The SEC applies its existing rules to AI agents used by investment advisers and broker-dealers. An agent's recommendations must meet the adviser's fiduciary duty or the broker-dealer's best interest standard; its client messages are records to keep; its content can be marketing; and its data access falls under safeguarding rules. Claims about the agent must be accurate.
What do SEC rules require, in plain words?
There is no SEC rule specific to AI agents. Several existing obligations reach them, in substance:
- Fiduciary duty of advisers. Registered investment advisers owe clients a duty of care and a duty of loyalty: advice must be in the client's best interest, based on a reasonable understanding of their objectives, and conflicts must be eliminated or fully and fairly disclosed.
- Best interest for broker-dealers. When recommending securities or strategies to retail customers, broker-dealers must act in the customer's best interest and not put their own interest ahead of it, with disclosure, care, conflict and compliance components.
- Compliance programmes. Advisers must have written policies and procedures reasonably designed to prevent violations, review them at least annually, and appoint a chief compliance officer.
- Books and records. Advisers and broker-dealers must make and keep specified records, including business communications. The SEC has enforced heavily against firms that failed to preserve communications sent through unapproved channels.
- Marketing and communications. Advertisements must not contain untrue or misleading statements, and claims must be substantiated.
- Customer information. Firms must have written policies to safeguard customer records and information, respond to incidents, and give required privacy notices.
- Accurate claims about AI. The SEC has brought cases against firms that overstated their use of AI to clients and investors.
Who does it apply to?
SEC-registered investment advisers and broker-dealers. Broker-dealers are also members of FINRA, which applies its own rules on supervision and communications; see FINRA and AI agents in broker-dealers. State-registered advisers answer to state regulators under similar principles.
What does this mean when the system is an agent that acts?
A recommendation is a recommendation, whoever drafts it. An agent that suggests a portfolio change, a product or a rollover is producing advice or a recommendation. The firm's duty applies in full. If the agent cannot gather the information needed to judge suitability for this client, it should not make the recommendation.
Conflicts can hide in the brief. An agent instructed to favour the firm's own funds, or trained on materials that do, embeds a conflict. Under fiduciary duty and best interest, the conflict must be identified, addressed and disclosed. Reviewing the brief is part of conflict management.
Every message is a record. Client messages from an agent are business communications. They must be captured and retained like those from staff, in a way the firm can produce on request.
Generated content can be an advertisement. An agent that writes market commentary or describes performance for prospects is producing marketing. The marketing rules apply, including substantiation of claims.
Data access needs safeguards. An agent reading client accounts must be limited to what the task needs, and incidents involving it fall within incident response and notification duties.
Supervision still applies. Firms must supervise the activities of their business. An agent is part of that business, so its output needs review proportionate to its risk, by people who know what good advice looks like.
Take an illustrative case. A mid-sized advisory firm uses an agent to prepare quarterly review packs and draft follow-up emails. The agent may summarise holdings and performance from the firm's records and draft talking points. It may not recommend trades; advisers do. Every draft and every sent email is archived in the firm's communications system. Performance figures in drafts must come from the portfolio accounting system, labelled as such. The firm's disclosure describes the agent's role plainly, without overstating what it does.
How do you meet SEC expectations for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Fiduciary duty and best interest | Agents draft recommendations only where suitability data is complete; a registered person decides | Recommendation records with decider |
| Conflicts | Briefs and sources reviewed for embedded conflicts | Conflict review records |
| Compliance programme | Written policies covering agent use, reviewed annually | Policies; annual review |
| Books and records | All agent communications captured and retained | Archive records |
| Marketing | Agent-generated content reviewed before use; claims substantiated | Review approvals; substantiation file |
| Customer information safeguards | Least-privilege data access; incident response covers agents | Access configuration; incident records |
| Accurate AI claims | Descriptions of agent use reviewed by compliance | Approved disclosures |
What will SEC examiners ask?
- Which agents interact with clients or produce recommendations?
- How do you ensure agent recommendations meet your fiduciary or best interest obligations?
- How are conflicts in an agent's instructions identified?
- Show us the retained communications an agent sent to a client.
- How do you describe your use of AI to clients, and is it accurate?
What do SEC rules not cover?
They do not tell you how to test agents or what technical controls to use, only what outcomes you must achieve. Banking, insurance and state privacy laws may also apply. Firms with offices abroad meet other regimes for the same agent: Australia's operational risk standard, covered in how APRA CPS 230 applies to AI agents, and Japan's privacy law, covered in whether Japan's APPI applies to AI agents. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Can an AI agent give investment advice to retail clients?
The rules do not forbid it, but the firm's duties apply in full. In practice, most firms keep agents preparing analysis and drafts, with a registered person making and owning the recommendation.
Are an agent's draft messages records if they are never sent?
Recordkeeping duties focus on communications relating to the business as sent and received. Many firms also retain drafts and the agent's working records, because they show how a recommendation was formed.
Does using an AI agent need to be disclosed to clients?
Where it is material to the advice or relationship, disclosure is prudent, and any description must be accurate. Overstating or misdescribing AI use has itself led to enforcement.