Can RIAs use AI under the SEC Marketing Rule?
The short answer: Yes — with proper controls. The SEC Marketing Rule (Rule 206(4)-1, enforced since November 2022) is content-agnostic: it applies to all RIA advertising regardless of whether a human or AI drafted it. The compliance obligations are the same. What changes with AI is the operational workflow — firms need a CCO review gate, full archiving of the AI prompt-and-draft audit trail, substantiation for any performance claims, and an archiving platform that captures it all for the 5-year retention window.
This page explains the four criteria for SEC-compliant AI use, the four most common mistakes RIAs make, what a compliant AI + archiving stack actually looks like, and the five questions every CCO should ask an AI vendor before approving it for firm use.
The four criteria for SEC-compliant AI use at an RIA
If the AI workflow does not meet all four, the firm is exposed on SEC Rule 206(4)-1, Rule 17a-4, or both — regardless of how good the tool is.
CCO review before publication
Every AI-generated piece that will reach clients or prospects must be reviewed by the CCO (or designated supervising principal) before it is sent. No "auto-publish" of AI output to any client communication channel. Documented review trail required.
Full archiving for Rule 17a-4 + FINRA 4511
Final communication, AI prompts, intermediate drafts, CCO review comments — all archived in a non-rewritable, non-erasable (WORM-compliant) system for 5 years (SEC) or 6 years (FINRA). Integration with Smarsh, Global Relay, Hearsay, or equivalent required.
Substantiation files for any performance or testimonial claims
Every performance number, testimonial, endorsement, or third-party rating that appears in AI-generated content must have substantiation data in the firm's files before the content ships. AI drafts that include unsubstantiated claims get flagged and edited out during CCO review.
Fair and balanced presentation standards
The Marketing Rule prohibits statements that are untrue, misleading, or not presented in a fair and balanced manner. AI-generated content is prone to overstatement, unqualified predictions, and inadvertent performance projections — CCO review specifically tests for these. Firms need a review checklist that treats AI drafts as higher-risk for these violations until track record is established.
The four most common mistakes
Each is an SEC Marketing Rule violation, a Rule 17a-4 archiving gap, or both. Each has shown up in firms we have looked at.
❌ Advisors using consumer ChatGPT to draft client newsletters without CCO review
An advisor drafts the Monday market commentary using consumer ChatGPT, lightly edits it, and sends directly to the client distribution list. No CCO review. No prompt archive. Marketing Rule violation on the unsupervised advertisement plus Rule 17a-4 gap on the missing audit trail. Remediation: implement a draft-review-archive workflow using CCO-integrated tooling.
❌ Archiving the final email but not the AI prompts and intermediate drafts
The firm archives outbound client emails but treats the AI drafting process as "just a tool" not requiring archiving. On exam, the SEC asks for the full draft-review audit trail for a specific piece and the firm can't produce it. Remediation: extend archiving scope to cover AI prompts, intermediate drafts, and CCO review comments as part of the permanent record.
❌ AI-generated performance claims without substantiation files
ChatGPT drafts copy including phrases like "our clients consistently outperform the market" or "we've helped hundreds of families retire comfortably." These are performance and testimonial-adjacent claims requiring substantiation under the Marketing Rule. The firm ships the copy without the underlying data in files. Remediation: CCO review checklist must flag performance/testimonial language for substantiation check before publication.
❌ Assuming "editorial AI" doesn't trigger the Marketing Rule
The firm uses AI to "just polish" blog posts or "just help with grammar" on social media captions, assuming minor AI involvement doesn't trigger full Marketing Rule compliance. SEC interpretation treats any communication shared with clients or prospects as an advertisement regardless of AI's role in production. Remediation: apply the same review/archive workflow to AI-assisted content as to fully AI-generated content.
What an SEC-compliant AI + archiving stack looks like
Described at the category level — specific vendors change. The Caidance Financial Services playbook names current best-in-class tools in each category with pricing and compliance status.
Communications archiving platform
The foundation. Smarsh, Global Relay, Hearsay Systems, Erado, or equivalent. Must support WORM-compliant storage, full-content search, and supervision workflows. Non-negotiable for any RIA regardless of AI use.
AI drafting tool with archiving integration
Options include: enterprise LLM APIs (Anthropic Claude via AWS Bedrock, Azure OpenAI, OpenAI API) wired into a custom draft-review-archive workflow; or RIA-specific AI platforms (FMG Suite AI, Catchlight, Hearsay Content) that ship with built-in compliance workflow. Category spans "build your own" through "buy a compliant turnkey."
CCO review tooling
Pre-publication supervisory review infrastructure integrated with the archive. Some archiving platforms (Smarsh, Hearsay) include native pre-review workflows; smaller firms often use shared inboxes or dedicated compliance platforms like MyComplianceOffice for the review gate.
Substantiation file management
Every performance number, testimonial, and third-party rating referenced in published content must have substantiation available in the firm files. Organized folder structure or compliance-management platform; the operational pattern is to link each published piece to its substantiation set at archive time.
What this stack deliberately excludes
Consumer ChatGPT, consumer Claude, consumer Perplexity without enterprise compliance wrappers — all unsuitable for RIA drafting workflows because they lack archiving integration. Also excluded: personal email accounts for client communication (a perennial exam finding), any tool that cannot produce WORM-compliant records on demand.
Five questions your CCO should ask every AI vendor
Get each answer in writing. Hesitation on any of these is disqualifying for firm use.
