SEC Recordkeeping for AI Notes and Chats: What an RIA Should Archive

Often, yes. For a registered investment adviser, AI meeting notes and chatbot conversations can be books and records when they relate to advice, recommendations or client communications. The safe approach is to decide in writing which AI outputs count, archive those in a searchable place for the full retention period, and keep the transcript or prompt behind any note you rely on.

Rule 204-2 itself never mentions AI, chatbots or note-takers. The books and records rule, Rule 204-2 under the Investment Advisers Act, was written around kinds of record, such as written communications relating to advice, and a tool's label does not change the kind. An AI-generated summary of a client meeting that your adviser uses as the file note is a record of that meeting; a throwaway brainstorm probably is not. The grey area between them is where firms need a policy.

Follow me on Instagram@sagnikteaches

Treat the archive checklist that follows as general information, not legal or compliance advice: take it to your chief compliance officer, outside compliance consultant or counsel and let them decide what applies to your firm. A useful starting source is a guest article on Kitces.com, published on 30 July 2025, on the compliance risks of AI tools; points drawn from it are credited to it.

Connect on LinkedInSagnik Bhattacharya

What the rule says, in the parts that matter here

These points come from the text of 17 CFR 275.204-2 as read on Cornell's Legal Information Institute. Confirm them against the current rule before relying on them.

Subscribe on YouTube@sagnikteaches

• Written communications. Paragraph (a)(7) requires originals of written communications received and copies of those sent that relate to recommendations or advice, receipt or delivery of funds or securities, and the placing or execution of orders. An email drafted with AI and sent to a client is a sent written communication, whatever tool wrote the first draft.
• Retention. Paragraph (e)(1) requires records to be kept for not less than five years from the end of the fiscal year in which the last entry was made, with the first two years in an appropriate office of the adviser. Advertisements kept under (a)(11) follow paragraph (e)(3) instead, which counts the five years from the end of the fiscal year in which the adviser last disseminated them.
• Electronic storage. Paragraph (g) allows electronic media if the adviser has procedures to maintain and preserve records so as to reasonably safeguard them from loss, alteration or destruction, to index them, to produce copies promptly on request and to keep a separate duplicate.
• Advertisements. Paragraph (a)(11) requires a copy of each advertisement disseminated, and communications sent to ten or more people outside the firm, subject to exceptions. AI-drafted posts, newsletters and web copy can land here.

The consequence is that two questions matter for each AI output. Does it fall into a record category? If so, is it stored somewhere the firm controls for the right period in a form you can search? The checklist below turns those two questions into routine.

Where firms disagree, and how to settle it on paper

Commentary on AI meeting notes splits on the same question: when does a summary become a record? One view treats AI output as a record as soon as it is used to document advice. Another treats internal drafts as working papers and the reviewed note, or whatever is sent out, as the record. Examiners are not bound by either view, and a firm's own written position is the thing it will be measured against.

The Kitces article gives practical direction. It says Rule 204-2 can apply to AI-generated material used in client communications, meeting summaries relied on for advice, investment analyses and marketing, and that a junior employee brainstorming a draft or rephrasing internal talking points probably creates no record. It recommends keeping prompts and outputs from material AI interactions, retaining the full transcript and audio file of a meeting, keeping the original AI output even after editing, and having a designated reviewer, ideally someone who attended, check each summary. Those are one commentator's recommendations, not rules.

A sensible approach for a small RIA is conservative: treat the reviewed note as the primary record, and archive the transcript and original AI output as supporting material for the same retention period. That costs storage, which is cheap, and removes the argument about which version was "the record". Put the decision in your compliance manual with a date and an owner.

The per-tool archive checklist

List every AI tool anyone in the firm uses, including the ones nobody officially approved. For each, answer the same questions. Use a table like this and keep it in your compliance file.

For each row, also record four facts about the tool itself: how long the vendor keeps data; whether you can export everything in a usable format; whether anyone can delete records without a trace; and whether the firm, not an individual, owns the account. The last is easy to overlook. The Kitces article says content generated through personal accounts may not be accessible to the firm and recommends prohibiting personal accounts for business use; a firm cannot archive what it cannot reach.

What to keep for each type of AI output

Meeting notetakers

Keep four items together: the audio or video if the tool records it, the full transcript, the original AI summary and the final reviewed note. Name them with one client identifier and the meeting date. A firm that keeps only the final note has nothing to check it against if a client later disputes what was said. If the vendor deletes recordings after a set period, export before that date. Your notetaker choice affects all of this; Jump versus Zocks on compliance set-up compares two common options, and AI note takers for financial advisers covers consent and review.

Chatbot conversations

Save the conversations that shaped something sent to a client or used to support advice. Export or copy the prompt and the output, with the date, the tool and the user's name. A conversation about a client where nothing was used is a grey case; your policy decides. A rule that anyone pasting client data into a chatbot must save the chat to the client file makes a clean line. Can financial advisers use ChatGPT covers what compliance teams usually allow before this stage.

Drafted client communications

The sent email, letter or message is the record, and it sits in your email or messaging archive already. Keep the AI draft too if it differs materially, because the difference shows who wrote what. If the draft went through several rounds in a chatbot, save the chat.

Marketing and website copy

Keep the final version as published with the date, the approval, and the prompt or source material. Where AI wrote a performance claim or testimonial-style wording, expect extra scrutiny from a reviewer; AI cannot be trusted to know what you may say.

Internal-only drafts

An adviser asks a chatbot to tidy a personal to-do list or explain a concept. No client link, and a sensible policy treats it as no record. State this explicitly so that staff are not asked to archive everything, which nobody sustains.

