Can Financial Advisors Use ChatGPT? AI Privacy for RIAs and Wealth Managers

_Last updated: 2026-07-14_

If you are a registered investment advisor or wealth manager pasting a client's account statement into ChatGPT to summarize it, you are very likely creating a regulatory problem — not just a privacy one.

Client account numbers, balances, holdings, and financial goals are nonpublic personal information under SEC Regulation S-P. Sending that data to a consumer AI chatbot means it is processed and potentially retained on a third party's servers that your firm has no data processing agreement with, no audit rights over, and no ability to compel deletion from. That is exactly the kind of disclosure Reg S-P's safeguards rule and FINRA Rule 4511 recordkeeping obligations exist to prevent.

This is not a hypothetical compliance concern. The SEC has been increasingly focused on AI use at registered firms — its 2023 proposed AI conflicts rule and subsequent risk alerts both flag AI tool usage with client data as an exam priority. FINRA's 2026 exam priorities letter explicitly calls out generative AI as an area firms need documented supervisory procedures for. If your firm has not addressed AI in its written supervisory procedures (WSPs), that gap itself is now a finding waiting to happen.

The good news: advisors can use AI productively — for research, drafting, and portfolio commentary — without any of this risk, if the AI runs on infrastructure that never puts client data through a vendor you don't control. This guide covers the specific regulatory exposure and the practical stack that avoids it.

What Regulation S-P Actually Requires

Reg S-P's safeguards rule requires registered advisors and broker-dealers to adopt written policies reasonably designed to protect customer records and information — and to ensure that any service provider who receives nonpublic personal information (NPI) maintains appropriate safeguards too.

NPI is broadly defined: it includes account numbers, balances, transaction history, Social Security numbers, and any information a client provides in connection with obtaining a financial product or service. A client's name paired with their portfolio allocation is NPI. A prospect's income and net worth from an intake conversation is NPI.

The 2024 amendments to Reg S-P (compliance deadline extended into 2026 for smaller firms) added an incident response program requirement and tightened the definition of what counts as a reportable breach involving service providers. Feeding client data into a general AI tool that logs, trains on, or retains that input is functionally the same risk profile as handing a spreadsheet to an unvetted vendor — except most advisors don't think of it that way because there's no contract, no onboarding, no visible "sharing" action. You just paste text into a box.

The compliance question that matters: does your firm have a data processing agreement, a security assessment, and documented safeguards for every AI tool that touches client data? For ChatGPT Free, ChatGPT Plus, or Gemini's consumer tier, the answer is almost always no — those terms of service are not built for regulated-entity data handling and typically reserve broad rights to use input for model improvement.

What FINRA Rule 4511 Adds

FINRA Rule 4511 requires member firms to preserve books and records — including client communications — in a manner that meets SEC Rule 17a-4 requirements: non-erasable, non-rewriteable, and retrievable for the required retention period.

If your AI workflow involves drafting client communications, investment recommendations, or suitability documentation, those AI-assisted outputs may themselves become records subject to retention. A consumer AI chatbot with no audit log, no immutable storage, and no export function does not meet that bar. Neither does client data disappearing into a vendor's infrastructure where your firm has no recordkeeping control.

The practical implication: your AI tool choice is not just a privacy decision, it is a recordkeeping architecture decision. You need to know where inputs and outputs live, for how long, and whether you can produce them on request from an examiner.

The Three Layers of Exposure

1. The inference layer — where the AI model actually processes your prompt. Cloud-hosted consumer AI means client data leaves your firm's control the moment you hit enter.

2. The document storage layer — where client statements, account applications, and financial plans sit before and after AI touches them. Standard cloud drives (Google Drive, Dropbox, OneDrive without enterprise-grade controls) are not zero-knowledge encrypted, meaning the storage provider itself can access file contents.

3. The communications layer — how client data moves between advisor, client, and custodian. Ordinary email is not end-to-end encrypted and does not meet the confidentiality bar Reg S-P implicitly expects for NPI transmission.

Addressing only the AI tool itself and ignoring the other two layers leaves most of the actual exposure in place.

Layer 1: AI Inference That Doesn't Leave Your Firm

Local Models for Client-Specific Work

The most defensible position for any task touching actual client data — summarizing a statement, drafting a suitability note, analyzing a client's specific allocation — is a model that runs entirely on hardware your firm controls. Nothing is transmitted, so there is nothing for a third-party vendor to log, train on, or be subpoenaed for.

