Most advisory firms we talk to have already got an AI tool running somewhere. A meeting note-taker. A draft generator for SOAs. Maybe a chatbot on the client portal answering basic questions. What almost none of them have is a written answer to a simple question: what client data can that tool actually see, and who checked?

That gap used to be a minor operational untidiness. It’s becoming a regulatory problem. As AI tools move from novelty to daily use in advice businesses, regulators are starting to ask firms to prove their AI systems operate within a defined scope, not just that the outputs look reasonable. If you can’t show which systems touch which data, and what stops them going further than they should, you’ve got a governance hole that’s going to get more expensive to fix the longer it sits open.

This piece walks through what that governance actually looks like in practice for a firm doing $1M-25M in revenue, where the real risk sits, and how the same audit process that finds your automation opportunities also gives you the documentation regulators are starting to expect.

Why “it works fine” isn’t the same as “it’s governed”

Ask most principals whether their AI tools are safe and you’ll get a version of “yeah, we’ve tested it, it does what we need.” That’s a usability answer, not a governance answer. Governance is about boundaries, not performance.

A meeting-prep tool that pulls portfolio data, recent communications, and goal progress into a briefing note is genuinely useful. It’s also a tool with access to some of the most sensitive data in your firm. Does it pull from every client’s file or just the one on today’s calendar? Does it retain what it read after the brief is generated? Does the vendor’s model train on your data, and did anyone actually read that clause in the terms? These aren’t hypothetical questions anymore. They’re the exact things an ASIC or SEC-style review is starting to ask, and “we assume it’s fine” doesn’t hold up as an answer in a file note.

The firms getting caught out aren’t the ones doing something reckless. They’re the ones who adopted a tool quickly because it saved time, never wrote down its access scope, and now can’t produce a document showing what it can and can’t touch. That’s a governance gap, and it sits quietly until an audit or a client complaint forces it into the open.

The three places AI touches client data right now

Most advisory firms have AI creeping into three areas, often without anyone deciding that on purpose.

Meeting prep and client communication. Advisers spend 5-10 hours a week per person pulling together notes, portfolio summaries, and follow-ups before and after client reviews. A lot of firms have started feeding transcripts or CRM data into an AI tool to speed this up. That’s sensible. It’s also a system now touching every client’s goals, balances, and personal circumstances, often through a browser extension or a consumer-grade tool that was never vetted for data handling.

Advice documentation. SOAs, ROAs, and file notes are exactly the kind of structured, repetitive writing AI is good at drafting. Paraplanner time on a single advice document typically runs $3,000-8,000 in cost once you count drafting, review, and rework cycles that stretch into weeks. Firms using AI to speed this up need to know exactly what source data fed the draft and whether the tool is storing client financial detail somewhere outside the firm’s own systems.

Onboarding and KYC. New client onboarding commonly takes 30-60 days from first meeting to fully active file. Fact-finding, document collection, and risk profiling all involve collecting sensitive identity and financial information, often before a formal advice relationship is even confirmed. If an AI tool is helping run that fact-find, it’s handling data at the most vulnerable point in the client relationship, before your usual controls have even kicked in.

None of this means don’t use AI in these areas. It means each one needs a written answer to “what can this tool see, for how long, and who’s checked it recently.”

What a documented access map actually looks like

A governance document for AI agents doesn’t need to be a 40-page compliance manual. For a firm your size, it’s usually a single register, one row per tool, covering five things.

What data source it connects to. CRM, portfolio system, email, document store, whatever it’s plugged into.

What it’s allowed to read versus write. A tool that only reads meeting transcripts is a different risk profile to one that can update client records directly.

Where the output goes and who reviews it before it’s used. Draft SOAs should never go straight to a client without adviser sign-off, and that step needs to be named, not assumed.

How long data persists in the tool itself, and whether the vendor can access or train on it. This is the clause most firms never actually read.

Who owns the tool internally and how often its access gets reviewed. Ownership drifts fast in a growing firm. Someone needs to be named against every tool.

This is the exact kind of artifact an auditor or licensee compliance team wants to see. Not because it proves nothing ever goes wrong, but because it proves the firm understood the risk and built a control around it. Firms that can produce this document in a review move through it in a fraction of the time of firms that can’t. If you want a sense of how this fits into the broader documentation your firm should already be building, our guides library has a few pieces on structuring compliance workflows around AI tools rather than bolting AI onto existing ones.

