NIST's GenAI Profile supports risk identification around misuse, information integrity, privacy and human oversight. It is not itself a statute or guarantee that a tool is “compliant”. Keep source-of-truth financial numbers outside unapproved third-party products; obtain a processor's written retention, training and subcontractor policies; and test deletion and access controls. NIST Generative AI Profile, AI RMF
For an adviser using AI in delivery, require disclosure of what is uploaded, how the model output is checked, whether client data is reused, who owns work product, and whether recordings are made. Incident response and conflict protocols matter more than a generic “AI-powered” promise.