Ollama is the standard way to do this. It installs in minutes on a firm workstation or a dedicated Mac Mini or Windows machine, and it runs strong open-weight models — Llama 4 70B, Mistral Large 2, Qwen 2.5 72B — that handle document summarization, plain-English suitability explanations, and first-draft client letters at a quality level appropriate for advisor review before anything goes out the door. Because the model runs locally, there is no data processing agreement to negotiate: there is no data leaving to process.

For firms with several advisors, a shared local model server on firm-owned hardware — accessed only over the firm's internal network — keeps this capability available to the whole team without each advisor needing a beefy individual machine.

Perplexity Pro for Market Research and Non-Client Work

Local models are weak on anything requiring current information — market conditions, recent Fed commentary, a fund's most recent prospectus changes, sector news. For that category of research, which by definition does not involve a specific client's NPI, a web-connected AI research tool is far more useful.

Perplexity Pro is built for exactly this kind of query — "summarize the Fed's latest rate guidance," "what changed in [fund]'s Q2 filing," "compare expense ratios across these three ETFs" — and its Pro tier explicitly does not use subscriber queries to train models. The output format includes source citations, which is useful both for your own diligence and for any compliance review of how you arrived at a recommendation.

The discipline that keeps this compliant: Perplexity is for market and product research phrased generically, never for "my client Jane Smith has $2M in these holdings, what should she do." That second category stays on the local model, or off AI entirely until you've stripped identifying details.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

The workflow: client statements and financial plans live in Tresorit or Proton Drive, get pulled to a local working directory only when an advisor is actively working with them through the local AI model, and get returned to encrypted storage afterward. Nothing sits unencrypted in a general-purpose cloud drive at any point.

Layer 3: Encrypted Client Communications

A client emailing you a scanned account statement or a completed intake form over standard Gmail or an unencrypted Outlook thread has already created an NPI exposure — that data transits and rests on infrastructure your firm doesn't control, before AI even enters the picture.

Proton Mail provides end-to-end encryption automatically between Proton addresses, and password-protected encrypted messages to any external recipient, including clients on standard email. For a practice handling high-net-worth clients or particularly sensitive financial planning (divorce settlements, business sale proceeds, estate transitions), moving client-facing communication to encrypted email closes a gap that is easy to overlook because it doesn't feel like an "AI" problem — but it is part of the same NPI handling chain that regulators care about.

Custom domain support means clients see advisor@yourfirm.com, not an unfamiliar proton.me address, so the switch doesn't read as unusual to clients.

Putting the Stack Together

Market and product research (no client-specific data): Perplexity Pro for anything phrased generically — fund comparisons, rate environment summaries, sector analysis, recent filings.

Client statement analysis and suitability drafting: Local model via Ollama, running on firm-controlled hardware, working from files pulled temporarily from encrypted storage.

Client document storage: Tresorit or Proton Drive as the permanent home for statements, plans, and applications — never a standard cloud drive.

Client-facing communication involving account or planning details: Proton Mail, particularly for high-sensitivity matters.

First-draft client letters and portfolio commentary: Local model, reviewed and finalized by the advisor before anything is sent — never sent unreviewed, and never drafted in a way that surfaces raw client data to a hosted AI tool.

This structure gives you a defensible answer if a compliance officer or examiner asks how AI tools are used with client data: nothing client-specific reaches a vendor without a data processing agreement, and everything that does reach a vendor is either non-identifying or zero-knowledge encrypted in transit and at rest.

Building This Into Your WSPs

Regulators generally are not looking for firms to avoid AI — they are looking for documented, reasonable safeguards. A short addition to your written supervisory procedures covering AI tool usage should specify, at minimum:

Which AI tools are approved for use, and for what categories of task.
That client NPI may not be entered into any AI tool without a firm-reviewed data processing agreement.
Where client documents may be stored (approved zero-knowledge platforms only).
That AI-drafted client communications require advisor review before sending, and are retained per the firm's Rule 17a-4 recordkeeping policy.
An incident response step specific to AI tool misuse, referencing your existing Reg S-P incident response program.

This is a short document, but its absence is precisely the kind of gap an exam finding gets built around. Its presence — with a genuinely private stack backing it up — turns AI adoption from a compliance liability into documented due diligence.

Stay Ahead of AI Compliance Changes for Advisors

SEC and FINRA guidance on AI use is still developing, and exam priorities shift year to year. If you want tested, compliant AI workflows for advisory practices — without wading through SEC risk alerts yourself — the PrivateAI newsletter covers exactly this, with no vendor fluff.

Subscribe below to get the next issue directly.

_Running a compliant AI workflow at your firm that isn't covered here? Let us know — we test and publish practitioner-sourced stacks regularly._