Is this investment advice?

No. Serra Education provides process and tooling consulting only, never Serra Wealth investment advice. What you get here is a process-and-governance guide, not legal, investment, or compliance advice. Use it to structure your own decisions, and confirm every obligation against the primary source and your own counsel.

The blocker isn't the model — what is it?

It is the audit trail. Most wealth firms have already tried AI somewhere. Far fewer can show a reviewer where the data went, who checked the output, and how the decision would be reconstructed if a regulator asked. The binding constraint sits in the workflow around the model, not in the model you pick.

Do these obligations change if I switch AI tools?

No. None of the rules regulate which model you use. They regulate whether a human owns the output, whether client data stays contained, whether client-facing AI is disclosed, and whether you can reconstruct what the model did. A firm can swap one model for another and change nothing about its compliance position.

Where do the finder briefings come from?

Primary law, read by a person. Each obligation is sourced to the actual article, MiFID II, the GDPR, the EU AI Act, the FCA Handbook, ICO guidance, not to a scraped summary. Every line carries a citation and a confidence badge, and a person reviews each briefing before it is published.

How does the paid path work, and what does it cost?

It is three steps, in order, and the paid step is never first. Start with a free one-page report for your firm. Then a free 15-minute intro call. If it is useful, a 60-minute optimisation session is 250 EUR, and that fee credits in full toward a Tier 1 audit, which runs 2,000 to 10,000 EUR depending on firm size and the number of workflows in play.

Can I put live client data into an AI tool to test this?

Do not. Keep live client data out of any general-purpose AI tool. The report on this page is produced from a prompt you run inside your own environment, no client data leaves you, and Serra never asks you to send client data. Any real-data workflow needs a contracted tool, a lawful basis, and a data-protection impact assessment first.

Is Serra vendor-neutral?

Yes. Serra Education does not resell an AI stack, so the recommendation is what works in your firm, not what pays a referral. The engagement is about the governance around the model, which is portable across whichever tools you already run.

AI compliance obligations for a single family office in the UK

4 AI-adoption compliance obligations apply, each cited to primary law.

A single family office is generally outside the FCA regulated-activity perimeter

Rule: RAO exclusions / FCA perimeter (PERG)

What it requires: The Consumer Duty and SM&CR apply to authorised firms carrying on regulated activities for clients. An SFO acting only for its own family's capital, not by way of business for third parties, can generally rely on exclusions in the Regulated Activities Order and is not an authorised person — so those conduct regimes do not attach to it.

Do this: Confirm and document that the office acts for one family only and holds no permissions to deal with external clients, and re-check the boundary before taking on any outside capital — external clients pull the office back into the FCA perimeter (and the MFO obligations).

Source: Financial Services and Markets Act 2000 (Regulated Activities) Order 2001; FCA Perimeter Guidance (PERG).

Confidence: Sourced

Run a data-protection impact assessment before high-risk AI processing

Rule: UK GDPR / ICO DPIA

What it requires: Outside the conduct perimeter an SFO still processes personal data of family members, beneficiaries and counterparties. Where AI processing is likely to result in a high risk to individuals, UK GDPR requires a Data Protection Impact Assessment before processing begins.

Do this: Complete a DPIA (the ICO template is a good start) before putting family or beneficiary data through a new AI tool, and keep a human decision-maker on any significant outcome. This duty applies whether or not the office is FCA-authorised.

Source: UK GDPR Articles 22 and 35; ICO guidance on AI and data protection / DPIAs. (Art 22 automated-decision provisions are reframed as Arts 22A-22D by the Data (Use and Access) Act 2025, in force 5 Feb 2026.)

Confidence: Sourced

Keep a person on any significant automated decision and disclose AI use

Rule: ICO guidance on AI & automated decisions

What it requires: The ICO's AI and data-protection guidance requires transparency about AI-assisted processing and meaningful human involvement before a solely-automated decision produces a significant effect on an individual. This binds any organisation processing UK personal data, regulated or not.

Do this: Add an AI-use note where a model interacts with family members or processes their data, and ensure a person, not the model alone, makes any decision that significantly affects an individual.

Source: UK GDPR Article 22 (reframed as Arts 22A-22D by the Data (Use and Access) Act 2025, in force 5 Feb 2026); ICO guidance on AI and data protection (explaining decisions made with AI).

Confidence: Sourced

Keep orderly AI records even without a conduct regulator

Rule: Records & governance (prudential)

What it requires: An SFO has no SYSC 9.1 record-keeping duty, but audit trails still matter for tax, trust and succession governance and to evidence its DPIA and AI-transparency steps. AI drafting or summarising should not happen in an unretained way.

Do this: Point AI tools that draft memos, summarise meetings or process family data at a retained store, capturing input, output and reviewer, so the office can evidence its own governance and UK GDPR accountability.

Source: UK GDPR Article 5(2) (accountability principle); ICO accountability framework.

Confidence: Sourced