The IDR Principles · Edition 1.0
If Done Right
The AI Governance Framework for Regulated Financial Firms.
Twelve principles for governing AI at an SEC-registered investment adviser. Written from inside a practicing firm, tested in production, and built around the questions an examiner will actually ask.
By Brandon Veldman, CFA and Stefan Whitwell, CFA, CIPM
The human reality of this moment
Two desks. The same problem, the same side.
Inside one firm, two people carry the same problem from different chairs. The chief compliance officer already knows AI is in the workflow and cannot fully prove how it got there. The owner controls the budget, the authority, and the attention that would fix it, and does not yet know the clock is running. They are not adversaries. They are the two people who, together, decide whether the firm walks into its next examination with a story or with a silence.
The compliance officer’s desk
The firm’s compliance officer has an AI Use Policy somewhere: two pages he started last year and never finished. It sits on a running list of thirty-one items, beneath a line at the top that just says “think.” He does not have time to think about the thing he is most worried about. He has time to react to it, and that is where governance quietly breaks down.
The owner’s desk
The founder who owns most of the firm is building the version that lasts twenty years, with successors he trusts. He has read the words “compliance program” twice this week. What he does not have is the time or the background to see that his people are weaving AI into their work one phone at a time. It is not on his list because he doesn’t know it needs to be.
Going wide: the explosion
Most firms have never counted how many doors AI has already opened inside them.
Every AI touchpoint maps to at least one existing SEC priority, and most map to several. The regulatory architecture built over the last eighty-six years already reaches every one of them. The rules did not wait for a new one to be written. Neither should your governance.
The framework
Twelve principles. Four categories. One defensible architecture.
The IDR Principles define what defensible AI means for a regulated firm. Each one is operationally testable, maps to a specific examiner question, and produces a specific piece of evidence. If a principle produces no artifact, it is not yet operational.
Foundation
Principles 1 to 3The structural baseline: a documented chain of origin, written governance that exists before the exam letter arrives, and every workflow built for the show me moment. Three prerequisites. Skip one and the others collapse.
- 1.Chain of Origin
- 2.Document the Process
- 3.Build for the Show Me Moment
Intelligence
Principles 4 to 7Where most firms discover how far they are from defensibility. Screening that matches the sophistication of the content, component-level decomposition, forward-looking regulatory intelligence, and language-evolution awareness. This is the sophistication problem.
- 4.Match the Sophistication
- 5.Decompose Before You Evaluate
- 6.Anticipate Interpretation
- 7.Account for Language Evolution
Operations
Principles 8 to 10Where principles become provable behaviors. Decision explainability for every approval, structural separation of the screening function from the approval function, and version control for everything an examiner might ask to see.
- 8.Explain Decisions
- 9.Separate Functions
- 10.Version Everything
Evolution
Principles 11 to 12Everything else decays without these. Stress-testing and review cycles built into the governance architecture itself. A framework that cannot evolve is already decaying.
- 11.Stress-Test
- 12.Evolve the Framework
Three ways in
Read for the seat you sit in.
Build a process that survives the show me moment.
A working framework for the week you are actually having, not the week your policy manual assumes. Map the surface, find where governance breaks, and stand up evidence you can produce on demand.
Start hereThe same infrastructure that makes a firm defensible makes it grow.
Governance is not only a cost of staying out of trouble. Done right, it is faster turnaround, more content in the market, and a concrete trust advantage over the competitor who says our CCO reviews everything.
Read the owner’s caseThe same framework, read from the oversight seat.
Written for the firm, and built so the person examining it can use it too. A shared standard, a question set your team can adapt, and a confidential two-day sprint for regulators who want to go deeper.
See the regulator’s viewWhy now
There is a window, and it is open now.
No public enforcement action has yet targeted AI governance at a registered investment adviser. No binding guidance defines what reasonably designed supervisory procedures look like when AI is in the workflow. That statement has a short half-life.
The firms that build documented governance during this window will have years of audit trail when standards formalize. The first firms an examiner sees doing it well quietly set the standard the rest of the industry inherits. Edition 1.0 is not the last word. It is the first credible one.
The authors
Written by the people who built the system and run the firm.
One author operates a practicing SEC-registered advisory firm. The other built the AI screening infrastructure that governs its content. Every principle emerged from that intersection, tested against production before it was written in prose.
Frequently asked questions
What is If Done Right about?
Who should read it?
What are the IDR Principles?
Be first to read it
The window is open now.Be ready before it closes.
If Done Right publishes soon. Leave your email and we will send you one note the day it is available, along with early access to the working audit checklist from the book.
Written for the chief compliance officer having the week the policy manual did not plan for, and the owner who controls the budget, authority, and attention to fix it.