1. Executive Summary

This memo documents a governance review of the written compliance policies and procedures maintained by McNaughton Wealth Management, LLC (“the Firm”) as they relate to the use of artificial intelligence and machine learning tools by supervised persons, with specific attention to the requirements of Rule 206(4)-7 under the Investment Advisers Act of 1940. The review identified a material gap between the current Item 11 Code of Ethics framework — which addresses personal securities trading, pre-clearance, and fiduciary conduct — and the SEC’s documented examination expectation that investment advisers maintain written AI governance policies wherever AI tools are used in any operational or client-facing capacity.

This memo establishes a timestamped record of the Firm’s AI policy review event, documents the specific gap between existing written procedures and current regulatory expectations, and provides model written policy language the Firm may adopt as a supplement or addendum to its existing compliance manual. This memo has been cryptographically attested and anchored on Gnosis Chain, creating a tamper-evident record of the date, content, and scope of this governance review that is available for presentation to SEC examiners upon request.

2. Disclosure Gap Analysis

2.1 Current Language in Form ADV Part 2A and Compliance Manual

The Firm’s Form ADV Part 2A Item 11 describes a Code of Ethics framework that addresses personal securities trading, pre-clearance obligations, quarterly holdings reporting, and fiduciary standards of conduct. The compliance section contains no reference to artificial intelligence, machine learning, generative AI tools, algorithmic outputs, or any related technology. There is no reference to an approved AI tool list, no requirement that supervised persons disclose their use of AI tools to a principal, no output review or human-in-the-loop requirement, and no employee training obligation specific to AI use. The ADV is similarly silent in Item 8 (Methods of Analysis) and Item 17 (Voting Client Securities) with respect to any AI-assisted workflow.

The absence of AI governance language is not itself a deficiency if the Firm and all supervised persons use no AI tools in any capacity. However, where supervised persons use commercially available generative AI tools — including but not limited to ChatGPT, Microsoft Copilot, Google Gemini, or AI-embedded features within financial planning or portfolio management software — the complete absence of a written supervisory framework for those activities creates examination exposure that is difficult to remediate after the fact.

2.2 Applicable SEC Standard

Rule 206(4)-7 under the Investment Advisers Act of 1940 requires each registered investment adviser to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and the rules thereunder. The rule does not enumerate specific technologies; its scope is defined by the Firm’s actual business activities and risk profile. Where a supervised person uses an AI tool to generate client-facing content, conduct research, or produce planning outputs, the absence of any written policy governing that use means the Firm cannot demonstrate, in a regulatory examination, that it exercised supervisory control over those activities.

The SEC’s 2024 and 2025 Examination Priorities explicitly identified AI governance as a targeted area for investment adviser examinations, noting that staff would review whether advisers have written policies and procedures governing AI use, whether disclosures to clients accurately reflect actual AI practices, and whether recordkeeping obligations are being met with respect to AI-generated content. Enforcement actions in 2024 against Delphia (USA) Inc. and Global Predictions, Inc. established that misrepresentations or omissions regarding AI use in investment advisory activities constitute fraud under Sections 206(1) and 206(2) of the Advisers Act — confirming that the SEC treats AI disclosure as a substantive obligation, not a discretionary best practice.

2.3 Specific Examination Exposure Created by the Gap

For a firm of McNaughton Wealth Management’s profile — a boutique registered investment adviser with approximately $291 million in combined AUM, insurance-adjacent referral relationships, and a small supervised person population — the risk is not primarily one of AI washing or overstated AI capabilities. The risk is the inverse: if supervised persons are using AI tools for client communications, financial planning document drafts, research summaries, or portfolio commentary without a written policy, the Firm has no documented basis to demonstrate supervisory control over those activities when an examiner asks the threshold question: “Show me your written AI governance policy and when it was adopted.” An examiner who does not receive a responsive answer to that question proceeds immediately to document review, and the absence of any policy becomes the finding. The Firm’s existing Code of Ethics framework — while substantive with respect to personal trading and fiduciary obligations — creates no safe harbor for AI-related supervisory deficiencies because it does not address that domain at all.

3. Recommended Written Policy Language

The following is model language that the Firm may consider adopting as a supplement to its existing compliance manual or as a standalone AI Governance Policy addendum. This language is drafted to reflect a legally conservative, operationally realistic posture for a small registered investment adviser. It does not assert AI capabilities the Firm does not have, and it does not create obligations the Firm cannot fulfill. A production version would be tailored to the Firm’s specific tool inventory and supervised person count following onboarding.

4. Attestation Record

This memo has been cryptographically anchored on Gnosis Chain. The hash below uniquely identifies this document and cannot be altered retroactively. This record is available for SEC examination on request.

The hash above uniquely identifies this document and cannot be altered retroactively. Gnosis Chain is an EVM-compatible public blockchain providing permanent, independently verifiable records. This attestation record, together with the memo content, constitutes a compliance artifact suitable for production to SEC examiners under Rule 204-2.