Pre-exam AI checklist: 14 things a CCO should be able to answer
For SEC-registered advisers, $250M–$5B AUM. None of this is regulatory advice; what a rule requires of your firm belongs to your compliance consultant.
The inventory
- 1. A dated inventory of every AI tool in use, including what an adviser bought on a personal card
- 2. A risk assessment for each tool, dated before that tool went live
- 3. The vendor’s data-processing terms saved as a PDF, dated the day you retrieved them
- 4. A named owner and a review date on every row
The service provider layer
- 5. A register of every service provider with access to customer information, not the list finance pays
- 6. For each one, the due diligence record and the monitoring record
- 7. For each one, the 72-hour unauthorized-access notification arrangement your policies must establish
The incident layer
- 8. The record of every incident in the last five years
- 9. The determination of whether notification was required, including where you concluded it was not
- 10. An incident response program that contemplates an AI failure, not only a breach
The review layer
- 11. One completed test of an AI output against its source, with findings and a re-run date
- 12. Where a human reviews before anything reaches a client, in writing, with a name on it
- 13. A retention decision for AI transcripts, made in advance at the category level
- 14. A notetaker vendor retention setting that matches that decision
Two dates. Reg S-P compliance was due December 3, 2025 at $1.5B or more and June 3, 2026 below it; both passed, and the extension ten trade associations sought on November 19, 2025 was not granted. Rule 206(4)-7 does not require a written report of the annual review — that is practice, not rule text — but an undocumented review reads as none.
Download the one-page PDF
No form. Print it, mark it up, hand it round.