Financial Firms Scramble on AI Recordkeeping Compliance

Rubin recommended starting with existing rules. An AI-generated item used in a customer communication, recommendation or marketing material generally falls under the same retention requirement as a human-created item. Some firms therefore apply full regulatory retention periods to AI records tied to communications, recommendations and supervisory reviews while using shorter periods for lower-risk operational information.

Retention alone may not be enough. Firms must be able to reconstruct decisions and explain what role an AI system played. That becomes hard when a model used to make a decision has since been updated or retired.

The problem echoes regulators’ earlier responses to email and, more recently, off-channel communications such as text messages and WhatsApp. Existing books-and-records rules were applied to new communication technologies without rewriting the underlying framework. Employees using unapproved AI platforms for client-related work could similarly create records beyond their firm’s ability to capture or supervise.

Derek Stern, head of global distribution compliance at Manulife Wealth & Asset Management, said firms should involve compliance teams while AI systems are being designed, not after deployment. Due diligence should examine where data are stored and who can access them, whether the system’s conclusions can be explained and defended, how vendors manage model updates and testing, and how the technology integrates with human review.

Jamie Hoyle, vice president of product at MirrorWeb, warned firms to be skeptical of promises to put compliance on “autopilot.” AI can improve supervision – context-aware systems can replace crude keyword searches that generate many false positives by interpreting communications against actual firm policies.

Red Oak’s central message, panelists said, is that AI does not shift accountability from the regulated firm to the technology. Until regulators provide more specific guidance, documentation, explainability and human oversight remain the safest guideposts.