AI has moved from novelty to normal in many FAPs. Advisers are using it to draft file notes, summarise client meetings, and speed up research and correspondence. The tools are useful — but in most firms adoption has happened informally, one adviser at a time, without a documented position on what is allowed, what is not, and who is accountable.
Why this is now a compliance issue
Two things have changed. Privacy Act 2020 obligations — including the new IPP 3A requirements around automated processing — are now in force. And the FMA has signalled clear expectations that AI used in regulated advice must sit within proper governance, with competent human review. For FAPs, AI is no longer just an efficiency question; it touches your Standard Conditions, including outsourcing and your technology systems.
What good AI governance looks like
Good governance does not mean banning AI. It means deciding, at governance level, which categories of tool are approved, how client and personal data may and may not be used, who is accountable, and where human sign-off is mandatory. The principle most firms land on is simple: AI can assist, but a competent person stays responsible for the output. AI-assisted file notes with human review are fine; AI-fabricated records or fully automated regulated advice are not.
You do not have to build it from scratch
Building this from a blank page is real work. Strategi has developed an AI Tool Approval Framework designed for exactly this — a board-ready package that helps a FAP set its AI policy, assess individual tools against clear criteria, and evidence the decision. It comes as three companion documents: the framework itself for the board to approve, an assessment checklist for evaluating tools, and an explanatory booklet with worked examples. It is provider-neutral, so it works whatever tools your team uses.
If AI is already part of how your advisers work — and in most firms it is — now is a sensible time to put governance around it.