Keeping AI Records: Rule 204-2 and 17a-4 for Advisers

Advisers using AI notetakers ask whether they have to keep the transcript or only the summary. For SEC-registered advisers, the client data and consent page answers it: Rule 204-2 names neither, so the firm decides which document is the record of the meeting, writes down why and applies that choice every time.

The same question applies to prompts, Copilot chats, chatbot conversations and email drafted with AI. Broker-dealers answer it under Exchange Act Rule 17a-4 and FINRA Rule 4511, which reach more communications and set different retention periods.

What the rules cover

Rule 204-2, for SEC-registered advisers. Paragraph (a)(7) requires "Originals of all written communications received and copies of all written communications sent by such investment adviser" relating to recommendations made or proposed and advice given or proposed, receipts and deliveries of funds or securities, the placing or execution of orders, and performance. Advertisements are kept under paragraph (a)(11). Under paragraph (g), records kept electronically must be arranged and indexed so any record can be located and retrieved, and the adviser must promptly provide a legible, true and complete copy when SEC examiners ask.

Rule 17a-4, for broker-dealers. Paragraph (b)(4) requires "Originals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer (including inter-office memoranda and communications) relating to its business as such." Two differences from Rule 204-2 matter for AI. It covers all communications relating to the business, without a list of topics, and it names inter-office communications, which Rule 204-2 does not mention. Under paragraph (f), records on an electronic system must be kept either with a complete time-stamped audit trail that allows the original to be re-created if it is modified or deleted, or "exclusively in a non-rewriteable, non-erasable format."

FINRA rules. Rule 4511 requires members to keep books and records under FINRA and Exchange Act rules, in a format that complies with Rule 17a-4. Rule 3110.09 requires keeping associated persons' correspondence and internal communications for the Rule 17a-4(b) period, with the names of the person who prepared outgoing correspondence and the person who reviewed it ascertainable from the record. Rule 2210(b)(4) does the same for retail and institutional communications and adds "the name of any registered principal who approved the communication and the date that approval was given."

FINRA's position on AI content is direct. Its advertising FAQ D.8 says "Firms are responsible for their communications, regardless of whether they are generated by a human or AI technology," and that this includes "applicable FINRA and SEC recordkeeping requirements." Its 2026 oversight report lists business-related communications "received and sent via email, instant message, text message, chat message and interactive blog" among the records that Rule 17a-4(b)(4), Rule 3110.09 and Rule 2210(b)(4) address.

Record type by record type

Where a rule does not name a record type, the firm still has to decide and write the decision down. The AI policy page has recordkeeping language that sets the category for each class of AI output in advance, so nobody decides document by document.

Retention periods, as the rules state them

• Advisers, most records including (a)(7) communications: "not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser" (Rule 204-2(e)(1)).
• Advisers, advertisements under (a)(11): "not less than five years, the first two years in an appropriate office of the investment adviser, from the end of the fiscal year during which the investment adviser last published or otherwise disseminated" the communication (Rule 204-2(e)(3)(i)).
• Broker-dealers, communications under (b)(4): "not less than three years, the first two years in an easily accessible place" (Rule 17a-4(b)). Rule 3110.09 and Rule 2210(b)(4) point to the same period.
• FINRA records with no stated period: "at least six years" (Rule 4511(b)).

A dual registrant answers both columns. Where one artifact serves both businesses, setting retention to the longer period gives each tool one setting instead of two.

Copilot, Teams and other AI apps in Microsoft 365

Microsoft Purview retention policies can retain and delete Copilot prompts and responses. Microsoft now keeps them separate from Teams chats. New retention policies offer a location called Microsoft Copilot experiences (Microsoft 365 Copilot, Security Copilot, Copilot in Fabric and Copilot Studio), one called Enterprise AI apps (which includes ChatGPT Enterprise) and one called Other AI apps (which includes ChatGPT and Google Gemini). Microsoft says prompts and responses from other Copilots and generative AI apps are covered when they have a collection policy set to capture content. Older policies used a location called Teams chats and Copilot interactions, so check which location an existing policy uses.

The data is stored in a hidden folder in each user's Exchange mailbox that compliance administrators search with eDiscovery. Microsoft warns that "Messages visible in your AI apps are not an accurate reflection of whether they are retained or permanently deleted for compliance requirements." Confirm retention with an eDiscovery search, the way an examiner request would be answered.

Teams chats need the Teams chats location. Teams meeting recordings and transcripts from user chats are files, and Microsoft says they need a retention policy that includes the organizer's OneDrive account. Recordings and transcripts from channel meetings are covered by the retention policy for the team's files. An email drafted with Copilot in Outlook is an email once sent, and the firm's email archiving applies to it. The Copilot guide for advisors covers audit logs and admin settings.

Setting it up

1. List every AI tool in use and what each one produces. The inventory on the compliance page is the starting point.
2. For each output type, pick the record category and the rule that applies, using the table above. Write the decision down.
3. Set retention in each tool to match, with an administrator controlling the setting rather than each user.
4. Confirm the archive meets Rule 204-2(g) or Rule 17a-4(f). For a broker-dealer, that means the audit-trail option or non-rewriteable, non-erasable storage.
5. Test retrieval. FINRA's 2026 report describes testing recordkeeping vendors "by, for example, simulating a regulator's examinations by requesting records to confirm compliance." Ask for every AI-assisted client communication for one advisor or representative for one quarter, and note how long it takes to produce.

The notetaker comparison shows which retention and export settings three common tools list.