Your Reg S-P vendor assessment doesn't cover ChatGPT yet.

Under the SEC's 2024 Regulation S-P amendments, financial institutions must maintain a formal vendor-oversight program — written policies and a documented risk assessment for every service provider touching client data. Larger advisers ($1.5B+ AUM) had to comply by December 3, 2025. Smaller advisers' deadline was June 3, 2026 — already passed. Most solo and small RIAs haven't extended that assessment to their AI use yet, because most advisors are using ChatGPT informally without realizing it falls under the same vendor-oversight rule as any other service provider. The SEC has already penalized advisors $400,000 combined for overstating AI use under the Marketing Rule — proof of active regulatory attention to AI in this space right now.