Financial Services
By Sagar Shankaran, Founder of CallSphere
What a US registered investment adviser must actually document, disclose and log in 2026 — and which AI statutes are genuinely out of scope for the firm.
Key takeaways
Blunt question, and the honest answer for most US advisory firms is: less than the newsletters implied, but not zero, and not in the place you expected.
The EU AI Act's high-risk and transparency obligations carry a 2 August 2026 compliance date, and the law reaches companies outside Europe whose systems affect people in the EU. That last clause is what set off every compliance webinar this spring. If you have two retired clients living in Portugal and a website chat widget, are you in scope? Partly. Is your rebalancer in Orion or Tamarac now a regulated high-risk system? Almost certainly not. Working out which is which is a two-hour job, and it is worth doing properly rather than paying someone $12,000 to tell you what is written below.
The high-risk categories in the EU AI Act are a specific list. In financial services, the list reaches creditworthiness assessment and credit scoring for individuals, and risk assessment and pricing for life and health insurance. Discretionary portfolio management, rebalancing, financial planning projections, and performance reporting are not on that list. If you do not lend, score credit, or price insurance, your investment technology is not high-risk under this law. Say that out loud to your partners before anyone buys a compliance platform.
What can reach you is the transparency layer. If a person in the EU interacts with your AI chat agent or your phone answering agent, they have to be told they are dealing with a machine. If you publish marketing with a synthetic voiceover or generated imagery, it gets labelled. And the AI literacy expectation — that staff using these tools have adequate training for what they are doing — has been live since February 2025 and is not exotic; a one-page training record and an annual session satisfies the spirit of it.
The other genuine exposure is hiring. Using AI to screen candidates for a role based in the EU falls squarely into the high-risk employment category. Very few nine-person RIAs are hiring in Frankfurt. Know whether you are.
flowchart TD
A["Pick one AI tool the firm uses"] --> B{"Who does it talk to or decide about?"}
B -->|A person located in the EU| C["Disclose it is AI, log the disclosure"]
B -->|A job applicant| D["Check Illinois, NYC and Colorado hiring rules"]
B -->|A US client or internal staff only| E["No AI-specific statute; SEC rules still apply"]
C --> F["Add to the firm AI inventory"]
D --> F
E --> F
F --> G["CCO signs off in the annual 206(4)-7 review"]
California SB 53 took effect 1 January 2026 and it governs frontier model developers above serious compute and revenue thresholds. You are not one. Neither is your firm's use of ChatGPT Work or Claude Cowork. The obligations sit with the companies building the models, not with an advisory firm using them.
Hear it before you finish reading
Talk to a live CallSphere AI voice agent for financial services in your browser — 60 seconds, no signup.
Texas TRAIGA, also effective 1 January 2026, is aimed at intentional harms — systems built to manipulate people into self-harm or crime, to discriminate on purpose, or to run government-side social scoring and biometric identification. A Texas RIA using AI to draft meeting notes is not the target and does not have a filing to make. Read it once, note the conclusion, move on.
Colorado, New York, Utah, Nevada, Maine and Illinois each have their own AI statutes with genuinely different aims, and the federal position on whether any of it is preempted is still unsettled as of July 2026 — which means state law binds you today regardless of what Washington may do later. The two that most often catch an advisory firm are Illinois, where AI used in employment decisions is now squarely regulated, and Utah, where a firm in a state-regulated occupation is expected to disclose proactively when a consumer is interacting with AI rather than only when asked.
Here is the uncomfortable part. For a US registered investment adviser, the highest-probability enforcement risk from AI in 2026 is not any AI statute. It is the Investment Advisers Act you have complied with for years.
Rule 206(4)-1, the Marketing Rule, is the live one. Describing your process as "AI-driven" or "machine-learning powered" when the reality is a spreadsheet and a subscription is a false or misleading statement in an advertisement, and the SEC has already brought AI-washing cases on exactly that basis. Whatever your website and pitch deck claim about AI, someone at the firm needs to be able to demonstrate it is true.
Rule 206(4)-7 requires policies reasonably designed to prevent violations, reviewed annually. That review now has to cover the tools. Rule 204-2 means an AI-drafted email to a client is a record like any other and belongs in your archive. Form ADV Part 2A Item 8 describes your methods of analysis — if a machine materially shapes the advice, it is described there. And Reg S-P's amended safeguards and service-provider obligations reached smaller advisers in June 2026, which puts every AI vendor holding client information onto a list you now maintain deliberately.
