How to Keep AI Meeting Notes Under SEC and FINRA Rules

Current as of October 29, 2026. This guide describes rules and guidance as published by the SEC, FINRA and NASAA, and federal and California recording law, on that date. It is not legal advice; decisions about what your firm keeps belong with your compliance team and counsel.

AI meeting assistants join or record an advisor's client meetings, transcribe them, write a summary, draft the follow-up email and update the CRM. Each of those outputs raises the same question for an investment adviser or a broker-dealer: is it a record the firm must keep, and if so, how? Some parts of the answer are settled. One important part is not, and no regulator has yet said how it will be decided.

This guide sets out what the rules say, where they are silent, and eight steps to a decision your firm can defend in an examination.

Step 1: List everything the tool produces

Start with an inventory, not a policy. Run a test meeting and write down every artifact the product creates and where each one lives: the audio recording, if any; the transcript; the AI summary; the advisor's edits to it; action items and tasks; the CRM note; the draft follow-up email and the version actually sent; and the prompts and outputs if the tool lets advisors ask it questions.

Products differ here. Some keep a recording and a transcript. Some transcribe and then discard the audio. At least one large CRM platform keeps AI-generated summaries but neither audio nor transcript. You cannot classify what you have not listed, and the vendor's marketing page is not the list.

Step 2: Classify each artifact against the rules that apply to your firm

Investment advisers. SEC Rule 204-2 requires advisers to keep "Originals of all written communications received and copies of all written communications sent by such investment adviser relating to" advice, recommendations and orders, among other things. An AI-drafted email about a recommendation, once sent, fits that language (interpretation). The rule does not mention recordings or internal notes, so whether a transcript or summary must be kept is a judgment for the firm (interpretation).

Broker-dealers. SEC Rule 17a-4 requires broker-dealers to keep "Originals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer (including inter-office memoranda and communications) relating to its business as such". FINRA has noted in Notice 25-07 that "The phrase business as such under Exchange Act Rule 17a-4(b)(4) is not defined." Whether an internal AI summary is an inter-office memorandum relating to the business is, again, a judgment for the firm and its counsel (interpretation).

Where the state regulators' association stands. NASAA has taken a position, though it is advocacy, not a rule. In its July 2025 comment letter on FINRA's notice, NASAA wrote: "To the extent that firms are required to keep a record of phone or video calls, FINRA should not permit those firms to replace those records with AI-generated transcripts or summaries."

Step 3: Write the decision into your books-and-records policy

For each artifact on your list, record whether the firm keeps it, why, for how long, and where. The retention periods come from the rules themselves: Rule 204-2 records must be kept "for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser"; Rule 17a-4(b) records for "not less than three years, the first two years in an easily accessible place"; and FINRA Rule 4511 sets a default of "at least six years" for FINRA records with no other specified period.

As the archiving vendor Global Relay points out in its own guidance, a policy that governs call recordings may say nothing about the transcript an AI produced from the call, the summary made from it, or the CRM note copied from the summary. Name each one.

Step 4: Route what you keep to a compliant archive

Broker-dealers must keep electronic records in a system that either preserves "a complete time-stamped audit trail" covering "All modifications to and deletions of the record or any part thereof", or preserves them "exclusively in a non-rewriteable, non-erasable format", and must be ready to "immediately provide" them when regulators ask. An editable note inside the vendor's app does not meet that on its own if the note is a required record (interpretation). For advisers that keep records on electronic storage media, Rule 204-2(g) requires them "To maintain and preserve the records, so as to reasonably safeguard them from loss, alteration, or destruction".

In practice, that means connecting the meeting assistant to the firm's archive. Ask the vendor which archive integrations it supports, and ask your archive provider which meeting tools it captures. At least one archiving vendor publishes connectors for AI notetakers, and at least two document capture of Microsoft Copilot interactions.

Step 5: Review anything that goes to a client before it goes

FINRA's advertising guidance is direct: "Firms are responsible for their communications, regardless of whether they are generated by a human or AI technology." For broker-dealers, Rule 3110 requires evidenced review of correspondence, and its Supplementary Material.07 adds: "Merely opening a communication is not sufficient review." Supplementary Material.08 keeps responsibility with the principal when review functions are delegated: "the supervisor/principal remains ultimately responsible for the performance of all necessary supervisory reviews". That text addresses delegation to people; the same logic applies to delegating review to software (interpretation).

For investment advisers, a NASAA Investment Adviser Section publication (which says it does not necessarily represent NASAA's views) recommends that "All AI-driven output such as marketing materials, client communications, and investment recommendations should be reviewed by a compliance officer for accuracy before being disseminated" and that "Advisers must maintain documentation of the review of any AI-generated content for examination purposes."

Step 6: Treat the vendor as a service provider you must oversee

Regulation S-P, as amended in 2024, defines a service provider as "any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution." A meeting assistant that hears client conversations fits that definition (interpretation of a definition applied to a typical product). Covered firms' policies must require oversight "through due diligence and monitoring" and must be reasonably designed to ensure the provider notifies the firm "as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred". Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026.

FINRA's 2026 oversight report lists, among its books-and-records findings, "Not performing adequate due diligence to verify third-party vendors' ability to comply with recordkeeping requirements". Make the vendor show you how its outputs reach your archive before you sign.

Step 7: Get consent, and describe the tool accurately

Federal law allows recording where "one of the parties to the communication has given prior consent". State law can go further: California's Penal Code § 632 applies to anyone who records a confidential communication "without the consent of all parties". Firms with clients in California, or in any other state their counsel identifies as requiring all-party consent, need a consent step (interpretation); telling every participant that the meeting is being recorded or transcribed is sound practice everywhere.

What you tell clients about the tool is also a representation the SEC examines. Its examination priorities for fiscal 2027 say: "Registrants are increasingly incorporating super intelligence (SI) into their businesses. For example, they are using generative SI tools to support research, drafting, coding, and client communications..." "Super intelligence (SI)" is the SEC's new term; comparable passages in the fiscal 2026 edition said "AI," and that edition said the staff "will review for accuracy registrant representations regarding their AI capabilities or AI." Applying that to a notetaker (interpretation), a client disclosure should say what the tool records, where the data goes and who reviews the output.

Step 8: Pilot, sample and keep the evidence

Run the tool with a small group first, review every summary and email before it is saved or sent, and keep a record of the errors found. FINRA's 2026 report describes practices firms may consider for generative AI, including "storing prompt and output logs for accountability and troubleshooting; tracking which model version was used and when; and validation and human-in-the-loop review of model outputs". These are observations, not requirements, but they are the kind of evidence a firm would want to have if something goes wrong.

Checklist

• Every artifact the tool produces is listed, with where it is stored
• Each artifact is classified as kept or not kept, with the reason and the rule relied on
• Retention periods are set from Rule 204-2, Rule 17a-4 or FINRA Rule 4511 as applicable
• The books-and-records policy names transcripts, summaries and CRM notes, not just recordings
• Kept artifacts flow to an archive with an audit trail or non-rewriteable storage where required
• AI-drafted client emails are reviewed before sending, and the review is logged
• The vendor has completed Regulation S-P due diligence, with 72-hour breach notice in the contract
• The vendor has shown how its outputs reach the firm's archive
• Clients are told about recording or transcription, and consent is captured where state law requires it (California, and any other state counsel identifies)
• Client disclosures describe what the tool records, where data goes and who reviews output
• A pilot group's error findings are documented
• The decision is revisited when FINRA answers Notice 25-07 or finalizes Notice 26-14

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.