AI features in advisor software: questions a small RIA should ask before turning them on
Before turning on an AI feature in advisor software, a small RIA should find out what client data the feature can see, which outside provider processes it, whether that provider keeps or trains on the data, whether the feature can change records or only answer questions, how its actions are logged, and how the vendor will notify you of a problem. Then add the provider to your vendor list, write a short staff rule for using it, and review it like any other service that handles client information.
Most advisor software now has an AI feature somewhere: a chat button, a meeting summary, a draft email. For a small firm, the question isn't whether these are clever. It's what happens to client data when someone clicks the button, and whether you could explain that to a client or an examiner.
What should you ask the vendor?
| Question | Why it matters |
|---|---|
| What client data can the feature see? | A feature that reads every client record carries more risk than one that sees a single note |
| Which outside provider processes the data? | The provider becomes another service handling your client information |
| Does the provider keep the data, or use it for training? | Retention and training settings decide where your clients' information ends up |
| Can the feature change records, or only answer questions? | A feature that can add or edit records needs clearer controls |
| Are its actions logged? | You should be able to see what was changed, when and by whom |
| How will you be told about a problem? | It should be covered by the vendor's incident notice commitment |
| Can it be turned off, per user or for the firm? | You may want it off for some staff or some tasks |
Ask for the answers in writing, as part of your Regulation S-P vendor oversight if you're SEC-registered, or your state's equivalent.
What should you put in place at the firm?
- Add the AI provider to your vendor list, with what it handles and the vendor's written answers.
- Write a short staff rule: which AI tools are approved, what data may go into them, and that general chat tools are off limits for client data unless approved.
- Review output before it counts: anything going to a client, or into a record that matters, gets a human check.
- Check the log occasionally: see what the feature changed.
- Revisit yearly, with your other vendor reviews.
A worked example
Take a hypothetical two-person RIA whose practice software adds an assistant that can answer questions about client records and add tasks. Before turning it on, the owner asks the vendor the seven questions and files the written answers with the vendor's due diligence file. The firm adds a two-line rule to its written procedures: staff may use the built-in assistant; client data never goes into general chat tools. Each quarter, during the access review, the owner glances at what the assistant changed.
What are the common gaps?
- An AI feature turned on by default and nobody asked where the data goes.
- Staff pasting client details into a general chat tool to "tidy up an email".
- AI-drafted text sent to a client without anyone reading it closely.
When is this overkill?
If you don't use any AI features, there's nothing to set up beyond a one-line staff rule about general chat tools. The moment one is switched on, ask the questions first.
How Advorra fits
Advorra has a built-in assistant, the round button on every screen, which can answer questions about your clients, trades and tasks and make simple changes such as adding a task. It runs through an AI provider on The CollabHub's own account; ask us and we'll answer the seven questions above in writing. Each firm's data is kept separate at the database level and encrypted in transit and at rest. See the product page, or read who can see your client data.
One thing to do this week: list every AI feature switched on in the tools your firm uses, and who decided to turn each one on.
A practical checklist, not legal or compliance advice.
Questions advisors ask
Is it safe to use AI features with client data?
It depends on how the feature and its provider handle data. Ask for the vendor's written answers and treat the AI provider as a service that handles client information. Your compliance consultant can advise on your obligations.
Does an AI provider count as a service provider?
If it processes your client information, it's sensible to treat it as one: add it to your vendor list and check its data handling, as you would for any other vendor.
Should staff be allowed to paste client data into general chat tools?
Many firms say no, or only into tools the firm has approved. Write the rule down so staff know where the line is.
What about mistakes the AI makes?
Treat AI output like a draft from a new assistant: review before it reaches a client or a record that matters.
Is this compliance advice?
No. It is a practical checklist. Your compliance consultant decides what your firm's policy should be.
See it on a demo firm
Advorra is practice software for independent RIAs: clients, models, IPS, billing and compliance records in one place, on top of the custodian you already use. Built by The CollabHub.
Get in touch