Four artifacts. Not a platform, not a consultant retainer — four documents that a CCO can build in a working week and refresh annually.
| Illustrative line item | Hours | Cost at $145/hr CCO time |
|---|---|---|
| Build the AI inventory | 8 | $1,160 |
| Draft disclosures and update the 206(4)-7 manual | 10 | $1,450 |
| Marketing Rule review of website and deck claims | 6 | $870 |
| Staff training session and record | 4 | $580 |
| Total, year one | 28 | $4,060 |
| Annual refresh thereafter | 7 | $1,015 |
Compare that to the alternative, which is not a fine — it is a deficiency letter that arrives during an exam, a remediation the examiner supervises on their timetable, and outside counsel at several times that hourly rate reconstructing after the fact what your firm was doing with which tool. Firms consistently underestimate how much of an exam response is simply the cost of not having written anything down.
Still reading? Stop comparing — try CallSphere live.
See the financial services AI agent handle a real call — complete, industry-specific, and live in your browser. No signup.
None of this makes the advice right. A written AI policy does not stop a model from producing a plan projection with a bad assumption in it, and no examiner will accept "the tool said so" from an adviser with a fiduciary duty. The documentation proves you supervised. It does not substitute for supervising.
It also will not settle the questions still genuinely open. Whether federal preemption arrives and what it covers is unresolved. Guidance on how the EU transparency rules apply to a small non-EU firm serving a handful of EU-resident clients is thin. If your firm has real EU client exposure — more than a couple of expats, or an actual marketing presence — that is a question for counsel, not for a blog post, and the honest advice is to spend the money once rather than guess annually.
For the high-risk obligations, almost certainly not, because portfolio management is not a listed high-risk use. For the transparency obligations, if those clients can reach an AI chat or phone agent on your site, tell them it is AI. That is a one-line change, so make it and stop thinking about it.
Only if it materially affects your methods of analysis or your operations in a way a client would want to know. A notetaker that drafts meeting summaries reviewed by the advisor generally does not rise to that. A model that materially influences security selection or allocation does. When in doubt, disclose in Item 8 — it costs you nothing and reads better in an exam than silence.
Look at what is in it first. If it produces the four artifacts above, that is fair value. If it is a subscription to a dashboard that tracks legislation you are not subject to, you are buying anxiety. Ask them directly which high-risk category they believe applies to your firm and why.
Marketing language. A page on your website written in 2025 that says the firm uses artificial intelligence to manage risk, which nobody can substantiate in 2026. Go read your own site this week.
If your firm runs an AI agent on the phone or the website, the disclosure obligation lands there first, which makes it worth choosing a tool that handles it cleanly. CallSphere builds AI voice and chat agents that answer business lines and web chat, book appointments and capture leads around the clock — and they can open by identifying themselves as an AI assistant, hand off to a person on request, and keep the transcript, which is exactly the record your CCO wants in the file when the annual review comes around.
Written by
Sagar Shankaran· Founder, CallSphere
LinkedInSagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
Held-away 401(k)s, annuities and non-traded alts have no feed into Orion. How browser-driving AI agents cut five days out of the quarter-end reporting run.
The EU AI Act's August 2 date, Texas TRAIGA and California SB 53 all landed. What a US rehab clinic must document, disclose and log, and what it can skip.
Driver screening tools and cab-facing cameras put carriers under Illinois, Texas and NYC rules in 2026. What to document, and what is genuinely out of scope.
Why an RIA should baseline its custodian rejection rate before buying AI, what four numbers to capture, and a worked example on 528 packets a year.
Two casino systems land in the EU AI Act high-risk bucket: face matching and marker scoring. What US gaming operators document, disclose and can ignore.
The EU AI Act's August 2, 2026 date reaches US studios delivering to EU viewers. Here is what to log, disclose and consent for, and what is out of scope.
© 2026 CallSphere Inc. All rights reserved.
Made within San Francisco
Watch how CallSphere handles real customer calls, schedules appointments, and processes payments — live.
Try Live DemoBook a DemoCalculate Your ROI