SEC Marketing Rule and AI: 2026 Disclosure Requirements for Wealth Advisors

The 60-second answer

The SEC Marketing Rule (Rule 206(4)-1 under the Advisers Act) applies to any communication an RIA distributes that offers advisory services or refers to performance. When an adviser uses AI in client-facing work — generating market commentary, producing performance summaries, drafting communications, or making recommendations — three disclosure obligations attach: the use of AI must not be misleading, performance claims generated or filtered by AI must be substantiated, and any testimonial or endorsement language produced by AI must comply with the same standards as a human-authored one. The CCO needs three things on file: a written AI policy, a record of which AI tools touch client-facing content, and a review process for the output.

Why the Marketing Rule cares about AI specifically

The Marketing Rule does not name AI. It names "advertisements" — which it defines broadly as any direct or indirect communication an adviser makes to more than one person that offers advisory services. The rule's principle is anti-fraud: communications must be fair, balanced, and substantiated.

AI matters under the rule because it changes who or what is generating the communication and how easily a firm can validate it. Three friction points come up regularly:

• Performance figures generated by AI tools — easy to produce, easy to misstate, easy to present without the required time-weighted return methodology or net-of-fees disclosure.
• Forward-looking statements that look like predictions — language models default to confident phrasing that can read as promissory if it is not edited.
• Testimonials and endorsements summarized or rephrased by AI — the rephrased version is still a testimonial under the rule, and the same disclosure requirements apply.

The 2024 SEC risk alert on the Marketing Rule specifically called out AI-generated content as an area examiners are looking at. That is not the same as a new rule; it is a clarification that the existing rule already covers it.

The three disclosure obligations in practice

1. AI-generated content cannot be misleading

The general rule: an advertisement is misleading if it states a material fact untruthfully, omits a material fact that makes the rest misleading, includes a discussion of investment strategies without a balanced view of risks, or implies that performance was achieved in conditions different from those that actually existed.

In an AI context, the most common slips are:

• Market commentary that sounds like a forecast rather than a viewpoint.
• "Hypothetical performance" generated by an AI tool without the required risk and methodology disclosures.
• Client-facing language that implies a level of personalization the AI did not actually deliver.

The fix is procedural: every piece of AI-generated client-facing content goes through a human review before distribution, with a documented checklist for misleading-content risk.

2. Performance must be substantiated, regardless of who computed it

If an AI tool produces a "your portfolio outperformed the benchmark by 240 basis points" statement, the firm has to be able to show, on demand, the calculation, the time period, the benchmark, and the net-of-fees adjustment. The same standards that apply to a human-prepared performance attribution apply to an AI-prepared one.

Practical implication: AI tools that touch performance numbers should write their inputs and assumptions to an audit log the firm can produce in an exam. If the tool cannot do that, the firm should not be using it for performance communications.

3. Testimonials and endorsements have the same rules whether AI touched them or not

If a client testimonial is rephrased by an AI tool for use on the firm's website, the underlying testimonial still needs:

• Clear and prominent disclosure that it is a testimonial from a current client (or endorsement from a non-client).
• Disclosure of any cash or non-cash compensation.
• A statement of any material conflicts of interest.
• The adviser's adoption of the testimonial as an advertisement.

The Marketing Rule does not have a "lightly edited by AI" exception. The disclosures attach to the substance, not the production method.

What the CCO needs on file

A clean AI compliance posture under the Marketing Rule has three artifacts:

A written AI policy. Short and specific: which tools are approved, what they may produce, what they may not produce without human authorship, how output is reviewed before client distribution, and how output is retained.

A registry of AI-touched content. A list of every AI tool that produces or modifies client-facing content, the version, the vendor, the data it has access to, and the firm employee who owns it.

A review record. Each piece of AI-generated content that goes out should have a reviewer's name and a date stamp. This can be lightweight — a checkbox in a content workflow — but it has to exist and be retrievable.

These three artifacts are what an examiner will ask for. They are also what protects the firm if a client complaint turns into a regulatory inquiry.

The retention question

Books and records under Rule 204-2 require advisers to retain advertisements for at least five years from the date of last use, with the first two years in an easily accessible place. That retention applies to the AI-generated version that was actually distributed, not just the final human-edited version.

In practice, firms keep:

• The prompt or instruction set provided to the AI tool, if any.
• The raw AI output.
• The final reviewed and approved version that was sent or published.
• The reviewer name and approval timestamp.

This sounds heavy. With the right tooling it is automatic — most enterprise AI assistants designed for regulated industries write these records to a versioned audit log without the user doing anything.

Three failure modes to watch for

The Slack-to-LinkedIn pipeline. An advisor drafts a market commentary in Slack with AI assistance, copies it to LinkedIn. There is no review record. The post is now a non-compliant advertisement under the Marketing Rule, regardless of whether the underlying content was accurate.

The unmonitored personalization tool. A tool that generates personalized prospect outreach using portfolio modeling or performance data can produce hypothetical performance figures inside individual emails. Each of those emails is an advertisement; each needs the substantiation backstop. Firms often do not realize this until the first exam.

The vendor-default disclaimer. Many AI tools ship with a default disclaimer like "AI-generated content may be inaccurate." That disclaimer does not satisfy the Marketing Rule. The rule requires substantive accuracy and substantiation, not a notice that the content might be wrong.

What changes when AI tooling is built for advisers

A purpose-built AI for advisers does three things that a generic one does not:

• Refuses to generate forward-looking performance claims without the required methodology and disclosure language.
• Writes inputs, prompts, outputs, and approver to an audit log automatically.
• Integrates with the firm's content approval workflow so nothing goes out without a documented reviewer.

The result is that the compliance work moves from after-the-fact reconstruction to before-distribution prevention.

FAQ

Does the Marketing Rule apply to internal communications generated by AI? No. The rule applies to communications that offer advisory services or refer to performance to more than one person. Internal notes and one-to-one operational communications are not advertisements.

What about AI used to summarize client meetings? Meeting summaries are books-and-records (Rule 204-2), not advertisements. Different rule, different retention, but still subject to substantive accuracy.

Does using a third-party AI vendor shift compliance responsibility to the vendor? No. The adviser remains responsible for content that goes out under the firm's name. Vendor selection is a fiduciary act; using an unvetted AI tool for advertising is the adviser's compliance problem.

How does this interact with state-level AI disclosure laws? A handful of states have introduced AI disclosure requirements (Utah's 2024 law is the most-cited example). Those are layered on top of, not in place of, the federal Marketing Rule. The federal floor applies regardless of where the client is.

What's the right time to bring in outside counsel on AI compliance? Before the first piece of AI-generated marketing material goes to a client, not after. A one-hour conversation with regulatory counsel scoping the policy is cheaper than a one-month exam response.

Related: Meeting Assistant · Advisor Transitions Platform · For Transition Consultants · For Breakaway Advisors