- Does your tool integrate with our archiving platform (Smarsh / Global Relay / Hearsay / other)? — without native integration, every AI draft requires manual capture into the archive, which is error-prone and audit-risky
- Does the tool preserve the full draft history for Rule 17a-4 audit? — the AI prompts, intermediate drafts, and CCO review comments all need to be in the permanent record, not just the final output
- What retention settings meet the 5-year (SEC) or 6-year (FINRA) requirement? — tool defaults are often 30 or 90 days; firms must configure for their jurisdiction's actual retention period
- Does the tool flag testimonial / performance / projection language that triggers substantiation requirements? — AI-generated copy is prone to unsubstantiated performance claims; ideally the tool or workflow catches these before CCO review
- Is there a pre-publication CCO review gate built in? — or will we need to layer one ourselves? Firms that layer the review externally need explicit workflow documentation for their compliance program
Frequently asked questions about SEC Marketing Rule and AI
What is the SEC Marketing Rule?
The SEC Marketing Rule (Rule 206(4)-1 under the Investment Advisers Act) was adopted in December 2020 and has been enforced since November 4, 2022. It consolidated and replaced the prior Advertising Rule and Cash Solicitation Rule, creating a single modern framework governing how registered investment advisers (RIAs) communicate with clients and prospects. The rule covers advertisements, testimonials, endorsements, third-party ratings, performance presentations, and hypothetical performance — and critically, it applies to all of those regardless of how the content was created, including AI-generated content.
Does the SEC Marketing Rule apply to AI-generated content?
Yes. The Marketing Rule is content-agnostic — it applies to any communication made by or on behalf of an RIA that qualifies as an advertisement, regardless of whether the content was drafted by a human, co-authored with AI, or fully AI-generated. The same substantiation, fair and balanced presentation, and recordkeeping requirements apply. Using ChatGPT to draft a market commentary email does not change the RIA firm's obligations — it only changes the tools used to produce the content that gets sent.
Can I use ChatGPT to write my RIA newsletter?
Yes, with the right controls. The firm's CCO (or designated supervising principal) must review every AI-generated piece before it is sent to clients or prospects. The firm must archive the final communication for at least 5 years per SEC Rule 17a-4 and FINRA Rule 4511. Any performance claims, testimonials, or predictions in the AI draft must be substantiated with supporting documentation in the firm's files. The convenience of AI drafting does not reduce the compliance burden — it shifts review time from writing to editing plus an expanded archiving footprint.
How do I archive AI-drafted content for SEC Rule 17a-4?
SEC Rule 17a-4 and FINRA Rule 4511 require broker-dealers and registered investment advisers to preserve electronic records of communications with clients for at least 5 years (6 for FINRA members) in a non-rewritable, non-erasable (WORM-compliant) format. For AI-generated content, the firm should archive: the final communication as sent, the AI prompts and drafts (as a paper trail showing CCO review), and any substantiating documents referenced in the content. Most RIAs use archiving platforms like Smarsh, Global Relay, or Hearsay integrated with their email and communications systems.
What about testimonials and performance claims in AI-generated posts?
The Marketing Rule permits testimonials and endorsements under specific disclosure conditions (including whether the person was compensated and whether there is a material conflict of interest). For performance claims, firms must maintain substantiation records — the underlying data supporting every performance number, presented on a net-of-fees basis for most contexts, with appropriate time periods. AI-generated content does not get a pass on any of these requirements. If ChatGPT drafts a newsletter mentioning "our clients often outperform the market," the firm needs substantiation data backing that claim or must remove it before publication.
Do I need CCO review on every piece of AI-generated output?
Yes, before it goes to clients or prospects. The CCO review gate is the single most important operational control when RIAs use AI for marketing. Firms that route AI-generated drafts directly to client communication channels without CCO review are exposed to both Marketing Rule violations (unsupervised advertising) and archiving failures (missing draft history audit trail). In practice, the Caidance Financial Services playbook routes AI through a "draft → CCO review → approve → archive → send" workflow that takes no longer than the traditional human-written equivalent, with more consistent compliance.
What is the penalty for a Marketing Rule violation involving AI?
SEC enforcement has been active since the rule took effect in November 2022. Penalties include cease-and-desist orders, censures, disgorgement of any benefits from the violation, and civil penalties (the SEC has issued fines in the tens of thousands to millions of dollars for Marketing Rule violations, depending on severity and firm size). State securities regulators also have parallel enforcement authority. The SEC's recent examination priorities have explicitly called out AI-generated communications as an area of focus, so firms using AI without proper controls face elevated examination scrutiny.
Does this apply to blog posts vs. email campaigns vs. social media?
Yes across all three, but with different operational implications. Emails: every communication that qualifies as an advertisement must follow the Marketing Rule. Blog posts: public-facing content visible to clients and prospects is an advertisement under the rule. Social media: posts, shares, and comments from firm or representative accounts can qualify as advertisements. The FINRA guidance on social media (Regulatory Notices 10-06 and 11-39) provides additional recordkeeping requirements for any firm subject to FINRA jurisdiction. AI-generated or AI-assisted content in any of these channels triggers the same compliance obligations as human-written content — the channel matters for archiving tool selection, not for whether the rules apply.
Related Caidance references
- Financial Services industry page — the 10 AI-era fixes for RIAs, each with a Marketing-Rule-aware playbook
- How to measure AI-era readiness — the category-defining reference with the 5 signal categories AI engines evaluate
- Caidance Discovery Index (CDI) — the 0–60 readiness framework
- HIPAA-safe AI — the equivalent compliance-depth reference for medical and dental practices
- Free 5-minute assessment — your firm's current CDI + top 3 priority fixes