How to write the AI section of your written supervisory procedures

Start with an inventory

Before writing policy, list every AI tool already in use: chat assistants, notetakers, email and text drafting tools, and anything vendors have added to existing software. FINRA’s guidance focuses on supervising the AI a firm actually uses, so the inventory is the foundation.

The eight parts of a practical AI section

A clear AI section usually covers:

• Scope and definitions: what counts as an AI tool at the firm.
• Approved tools: a named list, and a rule that anything else needs approval before use with clients.
• Permitted uses: what each tool may do, such as answering approved FAQs or booking meetings.
• Prohibited uses: no investment, tax or insurance advice, no recommendations, no performance or guarantees, no sensitive account data.
• Disclosure: clients are told when they are talking to AI.
• Content approval: who approves scripts and FAQs, and how changes are reviewed.
• Supervision and testing: who reviews conversations, how often, and how the tool is tested before and after changes.
• Records and vendors: how conversations are archived, and the due-diligence file kept on each AI vendor.

Test it like an examiner would

The strongest procedures are backed by evidence. Run the AI through a written set of test prompts before launch, including attempts to get advice, performance claims or account details out of it, and keep the results. Repeat the tests whenever scripts or models change.

Keep it alive

AI tools change monthly. Assign an owner, review the approved list at least quarterly, and log every change to scripts, models or vendors. A short policy that is actually followed beats a long one that isn’t.

Common questions

Do broker-dealers need an AI policy in their WSPs?

FINRA expects firms to supervise the technology they use, so firms using AI with clients should describe those tools, their limits and how they are reviewed in their written supervisory procedures.

What should an advisor AI-use policy prohibit?

Typical prohibitions are investment, tax or insurance advice from AI, recommendations, performance claims or guarantees, sharing sensitive account data, and using unapproved AI tools with clients.

How often should a firm review its AI procedures?

At least quarterly, and whenever a tool, model, vendor or approved script changes.