Pre-exam AI checklist: 14 things a CCO should be able to answer

The inventory

1. A dated inventory of every AI tool in use, including what an adviser bought on a personal card
2. A risk assessment for each tool, dated before that tool went live
3. The vendor’s data-processing terms saved as a PDF, dated the day you retrieved them
4. A named owner and a review date on every row

The service provider layer

5. A register of every service provider with access to customer information, not the list finance pays
6. For each one, the due diligence record and the monitoring record
7. For each one, the 72-hour unauthorized-access notification arrangement your policies must establish

The incident layer

8. The record of every incident in the last five years
9. The determination of whether notification was required, including where you concluded it was not
10. An incident response program that contemplates an AI failure, not only a breach

The review layer

11. One completed test of an AI output against its source, with findings and a re-run date
12. Where a human reviews before anything reaches a client, in writing, with a name on it
13. A retention decision for AI transcripts, made in advance at the category level
14. A notetaker vendor retention setting that matches that decision

Two dates. Reg S-P compliance was due December 3, 2025 at $1.5B or more and June 3, 2026 below it; both passed, and the extension ten trade associations sought on November 19, 2025 was not granted. Rule 206(4)-7 does not require a written report of the annual review (that is practice, not rule text) but an undocumented review reads as none.

Download the one-page PDF

No form. Print it, mark it up, hand it round.

We give no regulatory advice and build nothing that produces an investment recommendation.