AI and the SEC Marketing Rule: What Financial Advisors Can and Cannot Automate
AI can draft a client letter, a market commentary, or a LinkedIn post in seconds. For a registered investment adviser, every one of those outputs can also be an advertisement, a regulated communication, or a record you must keep. Here is a practical way to think about it.
The short version: AI does not change your obligations, it speeds up the way you can break them. The SEC Marketing Rule applies to AI-written advertising exactly as it applies to anything else, you are responsible for what goes out, and the output may need to be retained. Build in human compliance review before anything is published or sent. This article is general information, not legal or compliance advice.
The rules that matter most here
- The SEC Marketing Rule (Rule 206(4)-1 under the Advisers Act). It governs advertisements by registered advisers, including testimonials, endorsements, third-party ratings, and performance claims. Its general prohibitions include untrue statements, unsubstantiated material statements of fact, misleading implications, and presenting benefits without fair and balanced treatment of risks.
- Books and records (Rule 204-2). Advisers must keep copies of advertisements and certain communications for the required period. If AI tools produce or handle those materials, you need to know where the records live.
- Regulation S-P (privacy and safeguarding). The SEC amended it in 2024 to add incident response and customer-notification requirements, with phased compliance dates depending on firm size. Confirm the date that applies to your firm.
- FINRA rules for broker-dealers. FINRA Regulatory Notice 24-09 (2024) reminded member firms that existing communications, supervision, and recordkeeping rules apply to generative AI, including to its use in drafting communications.
"AI washing" is already an enforcement issue
In March 2024 the SEC announced settled actions against two investment advisers, Delphia (USA) Inc. and Global Predictions Inc., for making false and misleading statements about their use of artificial intelligence. The point for your firm is two-sided: do not overstate what your own AI can do in marketing, and do not assume a vendor's claims about its AI are accurate. If you say your process uses AI, be able to substantiate it.
Where AI helps, and the guardrail for each
- Educational content and blog posts. Good use of AI for first drafts. Guardrail: a person verifies every factual statement, removes performance and guarantee language, and sends it through your normal advertising review.
- Lead-generation tools. Retirement and planning calculators can educate prospects and start conversations. Guardrail: clear assumptions and disclosures, no projected returns presented as expected results, and review of how outputs are worded.
- Client communications and meeting prep. Drafting quarterly letters and preparing meeting briefs saves real time. Guardrail: the adviser reads and approves everything, and the final version is archived.
- Meeting notes and summaries. AI note-takers are convenient but create records and can capture sensitive data. Guardrail: confirm recording and consent rules, where the transcript is stored, and whether it falls under your recordkeeping policy.
- Social media. AI can draft posts. Guardrail: testimonials, endorsements, and performance references have specific requirements under the Marketing Rule, so route these through compliance.
What not to automate
- Anything that presents performance, past or hypothetical, without compliance review.
- Testimonials and endorsements, including generating or "improving" client reviews. Never fabricate or edit them.
- Personalized investment recommendations or suitability and fiduciary judgments.
- Sending client communications without a human approving the final text.
Client data and vendors
Client names, account details, and financial information should not go into a tool you have not vetted. Before using any AI vendor, ask where data is stored and processed, whether it is used for model training, how long it is retained, who can access it, and what security reports and contract terms the vendor provides. These are the same questions your vendor-oversight and cybersecurity policies should already require.
A simple policy to adopt now
- List the approved AI tools and what each is permitted to be used for.
- Prohibit client-identifying data in any unapproved tool.
- Require compliance review of AI-assisted advertising and mass communications before use.
- Decide where AI-assisted drafts and final versions are archived.
- Train staff, and review the policy at least annually.
Where Truvaldi fits
We build AI tools for financial advisors, such as calculators, assessments, and client-communication workflows with a human approval step, and the supporting financial advisor SEO. See our Saguaro Ridge case study for an example of workflow automation with compliance pre-review. We do not provide legal or compliance advice. Have your chief compliance officer or counsel review how any tool fits your obligations.
Elija leads security and compliance strategy at Truvaldi. As a CISSP-certified practitioner, he architects HIPAA-aware AI systems for medical, aesthetics, and financial practices — and delivers the Security Risk Assessments that keep them audit-ready.
Frequently asked questions
Does the SEC Marketing Rule apply to AI-generated content?
Yes. The rule applies to advertisements by registered investment advisers regardless of how they are produced. The adviser is responsible for the content, so AI-generated advertising has to meet the same standards as anything written by a person and should go through your compliance review.
Can financial advisors use ChatGPT?
Advisors can use AI tools, but client-identifying information should not go into a tool that has not been vetted, and anything that is an advertisement or client communication needs the same review and record retention as usual. Many firms adopt an approved-tools policy.
What is AI washing?
It is making false or exaggerated claims about a firm's use of artificial intelligence. In March 2024 the SEC announced settled actions against two investment advisers for misleading statements about their AI use, so any claim about your own AI capabilities should be accurate and substantiated.
Do AI-generated client communications need to be archived?
Recordkeeping rules apply to the communications and advertisements themselves, so the final versions generally need to be retained under your policy. Also decide how to handle drafts, prompts, and AI meeting transcripts, and confirm with your compliance officer.
Is a retirement calculator on my website an advertisement?
It can be, depending on how it is used and presented, so have your compliance officer review it. Pay particular attention to assumptions, disclosures, and any outputs that could read as projected or hypothetical performance.
Want AI tools your CCO can approve?
We build advisor tools with a human approval step and clear data boundaries, with security review led by a CISSP-certified practitioner.