Stop giving AI the whole inbox

Most RIA teams already use AI. ACA Group's 2026 survey found that 80% of respondents do, mostly approved for internal use only. "Internal only" says where AI can run. It doesn't say what records can move, what the model sees or whether anyone can reconstruct a suggestion later.

The better starting point is one workflow, with its data path designed first.

The pattern, using a morning brief

• Start with one job. For example, an internal morning brief built from yesterday's email, meetings and CRM activity, with two or three suggested follow-ups.

• Map the data first. Decide which systems, records, time window and fields the workflow can use. "Everything in the inbox" isn't a data contract. ACA found only 34% of respondents had mapped their nonpublic personal information.

• Tokenize identities. John Doe becomes person_001 everywhere in that packet, so the model can connect records without seeing the raw identity. The token map stays with the firm. If detection is unsure, block the record or route it for review.

• Send a work packet, not a data dump. The model gets a small packet for one task and returns suggestions only. It doesn't send the email or edit the CRM.

• Test the failure cases. A missed name, two households with similar names, a suggestion with no supporting record, a vendor outage. Decide what happens in each one.

• Keep the operating record. Sources, time window, policy and model versions, what was blocked, the evidence and the human decision.

Why it matters

Regulation S-P requires incident response that can detect, respond to and recover from unauthorized use of customer information, with customer notice within 30 days in most cases. That's hard to do without record-level traceability. This pattern doesn't replace vendor diligence, security review or counsel, but it gives a firm one AI workflow it can inspect, improve and reuse.

This is a short version of an issue of The Prodocol, our newsletter on LinkedIn. Read the full issue or subscribe to The Prodocol.