A 200-advisor RIA network running across three custodians, two BD relationships, twelve state DOI jurisdictions, and the SEC's enforcement footprint cannot survive 2026 on the eight-page AI Use Policy a $50M solo RIA drafted in 2024. The enterprise policy is a different document — longer, structured, signed by the AI Governance Committee, ratified by the CEO, named in the Form ADV Part 2A, cited in the engagement letter, and capable of producing the FINRA Rule 3110 reasonable-design defense on a 2027 exam day. This lesson installs the full policy framework with the seven mandatory sections, the regulatory anchor matrix, and the operating cadence for amendment and audit. The policy is the L5 strategist's foundational document; every other L5 lesson on data governance (Ch3 L2), disclosure framework (Ch3 L3), organizational design (Ch4), client experience (Ch5), and agentic AI (Ch6 L1) operates inside it.

Why the Enterprise Policy Is the Foundational Artifact

The 2026 enforcement environment makes the policy non-negotiable. SEC Compliance Rule 206(4)-7 requires every registered investment adviser to adopt written policies and procedures reasonably designed to prevent violation of the Advisers Act. FINRA Rule 3110 requires every BD to maintain a supervisory system reasonably designed to achieve compliance with applicable rules. The FINRA 2026 Annual Regulatory Oversight Report framed GenAI and agentic AI as discrete supervisory obligations under Rule 3110 reasonable design — meaning the WSPs and policies must explicitly address AI tool use, prohibited data categories, vendor approval, training, and incident response. The May 2024 Reg S-P 17 CFR Part 248 amendments added the written incident-response program requirement. The January 2026 SEC staff FAQs on Marketing Rule 206(4)-1 reaffirmed that policies must address external AI claims. The NY DFS 23 NYCRR 500 cyber regulation, the NAIC AI Model Bulletin, NAIC Model #275, and the patchwork of state DOI bulletins layer additional written-policy expectations. The enterprise policy is the artifact that holds all of this together — and is the artifact the buyer's diligence team per L4 Ch8 L2 will read first.

The Seven Mandatory Sections of the Enterprise Policy

Section 1 — Acceptable Use

The acceptable-use section names the approved AI tools and the approved use cases. Approved tools by category: meeting AI (Jump or Zocks at the network level via L5 Ch1 L1 hybrid model), tax extraction (Holistiplan), estate extraction (FP Alpha or Wealth.com), CRM AI (Salesforce FSC + Einstein or Wealthbox AI or Redtail Engage depending on installed base), CRM-adjacent (Pulse360), portfolio AI (Orion Eclipse), prospecting (Catchlight or SmartAsset), archive (Smarsh or Global Relay), enterprise LLM (Microsoft Copilot or OpenAI Enterprise or Google Gemini Enterprise). Approved use cases: meeting capture and summarization, draft generation for client communications subject to principal review under Rule 2210, structured extraction from client documents, pattern detection in transaction histories, internal research, prompt-library iteration. Prohibited tools: any free public LLM consumer offering, any tool without a Reg S-P 17 CFR Part 248-compliant data-handling agreement, any tool not approved by the AI Governance Committee. Prohibited use cases: pasting client NPI into unapproved tools, making representations of "AI-generated fiduciary advice" externally, deploying agentic action-taking without the L4 Ch3 L3 agentic-AI WSP.

Section 2 — Vendor Approval Workflow

The vendor approval workflow incorporates the L4 Ch2 L1 SOC 2 Type II-anchored vendor scorecard and the L4 Ch2 L2 vendor due-diligence questionnaire. Steps: (1) intake — any advisor or department proposing a new AI tool submits the vendor intake form; (2) initial screen — Chief AI Officer reviews against approved-list adjacency, addressable use case, integration feasibility; (3) due diligence — AI Compliance Specialist and CTO run the 40-question Reg S-P / GLBA / NY DFS 23 NYCRR 500 vendor questionnaire and the SOC 2 Type II review; (4) committee approval — AI Governance Committee votes on approval at the next monthly meeting; (5) contracting — outside counsel reviews data-handling, data-residency, no-training-on-firm-data, BAA-equivalent terms, breach notification SLA, audit rights; (6) ADV Part 2A material-change assessment — if vendor processes NPI in a new category, off-cycle (prompt) ADV amendment per IA-1992; (7) onboarding — provisioning, training, principal-review queue configuration, AI Risk Register entry. Decommissioning workflow mirrors the L5 Ch2 L2 kill discipline.

