Regulation S-P Now Applies to Smaller Advisers: What It Means for Your AI Vendors

By The Professions Cloud Editors Updated October 2026 · 5 sources · 3 min read

Prices and facts checked October 13, 2026. We don't accept payment for rankings.

What happened: on June 3, 2026, the SEC's amended Regulation S-P took effect for smaller entities, including registered investment advisers with $1.5 billion or less in assets under management. Larger firms have had to comply since December 3, 2025 (Davis Wright Tremaine; Holland & Knight).

Why it matters for AI: the amended rule requires you to oversee service providers that can access customer information. An AI notetaker that records client meetings, a CRM with AI features and a planning tool that ingests tax returns all qualify. The SEC has also named Reg S-P compliance as a 2026 exam priority (Foley & Lardner).

The four requirements that matter most

Sources: Davis Wright Tremaine; Holland & Knight.

Why your AI notetaker is a "service provider"

The rule defines service providers broadly: any company that receives, maintains, processes or can access customer information while serving your firm. That reasonably covers technology vendors (Holland & Knight).

And "sensitive customer information" is broad too. It goes beyond Social Security and account numbers to other information about an identifiable client, such as investment history, if its compromise could reasonably cause substantial harm or inconvenience. A transcript of a planning meeting can contain exactly that.

The 72-hour clause: your negotiation point

The rule requires your policies to ensure providers notify you within 72 hours. The SEC suggested getting this in the contract, or alternatively through certifications or other reasonable assurances. Lawyers note that large vendors may resist new terms, so expect to negotiate (Davis Wright Tremaine; Holland & Knight).

Ask every AI vendor for:

1. Written breach notice within 72 hours of awareness
2. Its security report (SOC 2 Type II or equivalent)
3. Data-use terms: does it train models on your clients' conversations? Can you turn that off?
4. Retention controls: how long recordings, transcripts and summaries are kept, and whether you can match them to your books-and-records schedule
5. Subprocessors: which AI model providers receive the data
6. Deletion on termination

Some tools reduce exposure by design. Zocks, for example, says it never records client conversations (Zocks). Fewer stored recordings means less sensitive data to protect, and less to notify about if something goes wrong.

Your Reg S-P checklist for AI tools

1. Inventory: list every tool holding client information, including AI features inside existing software. Compliance consultants note many small firms will need first-ever conversations with IT and software vendors about breach terms (Quest CE).
2. Contracts: confirm or add the 72-hour notice, and file the vendor's security report.
3. Incident plan: add an AI-vendor breach scenario, and run a tabletop exercise.
4. Notice templates: prepare the 30-day customer notice in advance (what happened, what data, what clients can do).
5. Records: keep the vendor due diligence, contracts and any incident decisions together.

Comparing notetakers? See our AI notetakers guide, and how SEC and FINRA recordkeeping rules apply to AI notes.

FAQ

Who counts as a "smaller entity" for RIAs?

Registered investment advisers with $1.5 billion or less in assets under management. Larger RIAs had to comply from December 3, 2025.

Do we have to notify the SEC about a breach?

The amended Reg S-P requires notice to affected individuals, not to the SEC. Other rules and state laws may add requirements.

Is there an exception to the 30-day notice?

Yes. Notice isn't required if a reasonable investigation determines the sensitive information hasn't been, and isn't reasonably likely to be, used in a way that would cause substantial harm or inconvenience. Lawyers note the default is to notify.

Changelog: Oct 13, 2026: first published.