Advisory firms told to put AI and cybersecurity policy in writing

Advisory firms weighing AI-assisted drafting and cloud tools should put the rules in writing, according to a WealthManagement.com column published Nov. 4. The column, aimed at private-client estate-planning practices, said a written policy gives staff clarity, sets a framework for training and shows the firm has acted deliberately on its professional responsibilities.

Some insurance carriers ask on cybersecurity applications whether a formal policy exists. The policy should settle who can reach confidential information, when a higher-security channel is required, how third-party processing may affect privilege and what governance covers generative AI. Firms that still operate partly on paper need digital safeguards alongside locked file cabinets, and the column calls for annual or more frequent reviews because the technology shifts quickly.

For advisory operators, the immediate use is a document that answers that question and defines access rules for staff already using AI-assisted drafting. Reasonableness rather than perfection is the governing standard, the column said.