Section 3 — Data Classification and NPI Handling

The data classification taxonomy: Class 1 (public marketing materials, non-confidential firm content), Class 2 (firm-internal not containing client NPI: WSPs, internal training, prompt library templates), Class 3 (client engagement data without direct NPI: planning concepts, anonymized case patterns), Class 4 (client NPI: name + account number, SSN, DOB, financial account data, health information). Class 4 data may only touch tools with executed Reg S-P 17 CFR Part 248 vendor terms and GLBA Safeguards-acceptable security posture. Class 3 data may touch approved enterprise LLMs without per-engagement consent if the engagement letter and ADV Part 2A general AI disclosure cover the practice. Class 2 may touch approved enterprise LLMs broadly. Class 1 is unrestricted. The "I just removed the name" anti-pattern is explicitly prohibited — anonymization for Class 4 to Class 3 requires the firm-approved anonymization workflow, not advisor-level judgment.

Section 4 — Training Requirements

Training requirements anchor to FINRA Rule 1240 Firm Element CE and the CFP Board CE alignment. Annual mandatory training: 4 hours on AI policy, acceptable use, Reg S-P NPI handling, Marketing Rule 206(4)-1 disclosure standards, and Reg BI §240.15l-1 implications of AI-drafted recommendations. Niche-owner training: 8 additional hours on the proprietary workflow's specific risks, prompt library iteration discipline, and substantiation file maintenance. Principal-review training: 4 additional hours for principal reviewers on Rule 2210 + Marketing Rule pre-use review of AI-drafted content. Onboarding training: 8 hours for new advisor onboarding including L1-L2 program equivalents. M&A onboarding fast-track: 16-hour curriculum for acquired-book advisors to integrate into the network's AI stack within 90 days post-close. Training records are themselves SEC Rule 204-2 and FINRA Rule 4511 records.

Section 5 — Supervision and Principal Review

The supervisory architecture covers the L4 Ch3 L1 WSPs under FINRA Rule 3110 reasonable design and SEC Compliance Rule 206(4)-7. The principal-review queue under FINRA Rule 2210 operates with: risk-based sampling (100% for new prompt versions for the first 30 days, then risk-based per the L4 Ch3 L2 framework), AI-to-AI red-team first-pass screening with exception routing to registered principal, exception logs retained under Rule 4511 and SEC Rule 204-2. The agentic-AI WSPs per L4 Ch3 L3 cover action-taking AI separately — kill-switch architecture, post-action review queue, Rule 4511 retention of agent action log. The supervisory log is reviewed monthly by the AI Governance Committee.

Section 6 — Incident Response

The incident-response program (IRP) per Reg S-P 17 CFR Part 248 May 2024 amendments has: incident classification (Severity 1-4), notification triggers (Reg S-P 30-day for affected individuals on Severity 1; NY DFS 23 NYCRR 500 72-hour; state DOI per the L4 Ch6 L2 50-state matrix; SEC if material per current rulemaking; FINRA per Rule 4530 for registered-person disclosure), escalation chain (advisor → AI Compliance Specialist → CCO → AI Governance Committee → CEO if Severity 1-2 + outside counsel), remediation workflow, E&O carrier notification per L4 Ch4 L2 application requirements, AI Risk Register update, Form U4 DRP filing per FINRA Rule 4530 if registered person is named (narrative drafting per L5 Ch7 L4). Tabletop exercises run semi-annually with the AI Governance Committee.

Section 7 — Audit, Amendment, and Recordkeeping

The policy is audited annually by the AI Compliance Specialist with outside counsel review. The Marketing Rule audit per L4 Ch7 L1 runs annually with the substantiation file maintained continuously. The ADV Part 2A annual updating amendment workflow per L5 Ch7 L6 incorporates AI tool changes affecting data handling. Off-cycle (prompt) amendments under IA-1992 are filed for material AI tool changes, vendor additions, or service changes. Policy amendments require AI Governance Committee approval and are themselves Rule 4511 records. The substantiation file is the audit-day artifact.

