Story · Financial services · Compliance
AI policy and SEC compliance for a financial services firm
A registered advisory firm wanted to use AI tools and knew the regulator would ask how. Their building move became the trigger for something bigger: retiring the on-premises server, moving files to SharePoint, standing up security monitoring, and writing the policy first.
The situation
The firm's first instinct was to get rid of the server as part of the move. We pushed back. They had recently bought a backup server; throwing it out was a sunk cost worth a real conversation about why they wanted to change, and what the SEC would expect of whatever replaced it.
What they actually wanted was to work anywhere, keep records the way the rules require, and let staff use AI without anyone pasting a client's account into a public chatbot.
What we did
The AI policy came first: what tools are approved, what data may never leave the firm, how usage is logged, who reviews it. Then the platform to enforce it. Files moved from Box to SharePoint with retention rules matched to the record-keeping requirements. Security monitoring went in so every login and file access is logged and alertable. Copilot Enterprise was rolled out inside that boundary, where client data stays in the tenant.
The server was retired at the end, once its replacement was proven, not at the beginning because a move made it convenient.
"The question was never whether to use AI. It was whether they could show the regulator exactly how."
How the account manager puts itWhat changed
ResolvedA firm that works from anywhere, a written policy the compliance officer can hand to an examiner, and AI in daily use with client data that never leaves the tenant.
The guide behind this story
Template and guideAn AI usage policy for a small business, in two pages
What to put in it, why consumer AI tools are the real risk, and how a regulated firm rolls out Copilot without the examiner flinching.
Read the guideOrder the internet circuit the week the lease is signed. Carriers take six to twelve weeks. Nothing else on a move fails as often.
The relocation checklist Did you knowA backup that has never been restored is a hope, not a plan. Ask for the date of the last tested restore.
What to actually testQuestions people ask about this
Can a regulated firm use Copilot or ChatGPT?
Yes, with the right edition and the right boundaries. Enterprise tools keep your data inside your tenant. Consumer tools do not, and the policy has to say so.
What does an AI policy actually contain?
Approved tools, prohibited data, logging and review, training, and who owns exceptions. Two pages, in plain English, that staff will actually read.
"Service is excellent, quick to respond and quick to complete. Thank you!"
Cheri, small businessMore from the survey wall- A technician who knows your setup takes every request. Not a dispatcher, not a queue.
- Every closed ticket is surveyed and a partner reads every response.
- 99.5% of surveys come back positive.
- Family-owned since 2005. 21 years in the same corner of Wisconsin, not going anywhere.
"Thanks for the hard work. I was kept informed with regular updates until the concern was resolved."
Jeff, insurance brokerageRegulated and curious about AI?
There is a safe way to do it. We have written the policy before.
Talk to a partnerTalk to a partner, not a sales script.
Tell us what is going on. A partner will call you back the same business day, look at what you have, and tell you honestly whether we are the right fit. No pricing pressure, no pitch deck.