What Registered Investment Advisors and Broker-Dealers Must Document Before Using AI  

Artificial intelligence and automated decision tools are rapidly becoming embedded in the operational and compliance environments of investment advisers and broker-dealers. Firms are increasingly using automation to support investment research, surveillance, communications review, portfolio monitoring, and elements of client servicing. In fact, industry surveys indicate that asset managers and advisors are embracing AI at a growing rate, even as concerns around oversight and accountability remain.

While these tools can improve efficiency and consistency, regulators have made clear that the use of automation does not reduce supervisory or fiduciary obligations. Firms remain responsible for outcomes, including how models are designed, implemented, monitored, and governed. As a result, AI adoption is increasingly becoming a governance and documentation issue rather than solely a technology decision.

For Registered Investment Advisors (RIAs) and broker-dealers considering or expanding the use of automation, a central question has emerged what must RIAs and broker-dealers document before using AI or model-driven processes?  

Why Model Governance Is Becoming a Compliance Priority for Financial Firms

Regulators have expressed growing concern around the risks associated with automated decision-making, including conflicts of interest, opaque model outputs, and over-reliance on technology without sufficient oversight. Whether a firm is using proprietary models, vendor-provided tools, or embedded automation within existing platforms, the expectation remains the same: firms must understand how the tool operates and demonstrate reasonable oversight.

From an examination perspective, regulators are increasingly focused on:

• Whether firms understand the purpose and limitations of automated tools
• Whether model outputs are reviewed and validated by qualified personnel
• Whether controls exist to identify errors or unintended outcomes
• Whether disclosures accurately reflect the role of automation in services provided

In practice, this means firms should approach AI and automation through a governance framework similar to other critical compliance functions.

Essential AI Compliance Documentation Areas Firms Must Address

While expectations will vary based on firm size and use case, several documentation areas are becoming foundational to responsible AI adoption.

1. Model Purpose and Intended Use 

Firms should clearly document what the model or automated tool is designed to do and where it fits within business or compliance processes. This includes identifying whether automation supports decision-making or directly influences outcomes, such as investment recommendations or surveillance alerts.

Clear documentation helps prevent “scope creep,” where tools are used beyond their original purpose without appropriate review.

2. Data Inputs and Assumptions

Automation relies on underlying data and assumptions that can materially affect results. Firms should understand and document:

• Sources of input data
• Known limitations or biases in the data
• Frequency of updates or retraining
• Dependencies on third-party providers

This is particularly important where outputs may influence investment decisions or supervisory conclusions.

3. Oversight and Human Review

Regulators consistently emphasize that automation cannot replace supervision. Firms should document:

• Who is responsible for reviewing model outputs
• Escalation procedures when results appear inconsistent or anomalous
• Circumstances requiring manual override or further review

Human oversight remains central to demonstrating that compliance programs are reasonably designed.

4. Testing and Validation

Before and after implementation, firms should be able to demonstrate that models function as intended. Documentation may include:

• Initial validation testing
• Ongoing monitoring or periodic review
• Testing for unintended consequences or false positives
• Changes made following testing outcomes

Testing becomes especially important where models impact client communications, trading surveillance, or suitability-related processes.

5. Change Management and Version Control

AI tools and automated systems evolve over time. Firms should maintain records reflecting:

• Material model updates or configuration changes
• Approval processes for implementation
• Documentation of performance changes following updates

Without structured change management, firms may struggle to explain how automated outcomes evolved over time.

Balancing Innovation and Responsibility

Automation offers meaningful benefits for RIAs and broker-dealers, particularly as regulatory expectations and operational complexity continue to increase. However, efficiency gains must be balanced with governance and accountability. Over-reliance on automated outputs without sufficient documentation or oversight can create risks that are difficult to identify until problems arise.

A risk-based approach allows firms to incorporate AI and automation thoughtfully, ensuring that technology enhances compliance programs rather than introducing unmanaged risk.

Looking Ahead

As automation becomes more integrated into advice, surveillance, and operational processes, regulatory expectations are likely to continue evolving toward transparency and accountability. Firms that approach AI adoption through a governance lens (documenting purpose, oversight, and limitations from the outset) are generally better positioned to balance innovation with supervisory responsibility. In practice, effective model governance is less about restricting technology and more about ensuring that automation operates within clearly defined risk and compliance frameworks.

How CRC Can Help

Navigating AI governance requirements is complex, and the documentation expectations for RIAs and broker-dealers continue to evolve alongside regulatory guidance. CRC-Oyster works with financial services firms to build and strengthen the compliance infrastructure needed to adopt automation responsibly. From governance gap analysis and model oversight frameworks to policies, procedures, and supervisory program design, CRC-Oyster's team of senior compliance professionals brings the practical experience and regulatory insight firms need to stay ahead. Whether your firm is evaluating AI tools for the first time or looking to formalize existing practices, CRC-Oyster can help ensure your program is built to meet current expectations and ready for what comes next.