A perspective piece in SC Media laid out four ways AI agent deployments go wrong before anyone notices. No defined data boundaries. No human checkpoint on high-stakes decisions. No audit trail worth showing a regulator. No ownership once the agent is live and quietly making calls on its own.

For most industries that’s a compliance headache. For a financial advisory firm it’s the whole business model. You hold client money, client data, and a fiduciary duty that doesn’t pause because a piece of software drafted the recommendation. If you’re running AI anywhere near portfolio analysis, client communication, or advice generation, these four mistakes are the ones worth fixing before your next audit, not after.

The gap between “we use AI” and “we govern AI”

Most firms in the $1M-$25M range we talk to have already started using AI somewhere. A paraplanner drafting file notes with an assistant. An adviser running portfolio summaries through a chatbot before a client call. Usually this starts informally, one person finds a tool that saves them two hours a week, and it spreads by word of mouth.

The problem isn’t the tool. It’s that nobody wrote down what it’s allowed to touch, who signs off before it talks to a client, and how you’d reconstruct its reasoning if ASIC, the FCA, or the SEC came asking six months from now. That gap between informal use and actual governance is where the real risk sits, and it’s exactly the gap the SC Media piece is describing.

Mistake 1: No defined boundary on client data access

The first mistake is the simplest and the most common. An agent gets connected to a CRM, a portfolio management system, or a document store, and it’s given broad access because narrowing it down felt like extra setup work. Nobody defined which fields it can read, which it can write to, or which client segments are off-limits (trusts, SMSFs, anything under a compliance flag).

This matters more in wealth management than almost anywhere else. A single client record can include account balances, beneficiary details, tax file numbers, health information tied to insurance advice, and family relationship data. If an agent has blanket access to pull any of that into a summary or a draft communication, you’ve created an exposure that didn’t exist when a human paraplanner was the only one touching the file.

The fix isn’t complicated, it’s just deliberate. Define access at the field level, not the system level. A Meeting Prep Agent that pulls portfolio data, recent comms, and goal progress into a one-page brief doesn’t need write access to anything, and it doesn’t need to see legal or trust documents unless the meeting is specifically about them. Scoping access this tightly takes an extra day of setup and it’s the difference between a tool you can explain to a regulator and one you can’t.

Mistake 2: No human checkpoint before recommendations go out

The second mistake is letting an agent’s output reach a client without a person reviewing it first. This is the one that keeps compliance officers up at night, and for good reason. An AI agent can draft a portfolio rebalancing suggestion, a fee restructure, or a risk profile update that reads perfectly and is subtly wrong, wrong asset allocation for the stated risk tolerance, wrong assumption about a client’s timeline, a fact that changed three months ago that the agent never saw.

The SC Media piece frames this as defining “which recommendations require human approval.” In practice that means drawing a line between drafting and deciding. An agent can prepare a Statement of Advice, a Record of Advice, or a file note from a meeting transcript, that’s exactly what our Advice Document Agent does, pulling from the meeting recording and the firm’s compliance template. But nothing goes to a client, and nothing gets filed as final advice, until an adviser has read it and signed off.

Firms that skip this step usually don’t skip it on purpose. It happens gradually, someone gets comfortable with the drafts being accurate 95% of the time and starts letting the other 5% slide through unchecked. That’s not a technology failure, it’s a process failure, and it’s the kind regulators are now specifically trained to look for.

Mistake 3: No audit trail for what the agent actually decided

The third mistake is the one that turns a minor issue into a real problem during a review. If an agent influenced a recommendation, a client communication, or a file note, and nobody can reconstruct why it produced that output, you have no defensible record. You can tell a regulator what your process is supposed to be. You can’t show them what actually happened on March 14th when a specific client got a specific piece of advice.

Every agent action needs a log. Not a vague “AI-assisted” note in the file, but a record of what data the agent pulled, what template or prompt it used, what output it produced, and who reviewed and approved it before it went further. This is the same discipline advisory firms already apply to human advisers through file notes and version control on SOAs. Agents don’t get an exemption from that just because they’re faster.

This is also where a lot of firms discover their existing AI use has been running without any of this in place. If you’ve had a tool live for six months and you can’t produce a clean audit trail for it today, that’s worth fixing before it’s a finding rather than a fix. It’s one of the first things we check when we run the AI audit for financial advisory firms, because it’s usually the gap firms didn’t know they had.

Mistake 4: Treating governance as a setup task instead of an ongoing job

The fourth mistake is assuming governance is something you do once, at rollout, and then move on from. Models get updated. Data sources change. An agent that was scoped correctly in January might be pulling from a new integration by June that nobody re-reviewed. Ownership drifts, the person who set up the rules leaves or changes roles, and nobody inherits the responsibility of checking whether the rules still hold.

