What your compliance officer will ask before you use AI

Before you use AI on client work, compliance or counsel will ask seven kinds of questions. What data the AI sees, and where it goes. What it can read and change. What a person approves. What gets logged and kept. Who the vendors are. How you test and monitor it. What you tell clients. Bring a written answer to each.

This is not legal advice. Rules differ by firm type, regulator, and state. Use this guide to prepare for the meeting, then confirm every answer with your own counsel or compliance officer.

Why does compliance ask these questions at all?

Many existing rules already reach AI. The examples below show old duties still applying when a tool does part of the work.

A few examples, each in one line:

• FINRA Regulatory Notice 24-09 (June 2024) says its rules are technology neutral and still apply when member firms use generative AI. It creates no new requirements.
• The NAIC Model Bulletin on the use of AI systems by insurers (adopted December 4, 2023) expects insurers to keep a written program for AI systems that make or support insurance decisions. It covers governance, testing, and third-party oversight. Each state decides whether to adopt it.
• In March 2024 the SEC settled charges against two investment advisers for false claims about their use of AI. The charges included violations of the Marketing Rule.
• For tax preparers, 26 CFR 301.7216-3 requires a tax return preparer to get the taxpayer's written consent before return information is used or disclosed for a purpose the rules do not already permit.

So the questions below are not new. They are your existing duties, asked about a new tool.

Data: what does the AI see, and where does it go?

A good answer names the exact fields the AI reads, the systems it reads them from, and every place the data travels. "Client data" is not an answer. "Name, account type, and the last three emails in the service inbox" is.

Expect these questions:

• What data goes in? Does it include personal, account, health, or tax return information?
• Where is it processed and stored? Which vendor, which region?
• Does the AI provider use your data to train its models?
• How long does the provider keep prompts and outputs? Can you get them deleted?

What a good answer looks like: a one-page data map. It lists each field, its source, the vendor that processes it, the provider's training and retention terms, and a link to those terms. If you strip out fields the AI does not need, say so. Less data in means fewer questions.

Access: what can the AI read and change?

The best first answer is "read-only, scoped to one folder or one queue." Compliance relaxes when the AI cannot change anything on its own.

Questions to expect:

• Does it have read access, write access, or both?
• Which systems, which records, which users' data?
• Whose credentials does it use? Can you turn it off in one step?

A good answer separates reading from acting. The AI may read the CRM to draft a reply. It may not edit the client record. If it needs write access, name the one field or action and who approves it.

Approvals: what does a person sign off on?

A person approves anything that goes to a client, moves money, or changes a client record. That one sentence answers most of this section.

Write down the approval points as a table:

This also shows the difference between a workflow and an agent. A workflow follows fixed steps, so every approval point is known in advance. An agent decides its next step within rules you set, so you must also say when it stops and asks a person.

Records: what gets logged, and how long is it kept?

A good answer is "every action is logged with its source, and the outputs we keep follow our existing retention rules." Plan to treat AI drafts that reach a client as communications, and AI notes in a file as records. Let compliance decide where the line sits.

Questions to expect:

• Is there an audit log of each step, input, output, and approval?
• Who can see the log? Can anyone edit or delete it?
• Do client communications drafted by AI go into your normal archive?
• Does this change your books-and-records or retention schedule?

Bring a sample log entry. One real-looking line beats a paragraph of promises.

Vendors: who else touches the data?

Compliance will run its normal vendor review on the AI provider and on anyone who builds or runs the workflow. Treat the AI provider like any other service provider that holds client data.

Have these ready:

• The provider's data processing terms, training policy, and retention policy.
• Any security reports or questionnaires the provider offers.
• Who builds the workflow, who runs it, and what access each one has.
• What happens to your data if you leave.

The NAIC bulletin, for example, names due diligence on third-party AI systems and, where appropriate, contract terms such as audit rights. Your regulator may expect something similar.

Testing and monitoring: how do you know it works?

A good answer says what you tested before going live and what you watch after. "We tried it and it looked good" will not pass.

Before go-live, run the workflow on a set of real past cases and compare its output with what your team actually did. Record the misses. After go-live, review a sample of outputs on a schedule. Track how often a person rejects or edits a draft. Name who gets alerted when something breaks, and who can switch it off.

FINRA's notice says a member firm should evaluate generative AI tools before it deploys them. A short written test plan answers that directly.

Disclosure and marketing: what do you tell clients?

Say only what is true and what you can show. The SEC cases above were about firms that described AI capabilities they did not have.

Questions to expect:

• Do client agreements or privacy notices need an update?
• Do you need client consent before their data goes to an AI provider? For tax return information, this is a real question to put to counsel.
• Does any marketing copy, website text, or pitch mention AI? Is each claim accurate?

A good answer: no AI claims in marketing until compliance reviews them, and disclosure decisions made by counsel, not by the project team.

How we build with these questions in mind

We are not a compliance firm and we hold no certifications. We build every workflow and agent the same way. A person approves anything that moves money, changes a client record, or goes out in your name. Every action is logged with its source. Access is scoped and read-only where possible. That gives your compliance officer something concrete to review. Whether it meets your obligations is their call.

The detail differs by industry. See how this applies to RIAs, insurance agencies, accounting firms, and digital asset companies.

The checklist to bring to the meeting

1. One sentence on what the workflow does and what it does not do.
2. A data map: fields, sources, vendors, and each vendor's training and retention terms.
3. An access list: read or write, per system, and how to turn it off.
4. An approval table: every action that reaches a client, moves money, or changes a record, and who approves it.
5. A sample audit log entry and where outputs are archived.
6. Vendor documents: data terms, security materials, and exit terms.
7. A test plan with results on real past cases, plus the monitoring schedule.
8. Proposed client disclosure and any marketing language, for review.
9. An owner: the person accountable for the workflow after it goes live.

If you want a quick outside view of how your firm shows up online before you add AI to client-facing work, the free search and AI visibility report takes six questions and a website check.

Your next step

If you have one workflow in mind and want these answers written down before the compliance meeting, start with the AI Assessment. It is $1,500 for one week. It needs read access and an hour with the person who does the work. Nothing in your systems changes. You get a ranked plan and a fixed Build Sprint scope, or a clear no. If you would rather talk it through first, book a call.