August 2 Is the EU AI Act Deadline. Here's the Small Part of It That Reaches a Nine-Person RIA — and the Large Part That Doesn't.

Does August 2 apply to you?

Blunt question, and the honest answer for most US advisory firms is: less than the newsletters implied, but not zero, and not in the place you expected.

The EU AI Act's high-risk and transparency obligations carry a 2 August 2026 compliance date, and the law reaches companies outside Europe whose systems affect people in the EU. That last clause is what set off every compliance webinar this spring. If you have two retired clients living in Portugal and a website chat widget, are you in scope? Partly. Is your rebalancer in Orion or Tamarac now a regulated high-risk system? Almost certainly not. Working out which is which is a two-hour job, and it is worth doing properly rather than paying someone $12,000 to tell you what is written below.

The part of the EU rules that can actually touch an RIA

The high-risk categories in the EU AI Act are a specific list. In financial services, the list reaches creditworthiness assessment and credit scoring for individuals, and risk assessment and pricing for life and health insurance. Discretionary portfolio management, rebalancing, financial planning projections, and performance reporting are not on that list. If you do not lend, score credit, or price insurance, your investment technology is not high-risk under this law. Say that out loud to your partners before anyone buys a compliance platform.

What can reach you is the transparency layer. If a person in the EU interacts with your AI chat agent or your phone answering agent, they have to be told they are dealing with a machine. If you publish marketing with a synthetic voiceover or generated imagery, it gets labelled. And the AI literacy expectation — that staff using these tools have adequate training for what they are doing — has been live since February 2025 and is not exotic; a one-page training record and an annual session satisfies the spirit of it.

The other genuine exposure is hiring. Using AI to screen candidates for a role based in the EU falls squarely into the high-risk employment category. Very few nine-person RIAs are hiring in Frankfurt. Know whether you are.

flowchart TD
  A["Pick one AI tool the firm uses"] --> B{"Who does it talk to or decide about?"}
  B -->|A person located in the EU| C["Disclose it is AI, log the disclosure"]
  B -->|A job applicant| D["Check Illinois, NYC and Colorado hiring rules"]
  B -->|A US client or internal staff only| E["No AI-specific statute; SEC rules still apply"]
  C --> F["Add to the firm AI inventory"]
  D --> F
  E --> F
  F --> G["CCO signs off in the annual 206(4)-7 review"]

What is genuinely out of scope, so you stop worrying about it

California SB 53 took effect 1 January 2026 and it governs frontier model developers above serious compute and revenue thresholds. You are not one. Neither is your firm's use of ChatGPT Work or Claude Cowork. The obligations sit with the companies building the models, not with an advisory firm using them.

Texas TRAIGA, also effective 1 January 2026, is aimed at intentional harms — systems built to manipulate people into self-harm or crime, to discriminate on purpose, or to run government-side social scoring and biometric identification. A Texas RIA using AI to draft meeting notes is not the target and does not have a filing to make. Read it once, note the conclusion, move on.

Colorado, New York, Utah, Nevada, Maine and Illinois each have their own AI statutes with genuinely different aims, and the federal position on whether any of it is preempted is still unsettled as of July 2026 — which means state law binds you today regardless of what Washington may do later. The two that most often catch an advisory firm are Illinois, where AI used in employment decisions is now squarely regulated, and Utah, where a firm in a state-regulated occupation is expected to disclose proactively when a consumer is interacting with AI rather than only when asked.

The rules that were always going to bind you

Here is the uncomfortable part. For a US registered investment adviser, the highest-probability enforcement risk from AI in 2026 is not any AI statute. It is the Investment Advisers Act you have complied with for years.

Rule 206(4)-1, the Marketing Rule, is the live one. Describing your process as "AI-driven" or "machine-learning powered" when the reality is a spreadsheet and a subscription is a false or misleading statement in an advertisement, and the SEC has already brought AI-washing cases on exactly that basis. Whatever your website and pitch deck claim about AI, someone at the firm needs to be able to demonstrate it is true.

Rule 206(4)-7 requires policies reasonably designed to prevent violations, reviewed annually. That review now has to cover the tools. Rule 204-2 means an AI-drafted email to a client is a record like any other and belongs in your archive. Form ADV Part 2A Item 8 describes your methods of analysis — if a machine materially shapes the advice, it is described there. And Reg S-P's amended safeguards and service-provider obligations reached smaller advisers in June 2026, which puts every AI vendor holding client information onto a list you now maintain deliberately.

The documentation, and roughly what it costs to build

Four artifacts. Not a platform, not a consultant retainer — four documents that a CCO can build in a working week and refresh annually.

• An AI inventory. One row per tool: what it is, who owns it, what client data it touches, whether output reaches a client, and who reviews that output. Include the notetaker, the chat widget, the phone agent, the drafting tools, and anything a paraplanner installed without asking.
• Disclosure language. The one line your chat widget and phone greeting say. "You're chatting with an AI assistant for the firm; ask for a person any time." Log that it is shown.
• A review record. Evidence that a human approved client-facing output, kept where an examiner can find it.
• A training record. Who was trained, on what, when. One page.

Compare that to the alternative, which is not a fine — it is a deficiency letter that arrives during an exam, a remediation the examiner supervises on their timetable, and outside counsel at several times that hourly rate reconstructing after the fact what your firm was doing with which tool. Firms consistently underestimate how much of an exam response is simply the cost of not having written anything down.

What no policy document will fix

None of this makes the advice right. A written AI policy does not stop a model from producing a plan projection with a bad assumption in it, and no examiner will accept "the tool said so" from an adviser with a fiduciary duty. The documentation proves you supervised. It does not substitute for supervising.

It also will not settle the questions still genuinely open. Whether federal preemption arrives and what it covers is unresolved. Guidance on how the EU transparency rules apply to a small non-EU firm serving a handful of EU-resident clients is thin. If your firm has real EU client exposure — more than a couple of expats, or an actual marketing presence — that is a question for counsel, not for a blog post, and the honest advice is to spend the money once rather than guess annually.

Frequently asked questions

We have three American clients living in Europe. Are we in scope on August 2?

For the high-risk obligations, almost certainly not, because portfolio management is not a listed high-risk use. For the transparency obligations, if those clients can reach an AI chat or phone agent on your site, tell them it is AI. That is a one-line change, so make it and stop thinking about it.

Do I have to amend my Form ADV because we use AI?

Only if it materially affects your methods of analysis or your operations in a way a client would want to know. A notetaker that drafts meeting summaries reviewed by the advisor generally does not rise to that. A model that materially influences security selection or allocation does. When in doubt, disclose in Item 8 — it costs you nothing and reads better in an exam than silence.

Our compliance vendor is selling an "AI Act readiness" package. Should we buy it?

Look at what is in it first. If it produces the four artifacts above, that is fair value. If it is a subscription to a dashboard that tracks legislation you are not subject to, you are buying anxiety. Ask them directly which high-risk category they believe applies to your firm and why.

What is the single most likely way this bites a small RIA?

Marketing language. A page on your website written in 2025 that says the firm uses artificial intelligence to manage risk, which nobody can substantiate in 2026. Go read your own site this week.

If your firm runs an AI agent on the phone or the website, the disclosure obligation lands there first, which makes it worth choosing a tool that handles it cleanly. CallSphere builds AI voice and chat agents that answer business lines and web chat, book appointments and capture leads around the clock — and they can open by identifying themselves as an AI assistant, hand off to a person on request, and keep the transcript, which is exactly the record your CCO wants in the file when the annual review comes around.