Good governance names an owner. Someone in the firm, usually a principal, a compliance lead, or an ops manager, who reviews agent access and output quarterly, not annually. That review doesn’t need to be a big production. It’s a short checklist: what can each agent access, has that changed, what’s the approval rate on its drafts, has anything gone out that shouldn’t have. Firms that build this into a quarterly rhythm rarely get surprised. Firms that don’t, usually find out the hard way, right around the time a regulator asks for evidence.

What this looks like when it’s built right

We build three agents most often for advisory and wealth management firms, and each one is a useful case study in how governance should actually work day to day.

The Meeting Prep Agent pulls portfolio data, recent communications, and goal progress into a one-page brief before every client meeting. It has read-only access, scoped to the specific client on the calendar for that day, nothing else. Advisers currently spend somewhere between 5 and 10 hours a week on prep and write-up for client reviews, time that’s rarely billable and almost always squeezed into evenings. The agent doesn’t decide anything. It assembles what a human needs to decide faster.

The Advice Document Agent drafts SOAs, ROAs, and file notes from meeting transcripts against the firm’s own compliance template. This is the agent doing the most consequential work, so it’s also the one with the tightest human checkpoint. Every draft goes to the adviser for review before it’s finalized or sent. Paraplanner time on a single advice document typically runs $3,000 to $8,000 in fully loaded cost once you count drafting, review cycles, and compliance sign-off, and cycle times stretch into weeks when everything’s manual. The agent cuts the drafting time down dramatically. It does not cut the review step. That stays with a licensed human, every time, and the system logs who approved what and when.

The Client Onboarding Agent runs a guided fact-find with new clients, collects KYC documents, and prepares a clean onboarding pack for the adviser. Onboarding at most firms takes 30 to 60 days from first contact to fully active client, and a lot of that time is chasing documents and re-asking questions that should have been captured the first time. This agent has access scoped only to the specific new client’s intake file, nothing from existing client records, and every document it collects is logged with a timestamp and a clear chain of custody.

Notice the pattern across all three. Scoped data access. A human checkpoint on anything that reaches a client or becomes part of the compliance file. A logged trail of what happened and who signed off. That’s not a bolt-on compliance layer, it’s the design itself. If you’re building or buying agents for your firm, this is the standard to hold them to, and it’s worth reading through how we think about it more broadly on the Omni ops page before you commit to a build.

The dollar reality behind the governance conversation

Governance sounds like a cost center until you look at what the manual version of this work is actually costing you. Firms in the $1M-$25M range typically leave $70,000 to $200,000 a year on the table between unbilled adviser prep time, paraplanner hours burned on documentation cycles, and stalled onboarding that delays revenue on new clients or loses them altogether before they ever become billable.

The instinct at that point is to move fast and plug an AI tool into whichever process hurts the most. That’s exactly the instinct that leads to the four mistakes above. The firms that get this right aren’t slower to adopt AI, they just build the access rules, the approval checkpoint, and the audit log in from day one instead of retrofitting them after a close call. It’s cheaper and faster to do it that way, not just safer.

If you want a broader look at how firms in professional services are thinking about this trade-off, our insights section has a few pieces on where AI adoption is outrunning governance across other regulated industries, and the guides library has practical breakdowns on scoping agent access if you want to see the mechanics before you commit to anything.

Where to start without another six-month project

You don’t need a governance framework document before you can move. You need to know, specifically, where your firm’s time and money is leaking, and which of that work an agent can safely take on with the right boundaries built in from the start.

That’s what an Omni Audit gives you. It’s a 60-minute session, no deck, no generic AI pitch. We walk through your actual workflow, adviser prep, documentation cycles, onboarding, whatever’s costing you the most hours, and you walk away with three concrete things: where the time is going, what a properly governed agent would look like for your specific process, and a rough dollar figure on what fixing it is worth to your firm this year.

Book a 60-min Omni Audit if you want to see this against your own numbers rather than a generic range. It’s the fastest way to find out whether your firm’s exposure looks like the four mistakes above or whether you’re already ahead of most of the market.

The bottom line for advisory firm owners

AI agents are already inside advisory firms, whether or not there’s a policy document that says so. The SC Media piece is right that the mistakes are consistent and avoidable, undefined data access, no approval checkpoint, no audit trail, no ongoing ownership. None of those require you to slow down on AI. They require you to build it properly the first time.

If you’re not sure where your firm actually stands on any of this, that’s a reasonable place to start. See Omni for financial advisory firms and get a clear picture of your specific exposure before it becomes someone else’s finding. You can also browse how we’ve built these agents for other firms your size in our advisory practice notes, or book my Omni Audit directly and we’ll walk through your numbers together.