SEC Reg S-P and Shadow AI: The Vendor You Never Approved
Both Regulation S-P compliance dates have passed. And the most likely gap in your service provider oversight is not a vendor you chose badly. It is one an employee added for you, in a browser tab, without telling anybody.
Last updated . Written for registered firms by Accelerated Exposure.
The dates are behind you, not ahead
| Entity size | Compliance date | Status |
|---|---|---|
| Larger entities | 3 December 2025 | Passed |
| Smaller entities | 3 June 2026 | Passed |
Covered institutions are brokers, dealers, investment companies, registered investment advisers, funding portals and registered transfer agents. There is no small firm exemption. There was only a later start date, and it has been and gone.
What you were required to have in place
- A written incident response program to detect, respond to and recover from a breach of customer information
- Notification to affected individuals within 30 days
- Service provider oversight, with arrangements requiring vendors to notify you within 72 hours of becoming aware of a breach
- Records retained for five years documenting compliance
Where the gap actually is
Most firms wrote the vendor language, sent the questionnaires, and filed the responses. That work assumed one thing: that the firm knows who its service providers are.
The numbers are not marginal. Roughly 11 percent of the data employees paste into ChatGPT is confidential, and surveys of thousands of workers across multiple countries found that 38 percent of those using AI tools had submitted sensitive work information without their employer's knowledge. Once it is sent, it cannot be retrieved.
Why this is worse than an ordinary vendor failure
- It is invisible. The traffic is ordinary encrypted web browsing to a normal website. It leaves no trace in your systems and no line in any log you review
- It is unbounded. You cannot scope what you cannot see, so you cannot tell an examiner how much client information left the building
- The burden is yours. The rule asks you to demonstrate oversight. "We were not aware staff were doing that" is not a defence. It is the finding
- It grows quietly. Every new hire arrives already fluent in these tools and assumes using one is normal
What actually fixes it
Not a ban. Bans on useful tools produce more shadow use, not less, and drive it onto personal devices where you have no visibility at all.
- A written AI acceptable use policy naming what may never be entered into a public tool, with worked examples from your own business
- An approved tool list, on paid tiers that carry an actual data agreement and can be named in your vendor inventory
- Staff training with attestation, so the record shows who was told what and when
- A current vendor inventory that reflects the tools genuinely in use, not the ones procurement approved two years ago
- An evidence file, because demonstrating governance is the actual obligation
- Annual refresh, as staff turn over and new tools appear
The line we do not cross
We are not a compliance consultant to a registered firm, we do not give SEC advice, and nothing here is legal advice. Your chief compliance officer or your counsel owns the judgment on whether your program is adequate.
What we build is the documentation that judgment rests on: the acceptable use policy, the training and its attestation record, the inventory of what your people are genuinely using, and the evidence file. That is the part firms most often cannot produce, and it is the part that does not require a licence to write.
Common questions
Does Regulation S-P apply to my firm?
If you are a broker, dealer, investment company, registered investment adviser, funding portal or registered transfer agent, yes. The amended rule reaches every covered institution holding customer information, and there is no small firm carve out, only a later start date. Larger entities had to comply by 3 December 2025. Smaller entities had until 3 June 2026. Both of those dates have now passed, so the question is no longer whether you need a program but whether the one you have would survive an examination. Firms that assumed the rule was aimed at large broker dealers are the most exposed, because the substantive obligations are identical and only the deadline differed. If you are registered and you hold customer information, you are covered, and the burden of demonstrating compliance sits with you rather than with the examiner.
Is an employee using ChatGPT a Reg S-P service provider problem?
Yes, and it is the part most firms have not worked through. When someone pastes client information into a public AI tool, they have introduced a service provider into your customer data flow. Not a vendor you selected, assessed and contracted, but one added silently by a member of staff. The rule requires policies reasonably designed to ensure service providers notify you of a breach involving customer information as soon as possible and no later than seventy two hours. A free tier consumer account carries no such obligation, no data processing agreement, and no contractual relationship with your firm at all. So your service provider oversight program is incomplete by definition, and you cannot measure how incomplete, because the traffic is ordinary encrypted web browsing that leaves no trace in your systems. That is the gap an examiner will ask you to size, and you will not be able to.
What does a Reg S-P incident response program have to contain?
At minimum it must be written, and reasonably designed to detect, respond to and recover from unauthorised access to or use of customer information. It has to include procedures for assessing the nature and scope of an incident, containing and controlling it, and notifying affected individuals within thirty days where their sensitive customer information was, or is reasonably likely to have been, accessed. It must extend to your service providers, with arrangements requiring them to notify you within seventy two hours of becoming aware of a breach. And you must retain records documenting compliance for five years. A plan that lives in one person's head, or a template downloaded and never adapted to how your firm actually operates, satisfies none of that. The test is not whether a document exists. It is whether the document describes what your firm would genuinely do on the day it matters.
Now you have a guy
Accelerated Exposure is a Greater Toronto Area firm working on both sides of the border. We watch for the surprises that hit businesses so the people running them do not have to go looking. Compliance is one arm of that. The rest of what we do is growth.
- AI integration that arms your staff rather than replacing them
- Competitive intelligence and getting found in AI search
- Reactivating the customers who quietly stopped calling
- Compliance across privacy, accessibility, hiring, transport and trade
See everything we do or book a free briefing. The briefing costs nothing and there is no pitch.