Advisor Perspectives

Who Reviews the Draft? How RIAs Can Supervise AI-Drafted Client Materials

Knowing where your firm uses AI is step one. Step two is deciding what happens to an AI draft before a client ever reads it: who checks it, what they check, and what record you keep.

AdvisorPilot

In our last piece we argued that every firm should start with an AI inventory, because you cannot supervise a tool you have never written down. Once the list exists, a harder question shows up right behind it. The tools on that list are producing words that end up in front of clients: meeting recaps, follow-up emails, review summaries, plan narratives, the paragraph that explains why a portfolio looks the way it does. What happens to those words between the moment a tool drafts them and the moment a client reads them?

Our short answer is one rule with three parts. Every AI draft that could reach a client has a named human reviewer, a defined check that reviewer actually performs, and a record of what was finally sent. The rest of this piece is about making that rule concrete enough to follow on a busy Tuesday. It is educational, not legal or compliance advice. Your CCO and counsel decide what your policy requires.

Why is supervision of AI drafts on examiners' radar?

Because the SEC has said so in two consecutive years of exam priorities. The Division of Examinations' Fiscal Year 2026 priorities, released November 17, 2025, said the Division "will review for accuracy registrant representations regarding their AI capabilities or AI" and "will assess whether firms have implemented adequate policies and procedures to monitor and/or supervise their use of AI technologies."

The Fiscal Year 2027 priorities, announced October 23, 2026, use the term "super intelligence (SI)" and name the exact work this piece is about. Registrants, the Division writes, are using generative SI tools "to support research, drafting, coding, and client communications." It says it is working to understand "whether firms continue to comply with existing, technology-neutral obligations," and that it will prioritize examinations of "policies and procedures relating to monitoring SI."

Drafting and client communications, measured against obligations that do not care whether a person or a tool wrote the first version. That is the frame. The question is not whether your firm is allowed to use AI to draft. It is whether your existing duties still hold when it does.

Do AI-drafted client emails need review?

If the email goes to a client, treat it as if someone on your team wrote it, because in practice someone on your team is sending it. The tool does not sign the email or owe the client anything. The firm does.

That does not mean every AI output needs the same review. A sensible standard sorts material by where it goes and what it could do:

• Internal notes. Meeting notes and prep summaries that stay inside the firm. The advisor who uses them checks them against what actually happened. The risk is a wrong fact that later leaks into something client-facing, so the check is accuracy.
• One-to-one client emails. Recaps, follow-ups, scheduling notes. The sending advisor reviews every one before it goes. The risk is a misstated number, an implied promise, or a commitment nobody intended to make.
• Plan and review summaries. Narrative explanations of a client's situation, projections, or portfolio. The advisor reviews, and your policy may call for a second set of eyes on anything that discusses performance or projections.
• Anything sent to more than one person. Newsletters, market commentary, website copy, social posts. These are where the marketing rule may come in, which deserves its own question.

Does the marketing rule apply to AI-written content?

The rule does not ask who or what wrote the words. Under Advisers Act Rule 206(4)-1, an advertisement includes any direct or indirect communication an adviser makes to more than one person that offers its investment advisory services (and, if it includes hypothetical performance, even a communication to one person). Nothing in that definition turns on authorship. If an AI-drafted piece meets it, the same standards apply as if a person had written it: no untrue statements of material fact, no material statements of fact the adviser cannot substantiate on demand, and the performance presentation requirements where performance appears.

This is also where AI drafts carry a particular risk. Generative tools are fluent, and fluent text slides easily into confident claims: "proven," "guaranteed," "consistently outperforms." The SEC has already shown it takes misleading statements about AI itself seriously. On March 18, 2024, it settled charges against two advisers, Delphia and Global Predictions, for false and misleading statements about their use of AI, with civil penalties of $225,000 and $175,000. Those cases were about what firms said about AI, not text AI wrote, but the lesson carries over: what goes out under your name has to be true and supportable.

Quick Q&A

Q: Is an AI-written recap to a single client an advertisement?

A: A one-to-one recap is generally not a communication to more than one person, but the definition has nuances, including for hypothetical performance. Your CCO decides how your firm classifies each type.

Q: If the tool vendor says its output is compliant, can we skip review?

A: No vendor statement moves your obligations to the vendor. The firm is still the one communicating with the client.

Q: We are dually registered. Does FINRA see this differently?

A: For broker-dealer activity, FINRA's Regulatory Notice 24-09 (June 27, 2024) reminds member firms that its rules are "intended to be technology neutral" and continue to apply when firms use generative AI, just as they apply to any other technology. Supervision and communications rules do not pause for a new tool. For an adviser-only firm, the SEC text above is the reference point.

What should a reviewer check?

A review that consists of skimming for typos is not a review. Give reviewers a short, repeatable list:

1. Facts against the source. Names, dates, account types, and what was actually said in the meeting. AI recaps can merge two conversations or invent a detail that sounds right.
2. Numbers. Every figure ties back to the system or statement it came from. Balances, returns, contribution amounts, and dates are the most common errors.
3. Promises and commitments. Look for anything that sounds like a guarantee, a prediction, or an action item the advisor never agreed to.
4. Performance language. Any mention of returns, outperformance, or projections gets the closest read, and goes to whoever your policy names for it.
5. Tone and fit. Does it sound like your firm and suit this client? A cheerful recap after a hard conversation about a death in the family is its own kind of error.
6. Disclosures. Whatever your policy requires to travel with this type of material is attached.

The checklist only works if the draft cannot reach the client before someone runs it. That is a design choice as much as a policy one. In AdvisorPilot, for example, Flight Deck and Advisor Toolbox drafts stay drafts until the advisor reviews and sends them, so the review step is built into the path rather than left to memory.

Who signs off?

Name a person, not a role on paper. For one-to-one client communication, that is usually the advisor who sends it. For material that may be an advertisement, or anything with performance in it, your policy may route it to a principal or the CCO before it goes. Write down which material types need which reviewer, and keep the list short enough that people actually follow it. A rule that says "compliance reviews everything" tends to become a rule that nobody follows.

The sign-off also needs to be visible later. If an examiner asks how a given email was reviewed, "the advisor always reads them" is a weaker answer than a record showing who sent it and when.

What records should you keep?

The books and records rule, Rule 204-2, already requires advisers to keep copies of written communications sent relating to, among other things, advice and recommendations, and to keep copies of advertisements they disseminate. Records generally must be preserved in an easily accessible place for at least five years. The rule does not have a separate track for AI. What was sent is what you keep.

Two practical points follow. First, the record that matters is the final version the client received, not the draft the tool produced, so make sure the sent version is captured, not just the working copy. Second, a record is only useful if it cannot be quietly changed later. In AdvisorPilot, for example, generated reports are kept in WORM (write once, read many) storage for six years. That is one piece of a record-keeping program, not the whole of it: whether it, or any tool, meets your firm's Rule 204-2 obligations is a question for your CCO and counsel.

Putting it together

The inventory tells you where AI drafts. The supervision rule tells you what happens next: every draft that could reach a client has a named reviewer, a defined check, and a record of what was sent. Start with the material that carries the most risk, usually anything going to more than one person or mentioning performance, and work down. Revisit the standard when you add a tool to the inventory, because a new tool usually means a new kind of draft.

None of this requires an AI-specific rule. The SEC's FY2027 priorities describe firms' existing obligations as technology neutral. The work is making sure the person who sends the email is still the person who stands behind it.

This article is educational and is not legal, compliance, or investment advice. Your CCO and counsel decide what your policy requires.