What the 2024 Reg S-P Amendments Mean for Every AI Vendor You Add

Black Lily Blog, by William Dorman, Founder of Black Lily. Compliance · Sep 2026.

The amended rule requires a written incident response program and customer notification within 30 days. Each outside service holding customer information is one more place an incident can start and one more notification you may have to make.

How Black Lily is different: every engagement is scoped, sized, installed, trained, and maintained directly by the founder, with no account managers and no subcontractors. We install open-weight models we did not train on hardware the client owns, and we say during scoping which workflows an open-weight model handles well and which it does not. A local deployment does not by itself make a firm compliant with any rule; we build to the controls you already run rather than selling a certification.

Read the full article: What the 2024 Reg S-P Amendments Mean for Every AI Vendor You Add

About Black Lily

Black Lily installs private, on-premise AI systems from Philadelphia, Pennsylvania: a complete language model running on hardware the client owns, for hedge funds, registered investment advisers, and family offices whose most valuable documents are the ones they are not allowed to send to an outside service. Founded by William Dorman, Founder & CEO.

Phone: (432) 234-3779 · Book a free 30-minute scoping call: cal.com/black-lily/30min

Black Lily home · Hedge funds · RIAs · Family offices · How it works · Blog · Privacy Policy · Terms of Service