FINRA and SEC Record-Keeping for AI Chats and Notetakers

No AI exemption

FINRA's Regulatory Notice 24-09 (June 27, 2024) reminds firms that its rules are intended to be technology neutral and apply to generative AI the same way they apply to any other tool, including AI features embedded in third-party products. The SEC hasn't adopted an AI-specific recordkeeping rule either. (Its 2023 proposal on predictive data analytics was withdrawn in June 2025.)

FINRA's 2026 Annual Regulatory Oversight Report goes further on good practice: it says ongoing monitoring of AI tools may include "storing prompt and output logs for accountability and troubleshooting" and "tracking which model version was used and when." It also notes that the top GenAI use case among member firms is summarization and information extraction, which is exactly what notetakers do.

Broker-dealers: Rule 17a-4 and FINRA Rule 4511

SEA Rule 17a-4(b)(4) requires broker-dealers to preserve originals of communications received and copies of communications sent relating to their business as such, for at least three years, the first two in an easily accessible place. FINRA Rule 4511 requires members to preserve books and records in a format that complies with Rule 17a-4, and for at least six years where no other period is specified.

Supervision applies too. FINRA Rule 3110(b)(4) requires written procedures for reviewing incoming and outgoing correspondence. FINRA's May 2024 advertising FAQ says AI chatbot communications with investors may be correspondence, retail or institutional communications, depending on their nature and audience, and must be supervised accordingly.

Investment advisers: Rule 204-2

The adviser rule is narrower. Rule 204-2(a)(7) requires advisers to keep written communications received and copies of those sent relating to any recommendation made or proposed and any advice given or proposed, the receipt or delivery of funds or securities, and the placing or execution of orders. Advertisements are covered separately. Records are generally kept for five years, the first two in an appropriate office of the adviser.

So an AI-drafted follow-up email that recaps your recommendations is almost certainly a required record once it's sent. An internal notetaker summary that never leaves the firm may or may not be, depending on what it contains and how your firm uses it. Decide with your CCO, write the answer into your policy, and apply it consistently.

The off-channel lesson

The SEC's off-channel communications sweep shows what happens when business communications live where the firm can't capture them. In fiscal 2024 alone, the SEC brought recordkeeping cases against more than 70 firms with over $600 million in civil penalties, and since December 2021 the initiative has produced charges against more than 100 firms and over $2 billion in penalties, according to the SEC's enforcement director. In one August 2024 action, 26 broker-dealers and advisers agreed to pay $392.75 million combined.

Those cases were about texting and messaging apps, but the principle carries over: if advisors use an unapproved AI app to message clients, or a client-facing chatbot isn't captured, the firm can't produce the record. Archiving vendors such as Smarsh, Global Relay and Theta Lake now market capture of AI-generated content alongside email, chat and video.

AI notetakers: decide what the record is

An AI notetaker can produce four different things: the audio or video recording, a full transcript, an AI summary and the follow-up email or CRM note. Your policy should say which of these the firm keeps, where (your archive, not just the vendor's app), for how long, and who reviews the summary for accuracy before it becomes the official note. FINRA's 2026 report specifically flags hallucinations, where a model presents inaccurate information as fact. The AI meeting summary check prompt helps with that review.

Also check the vendor's retention settings: if the notetaker deletes recordings or transcripts after a set period, make sure what you're required to keep has been exported first. And remember recording consent. State laws vary, and some require every party's consent, so many firms ask for and document consent at the start of each recorded meeting. Advisor-built notetakers such as Jump, Zocks, Zeplyn and Finmate AI describe compliance and CRM features on their sites; compare them in meeting notes & crm notes.

Regulation S-P: the vendor side

Notetakers and AI assistants that touch client data are service providers. On May 16, 2024 the SEC amended Regulation S-P to require covered institutions, including broker-dealers and SEC-registered advisers, to have an incident response program, to notify affected individuals no later than 30 days after becoming aware of unauthorized access to sensitive customer information, and to oversee service providers, including requiring them to notify the firm of a breach within 72 hours. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, so the rules now apply to all covered firms.

Before you approve an AI tool, ask where data is stored, whether it's used to train models, how fast the vendor reports breaches and how you export records when the contract ends. The vendor due-diligence prompt drafts that questionnaire for you.

A practical checklist

1. Inventory every AI tool in use, including AI features inside your CRM, email and video apps. 2. Classify what each produces (recordings, transcripts, summaries, drafts, sent messages, chatbot conversations). 3. Map each output to the rule that may apply (17a-4/4511 or 204-2) and set retention. 4. Capture required records in your archive, not just the vendor's app. 5. Review AI summaries for accuracy before they become the official note. 6. Vet vendors under Regulation S-P, including breach notice within 72 hours. 7. Train staff on approved tools and on not moving client conversations into unapproved apps. 8. Document it all in a written AI policy (try the AI use policy prompt for a first draft).

Sources

FINRA: Regulatory Notice 24-09; 2026 Annual Regulatory Oversight Report, GenAI; Rule 4511; Rule 3110; Advertising regulation FAQ.

SEC: Rule 17a-4 (eCFR); Rule 204-2 (eCFR); Regulation S-P amendments, press release 2024-58; Enforcement Director remarks, Nov. 2024; Press release 2024-98. This guide is general information, not legal or compliance advice.