AI compliance obligations for an IFA / RIA in the EU

AI compliance obligations for an IFA / RIA in the EU

4 AI-adoption compliance obligations apply, each cited to primary law.

AI in the advice chain does not move the suitability duty off the adviser

Rule: MiFID II Art 24 & 25

What it requires: An independent adviser giving personal recommendations must act honestly, fairly and professionally in the client's best interests and ensure each recommendation is suitable. Where an AI tool drafts, screens or scores part of that recommendation, the firm keeps full responsibility for the outcome; the tool is inside the suitability process, not a substitute for it.

Do this: List every AI tool that can touch a recommendation or suitability assessment and require a named adviser to sign off the output before it reaches the client. Keep the suitability report the record, whether or not a model helped write it.

Source: Directive 2014/65/EU (MiFID II), Articles 24-25; ESMA Public Statement on the use of Artificial Intelligence in the provision of retail investment services, 30 May 2024 (ref ESMA35-335435667-5924).

Confidence: Sourced

Record the advice work the AI helps produce

Rule: MiFID II Art 16(6)

What it requires: The firm must keep records of all services, activities and transactions sufficient for the competent authority to monitor compliance, including where an AI system drafted or supported a suitability report or client recommendation.

Do this: Log which AI tool was used, on what input, and who reviewed the output, stored against the client's suitability file so the record of the advice is complete with or without a model in the loop.

Source: Directive 2014/65/EU (MiFID II), Article 16(6).

Confidence: Sourced

Retain the client communications an AI tool touches

Rule: MiFID II Art 16(7)

What it requires: Records of electronic communications relating to (at least) the reception, transmission and execution of orders must be kept and retained for five years, extendable to seven by the competent authority. An AI that drafts client emails or summarises advice calls is producing records that carry this obligation.

Do this: Point any AI that drafts client emails, transcribes advice meetings or summarises calls at a retained store, not an ephemeral chat. The retention duty attaches to the communication, not to the tool.

Source: Directive 2014/65/EU (MiFID II), Article 16(7); Commission Delegated Regulation (EU) 2017/565, Article 72.

Confidence: Sourced

Guard automated advice decisions and disclose AI to the client

Rule: GDPR Art 22 & AI Act Art 50

What it requires: A client has the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (GDPR Art 22). Separately, under the EU AI Act, people must be told when they are interacting with an AI system unless it is obvious (Art 50 transparency).

Do this: Keep an adviser in the loop on any client-affecting decision, and add a short AI-use disclosure to advice material where a model contributed, the same disclosure Serra puts on its own briefings.

Source: Regulation (EU) 2016/679 (GDPR), Article 22; Regulation (EU) 2024/1689 (AI Act), Article 50.

Confidence: Sourced