Is this investment advice?

No. Serra Education provides process and tooling consulting only, never Serra Wealth investment advice. What you get here is a process-and-governance guide, not legal, investment, or compliance advice. Use it to structure your own decisions, and confirm every obligation against the primary source and your own counsel.

The blocker isn't the model — what is it?

It is the audit trail. Most wealth firms have already tried AI somewhere. Far fewer can show a reviewer where the data went, who checked the output, and how the decision would be reconstructed if a regulator asked. The binding constraint sits in the workflow around the model, not in the model you pick.

Do these obligations change if I switch AI tools?

No. None of the rules regulate which model you use. They regulate whether a human owns the output, whether client data stays contained, whether client-facing AI is disclosed, and whether you can reconstruct what the model did. A firm can swap one model for another and change nothing about its compliance position.

Where do the finder briefings come from?

Primary law, read by a person. Each obligation is sourced to the actual article, MiFID II, the GDPR, the EU AI Act, the FCA Handbook, ICO guidance, not to a scraped summary. Every line carries a citation and a confidence badge, and a person reviews each briefing before it is published.

How does the paid path work, and what does it cost?

It is three steps, in order, and the paid step is never first. Start with a free one-page report for your firm. Then a free 15-minute intro call. If it is useful, a 60-minute optimisation session is 250 EUR, and that fee credits in full toward a Tier 1 audit, which runs 2,000 to 10,000 EUR depending on firm size and the number of workflows in play.

Can I put live client data into an AI tool to test this?

Do not. Keep live client data out of any general-purpose AI tool. The report on this page is produced from a prompt you run inside your own environment, no client data leaves you, and Serra never asks you to send client data. Any real-data workflow needs a contracted tool, a lawful basis, and a data-protection impact assessment first.

Is Serra vendor-neutral?

Yes. Serra Education does not resell an AI stack, so the recommendation is what works in your firm, not what pays a referral. The engagement is about the governance around the model, which is portable across whichever tools you already run.

AI compliance obligations for a single family office in the US

4 AI-adoption compliance obligations apply, each cited to primary law.

A qualifying single family office is excluded from the Advisers Act

Rule: Family Office Rule 202(a)(11)(G)-1

What it requires: The SEC family office rule excludes a family office that serves only 'family clients', is wholly owned and controlled by family members/entities, and does not hold itself out as an investment adviser, from the definition of investment adviser. A qualifying SFO is therefore outside 204-2, 206(4)-7 and the Marketing Rule — but the exclusion is conditional and narrow.

Do this: Confirm the office meets every condition of the rule — only family clients, family ownership and control, no holding-out — and re-test it before serving anyone outside the family definition, because a single non-qualifying client can break the exclusion.

Source: Investment Advisers Act of 1940, Rule 202(a)(11)(G)-1 (the family office rule; 17 CFR 275.202(a)(11)(G)-1).

Confidence: Verify

Data-security and privacy duties still apply to family data

Rule: Reg S-P / GLBA & state privacy law

What it requires: Even excluded from the Advisers Act, a family office holds sensitive personal and financial data of family members and staff. GLBA/Reg S-P safeguards may apply where financial products are involved, and state privacy laws (e.g. the CCPA/CPRA in California) can bind the office directly regardless of adviser status.

Do this: Map which AI tools touch family personal or financial data, apply a written safeguards and incident-response process to them, and check whether your state's privacy law (e.g. CCPA/CPRA) imposes direct obligations.

Source: Gramm-Leach-Bliley Act, 15 U.S.C. 6801-6809 and Regulation S-P (17 CFR 248.30); California Consumer Privacy Act / CPRA where applicable.

Confidence: Verify

Keep orderly AI records even without an SEC record-keeping duty

Rule: Records & governance (prudential)

What it requires: A qualifying SFO has no Rule 204-2 duty, but audit trails still matter for tax, estate and family-governance purposes and to evidence the data-security steps above. AI drafting or summarising should not happen in an unretained way.

Do this: Point AI tools that draft memos, summarise meetings or process family data at a retained store, capturing input, output and reviewer, so the office can evidence its governance and data-security posture.

Source: Prudential recordkeeping; consistency with GLBA/Reg S-P safeguards (17 CFR 248.30) and applicable state privacy law.

Confidence: Verify

Keep a person on significant automated decisions affecting individuals

Rule: Human oversight of automated decisions

What it requires: Where an SFO uses AI in ways that significantly affect individuals — for example hiring, or profiling family members — emerging state privacy laws and best practice call for transparency and meaningful human involvement, even though no SEC conduct rule applies.

Do this: Add an AI-use note where a model interacts with or profiles individuals, and ensure a person, not the model alone, makes any decision that significantly affects someone.

Source: State privacy statutes addressing automated decision-making (e.g. California CPRA regulations); office governance policy.

Confidence: Verify