The Regulatory Anchor Matrix

Each policy section maps to specific regulations the matrix surfaces. Acceptable Use: SEC Compliance Rule 206(4)-7 (written policies), FINRA Rule 3110 (supervisory system), the L1 Ch1 fiduciary framing under Advisers Act of 1940. Vendor Approval: Reg S-P 17 CFR Part 248 (May 2024 amendments — written IRP, vendor oversight), GLBA Safeguards, NY DFS 23 NYCRR 500, SEC Rule 204-2, FINRA Rule 4511, ADV Part 2A material-change requirements under IA-1992. Data Classification: Reg S-P, GLBA, NY DFS, California CPRA, Texas DIR, state DOI variations per L4 Ch6 L2. Training: FINRA Rule 1240 Firm Element CE, CFP Board CE alignment. Supervision: FINRA Rule 2210 (communications), Rule 3110 (supervision), Rule 4511 (retention), Marketing Rule 206(4)-1 (with January 2026 staff FAQs and 2024-2025 Delphia/Global Predictions AI-washing precedent), Reg BI §240.15l-1. Incident Response: Reg S-P 30-day, NY DFS 72-hour, state DOI per matrix, FINRA Rule 4530 customer-complaint and U4 DRP, NAIC AI Model Bulletin + Model #275 for annuity-licensed channels. Audit and Amendment: SEC Rule 204-2, FINRA Rule 4511, IA-1992 ADV amendment standards.

The Aggregator and Network Overlay

An RIA aggregator or multi-member network has additional policy layers. The network-level policy sets baseline standards; member firms may not weaken the standards but may add stricter local provisions. Network-level vendor approval covers shared infrastructure (centralized archive, centralized LLM, centralized CRM per the L5 Ch1 L1 hybrid model); member-level approval covers locally chosen tools within an approved list (meeting AI, planning AI). Network-level incident response coordinates cross-member incidents; member-level handles member-specific incidents. The policy's network-vs-member decision rights map to the AI Governance Committee charter and to the L5 Ch4 L1 organizational structure.

The OSJ supervising 60 BD reps has a layered Rule 3110 supervisory system: the BD's home-office WSPs at one level, the OSJ's local WSPs at the next, and the registered person's individual accountability at the third. The enterprise AI policy at the OSJ level harmonizes with the home-office policy; conflicts get escalated to the BD's CCO. The wirehouse channel — Morgan Stanley, Merrill, UBS, Wells Fargo Advisors, Raymond James, LPL, Edward Jones, Ameriprise — operates under a single home-office policy with local FA-level conformance; the wirehouse FA does not draft her own AI policy.

The ADV Part 2A AI Disclosure Paragraph

Every enterprise AI policy produces a Form ADV Part 2A disclosure paragraph that becomes part of the firm's annual updating amendment and is referenced in the client engagement letter. The 2026 standard language: "[Firm] uses artificial intelligence tools (including but not limited to [named categories — meeting AI, tax-extraction AI, estate-extraction AI, CRM AI, planning AI]) to support advisor workflow. AI tools assist with meeting capture, draft generation, document extraction, and pattern detection. All recommendations are made by registered individuals exercising professional judgment under the Investment Advisers Act of 1940 fiduciary duty and Regulation Best Interest §240.15l-1 as applicable. AI-generated content is reviewed by registered principals under FINRA Rule 2210 before client delivery. Client information is handled in accordance with Regulation S-P 17 CFR Part 248 and the firm's written information security program. AI tool changes affecting data handling are disclosed through the annual ADV updating amendment or off-cycle amendments as required. Material changes are also communicated through the client engagement letter and annual disclosure delivery."

The exact language is reviewed by outside counsel each annual amendment cycle and refreshed against the current SEC staff FAQs, FINRA guidance, and state DOI bulletins. The paragraph is updated when AI tool changes occur. The L5 Ch7 L6 AI-diff workflow for ADV Part 2A produces the year-over-year change tracking.

