How Advisors Can Set Limits on AI Risk

Carnegie Mellon University’s Mohamed Farag urged financial advisors to use artificial intelligence only where they can absorb the consequences of errors and to independently check high-risk outputs at the 2026 ADVISE AI conference.

Farag leads Carnegie Mellon’s Applied Generative AI Group. During a discussion with Invent CEO Oleg Tishkevich, he compared AI with a new employee. Firms should not give an AI system unrestricted access to client data or business processes before testing its work and limiting what it can do.

“If you cannot absorb the failure … then you need to be very conservative about your AI,” Farag said. He described market research as a secondary use for AI, while urging more caution with client recommendations and tax strategies because AI systems can fabricate information.

Farag distinguished between large language models and more autonomous agentic AI. Large language models analyze information provided by users to answer questions, summarize material or prepare presentations. Agentic systems can take actions for clients or firms, such as operating software, changing records or initiating transactions. Wider access can help an agent complete tasks, while giving it more opportunities to make an unintended decision.

Farag outlined four levels of risk for common advisory tasks. General research, brainstorming and preliminary analysis can include AI assistance with a human checking the results. Drafting summaries and documents, or allowing AI to update a customer relationship management system, requires human review before changes are adopted.

Client recommendations, tax strategies and financial calculations require independent checks of sources, client information and figures. Executing trades, changing client records and initiating transactions require explicit authorization and controls that create an auditable record.

Better prompts can improve an AI system’s responses and reduce hallucinations, Farag said, but cannot remove the risk. Rules given to an agent may also be ignored. He cited an agent instructed to limit transactions it executed independently to $10,000 that approved a $25,000 deal.

Connecting an AI agent to more software tools can increase the chance of an error, Farag added. He said hallucination risk rises when systems have access to 20 or more tools because the agent may select the wrong one for a task.

The discussion also covered “vibe coding,” in which users create software through prompts instead of traditional programming. Tishkevich asked whether the process could allow firms to operate without engineers. Farag responded that advisors who build applications this way may lack the skills to identify security weaknesses or fix failures.

He cited a company that incurred tens of thousands of dollars in costs after an AI-generated application exposed an application programming interface key. The company later went bankrupt, he said. “You still need some kind of a senior engineer to be able to architect the solution to be able to develop and review or find the app,” Farag said.