AI due diligence checklist
AI is moving into everyday work at regulated financial firms, and regulators expect firms to supervise its use like any other technology. This checklist is a practical place to start. It builds on the four points Archive Intel CEO Larry Shumbres discussed at NSCP 2026, with a cited source for every question. Read it here or download the PDF, no form required.
1Build an AI inventory
- Is every AI tool in use at the firm on the inventory, including tools individual advisors use?1
- Does each tool have an owner and a written approved use?1
- Are approved uses in the supervisory procedures, and do advisors know which tools are approved?1, 6
- Is there a formal review and approval step before a new AI tool goes live?1
- For larger firms, does an AI control plane or MCP gateway centrally govern which AI tools are used and what data they can access?7
2Review each vendor’s AI and privacy policies
- Do the policies state whether firm or client data is used to train models?1
- Do they state where data is stored and whether third-party AI models are involved?1, 2
- Is it documented which firm data the vendor’s AI can reach and which systems it connects to?2
- Are security attestations current, with ongoing reviews scheduled?2, 3
3Add Data Processing Agreements (DPAs) to service agreements
- Is a DPA part of the service agreement?7
- Does the contract prohibit firm or client sensitive information from being ingested into the vendor’s open-source GenAI tools?2
- Does the contract require the vendor to notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a security breach resulting in unauthorized access to a customer information system the vendor maintains?3
4Confirm the vendor provides audit logs of AI activity
- Does the vendor provide audit logs of AI activity, such as prompt and output logs, and does the firm know how to get them?1
- Are AI-assisted client communications and chatbot interactions supervised and retained like other communications?4, 6
- Has the firm decided which AI meeting notes and summaries it keeps as records, and can it produce them for a given client and date?5
- Is evidence of supervisory review of AI use retained?6
Sources for the AI due diligence checklist
- FINRA, 2026 Annual Regulatory Oversight Report, Generative AI section
- FINRA, 2026 Annual Regulatory Oversight Report, Third-Party Risk Landscape section
- SEC, Regulation S-P amendments, Small Entity Compliance Guide (2024)
- FINRA, 2026 Annual Regulatory Oversight Report, Communications with the Public section
- FINRA, Regulatory Notice 25-07 (April 14, 2025)
- FINRA, Regulatory Notice 24-09 (June 27, 2024)
- Larry Shumbres, NSCP 2026 panel, “AI & GenAI in Compliance: From Productivity Booster to Regulatory Risk.” Good practice beyond what the rules require.