not advertise your AI use. If you do advertise it, it must be true and substantiated.

A sequence for evaluating any AI use in an advisory practice, in the order the questions actually bind.

First, capture. Does the tool sit inside the firm's retention and supervision system. If not, nothing else matters, because usage creates a gap regardless of quality.

Second, data. What client information enters it, under what terms, and does the arrangement satisfy the safeguarding obligation. This is where a technically approved tool can still be used wrongly.

Third, output. Does anything reach a client or the file without a person adopting it. If yes, that is the point to fix, because the advisor is asserting whatever goes out.

Fourth, claims. Does the firm describe this capability externally, and can every description be substantiated on demand. This is the question that has actually produced enforcement.

The ordering matters. Firms tend to start at the third question, because output review feels like the responsible thing to do, and it is. But an approved review process on a tool that sits outside the supervisory perimeter fixes the visible problem and leaves the structural one.

The structural question for the profession is what happens as the analytical and administrative layers get cheap, and it is worth being precise about which part is exposed.

Automated portfolio management has existed at scale for over a decade and has taken the part of the business that was purely allocation and rebalancing. That process is largely complete, and the advisors it displaced were the ones whose service was portfolio construction alone.

What generative tools compress is different: the documentation, the explanation, the preparation, the research digestion. That is a cost reduction inside the practice rather than a substitution for it.

The part that resists both is planning and behaviour. Deciding whether to take the pension as income or a lump sum given a specific family situation. Working out whether the client can afford to help their son with a deposit without compromising their own retirement. Talking someone out of liquidating in a falling market.

That last one is the clearest case. Research on investor behaviour, including the long-running work on the gap between fund returns and investor returns, consistently finds that investors underperform the funds they hold because of the timing of their own purchases and sales. The methodologies are debated and the size of the gap varies by study, but the direction is well documented. An advisor who prevents one badly timed exit has justified years of fees, and the mechanism by which they do it is a relationship, not an analysis.

So the fee compresses toward what it was always actually for.

Naming precisely what is not substitutable, because that is what the fee is for and it is a shorter list than advisors assume, but a solid one.

An accountable party. A client who is badly advised has someone to hold responsible, professionally, and through a regulator, and often through insurance. That accountability is a substantial part of what is purchased, and no system provides it.

Judgement across domains that do not connect cleanly. A retirement decision touches tax, pensions, estate planning, family dynamics and the client's own health, and the right answer is a compromise between them rather than an optimum in any one. This is exactly the shape of problem that resists automation, because the objective function is not stated anywhere.

Knowing what the client actually wants. Covered in lesson two, and worth restating: the stated objective and the real objective differ, and the reconciliation happens in conversation.

Behavioural intervention. Being the person who is called before the panicked sale, and being trusted enough that the call happens.

And continuity. A relationship that spans decades, holds the history of why decisions were made, and knows the family. That accumulated context has no substitute, and it is why advisory relationships are unusually long.

The pattern matches the other profession cursus in this catalogue: production compresses, judgement and accountability do not. What is distinctive here is that the regulation has already drawn the line explicitly, which makes the boundary easier to see than in professions where it is only a matter of practice.

What a small advisory firm can write down, which is the realistic form of governance below the scale that has a compliance department.

Approved tools. A named list. Client work happens only on tools from that list, and the list is chosen for retention, supervision access and data terms rather than for output quality. Personal accounts are not used for client work.

Client data. A category list of what never leaves the approved environment: identity documents, account numbers, and anything about a client's health, family circumstances or financial difficulty. Minimise what is supplied for any analytical question.

Calculation. Numbers come from the planning system, the portfolio system or the spreadsheet. A language model explains a number, it does not produce one.

Meetings. Recording with consent, obtained at the start. The transcript is a client record. The generated note is reviewed for misattribution and compressed caveats before it is filed.

Client-facing output. Reviewed and adopted by the advisor before it goes out. Anything meeting the definition of an advertisement goes through normal marketing review with substantiation for each material claim.

Recommendations. Made by the advisor. A model may inform the analysis and draft the explanation, and the named person owes the duty.

Claims. The firm describes only what it actually does, and each description is substantiable on demand.

Seven paragraphs, and every one of them derives from an obligation that already existed before any of these tools did.