Where a named agent actually helps, and why scope matters more than speed

We build these systems for advisory firms every week, and the ones that hold up under scrutiny share one trait. They’re scoped narrowly on purpose, not because the technology can’t do more, but because doing more isn’t the job.

The Meeting Prep Agent pulls portfolio data, recent communications, and goal progress into a one-page brief the adviser reads before every client meeting. It has read access to exactly the client on the calendar for that meeting, nothing else, and it doesn’t retain the pulled data after the brief is generated. That’s a deliberate design choice, not a limitation. An adviser walking into a review with a clean, current brief saves hours a week. A tool that can browse every client file in the firm to build that brief is a liability wearing a productivity tool’s clothes.

The Advice Document Agent drafts SOAs, ROAs, and file notes from meeting transcripts and the firm’s own compliance template. It works from the transcript and the template, produces a draft, and stops. A human reviews and signs off before anything reaches a client. That review step is the governance control. Documented, named, logged. It’s also the step that turns a $3,000-8,000 document cycle into something a paraplanner can turn around in a day rather than three weeks, without giving up the oversight that makes the output defensible.

The Client Onboarding Agent runs a guided fact-find with new clients, collects KYC documents, and prepares a clean onboarding pack for the adviser. Because onboarding sits at the point where identity and financial data first enter the firm, this agent’s access map matters more than almost any other tool you’ll deploy. Done right, it cuts the 30-60 day onboarding window down significantly while giving you a cleaner audit trail of exactly what was collected, when, and from where, than most manual onboarding processes ever produce.

Two things worth noticing across all three. First, none of them write directly to client-facing outputs without a human step in between. Second, each one has a defined, narrow scope rather than broad access “just in case.” That’s what governance actually looks like in a working system, not a policy document sitting in a folder nobody opens.

For a deeper look at how these ops agents get built and scoped for a firm your size, Omni Ops covers the build process end to end.

The dollar cost of not knowing your own AI footprint

The direct time cost of manual meeting prep, document drafting, and onboarding is the number most firms focus on first, and it’s real. We typically see firms this size carrying $70,000-200,000 a year in adviser and paraplanner time lost to exactly the three areas above. That’s the number that shows up on a P&L if you go looking for it.

The governance cost is harder to see until it isn’t. A regulator asking for evidence of AI access controls and getting a shrug instead of a document is a finding, not a warning. Remediation after a finding costs more than building the control up front, and it costs credibility with your licensee or your clients on top of the compliance work. Firms that get ahead of this now are documenting as they build, not scrambling to reconstruct an access history after the fact.

Where to start without slowing your firm down

You don’t need to freeze every AI tool in the business while you build a perfect governance framework. That’s not realistic and it’s not necessary. What you need is a clear picture of what’s running, what it touches, and where the gaps are, so you can close the ones that matter first.

That’s what an Omni Audit gives you. It’s a 60-minute session, no deck, no sales pitch dressed up as a workshop. We map every place AI is touching client data or repetitive work in your firm right now, whether you built it deliberately or it arrived through a browser plugin someone installed last year. You walk out with three things: a written map of your current AI access points and gaps, a shortlist of the manual work costing you the most hours, and a plan for which agent to build first if you decide to go further.

If you want to see how this applies specifically to a firm your size, see Omni for financial advisory firms before the call, so we’re not starting from zero on the phone. And if you’re ready to get the audit on the calendar, you can Book a 60-min Omni Audit directly.

The firms that get ahead of this

The advisory firms handling this well right now aren’t the ones with the most sophisticated AI stack. They’re the ones who can answer a simple question clearly, for every tool they use: what does it see, what can it do, and who’s checking. That’s not a technical bar. It’s a documentation habit, and it’s one most firms can build in a matter of weeks once they know where to look.

We’ve written more broadly about how AI adoption is playing out across advice and professional services firms in our insights collection, and if you’re earlier in the process of deciding what to automate first, the blog has practical breakdowns of where firms usually start. But if governance and access mapping is the immediate itch, that’s exactly what the audit is built for.

Book the audit for financial advisory firms, or go straight to the calendar and book my Omni Audit. Sixty minutes, three outputs, and a clear answer to the question your next compliance review is going to ask anyway.