Case Study — Aggregator Policy Rollout

A $14B RIA aggregator with 240 advisors across 18 member firms rolled out its enterprise AI policy in Q1 2026. The drafting team: CCO (lead), Chief AI Officer, AI Compliance Specialist, outside counsel, two senior advisor representatives, the CTO, the CIO. Draft cycles: 4 cycles over 90 days. Reviewer set: AI Governance Committee, BD CCO at the captive-BD partner, two state DOI consultants (for the network's NY and CA footprints), the firm's E&O carrier. The final policy ran 47 pages including appendices (regulatory anchor matrix, vendor scorecard template, vendor due-diligence questionnaire, IRP playbook, training curriculum, ADV paragraph). Distribution: every advisor, paraplanner, CSA across the network plus AI Governance Committee, principal-review staff, and IT.

The financial and diligence outcomes through Q2 2026: zero Marketing Rule 206(4)-1 risk-alert flags from the SEC Division of Examinations on the firm's communications; one Reg S-P 17 CFR Part 248 minor incident (advisor pasted Class 3 data into an approved enterprise LLM with documented engagement-letter consent — not a violation but logged) handled within the IRP framework in 14 days; zero Form U4 DRP filings tied to AI-generated recommendations; the firm's L4 Ch8 L1 premium-attribute score moved from 7/10 (pre-policy) to 9/10 (post-policy) on the supervisory-architecture dimension. The policy is now the single most-cited artifact in the firm's M&A diligence pack.

Key Takeaways

• The enterprise AI policy is the L5 foundational artifact — required by SEC Compliance Rule 206(4)-7, FINRA Rule 3110 reasonable design, the FINRA 2026 Annual Regulatory Oversight Report, May 2024 Reg S-P 17 CFR Part 248 amendments, NY DFS 23 NYCRR 500, NAIC AI Model Bulletin + Model #275, and the state DOI patchwork. Every L5 lesson on data governance, disclosure, organizational design, client experience, and agentic AI operates inside it.
• The seven mandatory sections: acceptable use (approved tools and use cases, prohibited tools and use cases), vendor approval (L4 Ch2 L1/L2 scorecard and questionnaire, ADV material-change check), data classification (4 classes with explicit NPI handling and anonymization workflow), training (FINRA Rule 1240 Firm Element CE + CFP Board CE alignment, niche-owner additions, M&A onboarding fast-track), supervision (Rule 2210 principal review, Rule 3110 + L4 Ch3 L3 agentic-AI WSPs, Rule 4511 retention), incident response (Reg S-P 30-day, NY DFS 72-hour, Rule 4530 + L5 Ch7 L4 Form U4 DRP if applicable), audit and amendment (annual audit + Marketing Rule audit per L4 Ch7 L1 + ADV annual amendment per L5 Ch7 L6 + off-cycle prompt amendments under IA-1992).
• The regulatory anchor matrix maps every section to specific rules: Marketing Rule 206(4)-1 + January 2026 SEC staff FAQs + 2024-2025 Delphia/Global Predictions, Reg BI §240.15l-1, FINRA Rules 2210/3110/4511 + 2026 Annual Regulatory Oversight Report + Reg Notice 24-09, SEC Rule 204-2, SEC Compliance Rule 206(4)-7, Reg S-P 17 CFR Part 248 (May 2024), GLBA Safeguards, NY DFS 23 NYCRR 500, NAIC AI Model Bulletin + Model #275, FINRA Rule 1240, IA-1992 ADV standards.
• The aggregator/network overlay: network-level baseline that members cannot weaken (centralized infrastructure, vendor approval, IRP); member-level adds for locally chosen tools and member-specific incidents; OSJ layered Rule 3110 systems harmonize with home-office; wirehouse channels operate under single home-office policy.
• The ADV Part 2A AI disclosure paragraph is the client-facing client-perception artifact — names AI tool categories, frames AI as advisor-workflow support not recommendation-maker, anchors recommendations to the registered individual's fiduciary duty under the Advisers Act of 1940 and Reg BI §240.15l-1, references Reg S-P 17 CFR Part 248 NPI handling, and is updated through the L5 Ch7 L6 annual amendment workflow.
• Aggregator case study: $14B network with 240 advisors rolled out 47-page policy in Q1 2026 with 4 draft cycles over 90 days. Outcomes through Q2 2026: zero Marketing Rule risk-alert flags, one minor Reg S-P incident handled within 14 days, zero Form U4 DRP filings tied to AI, L4 Ch8 L1 supervisory-architecture score moved 7/10 → 9/10. The policy is now the single most-cited artifact in the firm's M&A diligence pack.