Retention in practice: the arithmetic

An illustration. An adviser holds a review meeting on 12 March 2026. The notetaker produces a transcript and summary; the adviser edits it into the final note and saves it in the CRM the same day. The firm's fiscal year ends on 31 December. If the meeting note is the last entry on that record this year, the five-year clock runs from the end of that fiscal year, 31 December 2026, so the earliest the note could be discarded under a five-year retention is 31 December 2031. If more entries follow in 2027, the period runs from the end of the fiscal year of the last entry. Marketing runs on its own clock: an AI-drafted newsletter first sent in 2026 and last sent in 2027 is kept until at least 31 December 2032, five years from the end of the fiscal year of its last dissemination.

Deleting at the exact minimum means tracking a date for every record, so a simpler policy is to retain client records for the whole relationship plus five years after the fiscal year in which it ends, and to apply that to AI outputs saved with the file. The first two years must be in an appropriate office of the adviser, which for a remote team means a system the firm controls and can produce records from quickly.

Check one more point when you buy: whether a vendor's own deletion schedule is shorter than yours. A notetaker that deletes transcripts after 90 days is fine only if your routine exports them before day 90. Put a diary reminder on the first working day of each month to confirm the export ran.

Worked example: an eight-adviser RIA writes its AI records policy

An illustration with invented numbers. An RIA with eight advisers, two paraplanners and a part-time compliance lead has accumulated AI tools informally: three advisers use a meeting notetaker, five use a chatbot on personal accounts, and marketing uses an AI writing tool. The compliance lead decides to bring this under control in one afternoon and one follow-up week.

1. Inventory (45 minutes). She asks every staff member to list the AI tools they have used on firm work in the past 90 days, with no penalty for honesty. The result is seven tools, two of which she did not know existed.
2. Classify (30 minutes). For each tool she completes the table above. Four tools produce likely records; two are internal-only; one, a free chatbot on personal accounts, produces possible records the firm cannot reach.
3. Decide (30 minutes). Reviewed meeting notes are the primary record; transcripts and original summaries are retained as support; client-related chatbot conversations are saved to the client file; personal accounts are not allowed for client work.
4. Fix the gap (one week). The firm moves chatbot use to a business account with export, tests exporting a conversation, and writes a one-page rule: "If you use AI on client work, save the chat to the file the same day."
5. Test (30 minutes). She picks one client and one date, and tries to reconstruct everything the AI tools produced about that client in that month, from the firm's systems only. It takes 22 minutes and uncovers one transcript that was never exported. That is the gap the test exists to find.

That whole exercise costs roughly a day of a compliance lead's time spread across a week, plus a business-plan subscription. It also produces what an examiner would want to see: a dated policy, a tool inventory and evidence that someone tested it. The policy and inventory are the artefact; the tool choice is secondary.

A quarterly retrieval test you can run in 30 minutes

A policy that is never tested drifts. Once a quarter, the compliance lead runs the same short test and files the result. Choose one client at random, one month, and one adviser, and ask for everything AI produced about that client that month.

The failed row is the useful one. Overwritten summaries are a risk wherever a tool lets users edit the AI output in place and saves the edit over the original. Fix it by switching on version history if the tool offers it, or by copying the original into the file before editing. Record the fix with a date and the name of the person who made it.

Asking an assistant to help with the inventory

You can use an assistant to speed up the inventory itself, as long as the data you give it contains no client information. Paste your list of tools and answers from staff, and ask it to organise them, not to decide anything.

Below are staff answers about AI tools used on firm work. Turn them into a table with columns:
Tool | Who uses it | Account type (firm/personal/unknown) | What it produces | Possible record? (Yes/Maybe/No, with one-line reason) | Questions for compliance.
Do not give legal advice and do not decide what is a required record; mark "Maybe" where the answer depends on how the output is used.

A sample line of what it returns (illustrative): "Free chatbot | 5 advisers | personal | client email drafts, meeting prep | Maybe: used for sent client emails | Can the firm access these accounts? Who owns the history if an adviser leaves?" You would fix any line where the assistant says "No" for something that touches client advice; a cautious classification is better than a tidy one. Then take the table to the person who owns compliance and settle each "Maybe" in writing.

The policy wording to adapt

A short clause is better than a long one. This is illustrative language to take to your counsel, not approved wording.

AI records. The firm treats the following as books and records and retains them with the client file for [period]:
(a) the final reviewed meeting note and the transcript and original AI output from which it was prepared;
(b) any AI prompt and output used to prepare a client communication, recommendation or analysis;
(c) AI-drafted marketing material as published, with the prompt and approval.
Employees must use firm-approved AI accounts only, must save material AI chats to the client file on the day of use,
and must review and sign off AI-generated notes within [number] business days.
Compliance will test retrieval quarterly and keep the results.

Ask your compliance consultant to adjust the periods, the review deadline and the scope. If a clause says the firm does something, the firm must do it; a policy promising quarterly tests that nobody runs is worse than none.

Mistakes that turn up in reviews of AI records

• The policy bans the tool people use. A written ban on cloud notetakers while advisers keep using them creates a gap between what the firm says and what it does. Approve a tool and archive it properly rather than pretending nobody uses one.
• Only the clean version survives. The adviser edits the AI note heavily and saves only the final. A later query asks what was said; the transcript is gone. Keep the source.
• Personal accounts. A departing adviser takes the chat history with them, along with the evidence of what was advised.
• The export that was never tested. The vendor offers "export", but the file is a bundle of unlabelled text files. Test with a real record, and check a person can find a specific client's chat in under ten minutes.
• The note nobody reviewed. A confidently wrong summary, such as a figure transposed or "client agreed" where the client said "will think about it", sits in the CRM as the official record. Reviews are the control; sign-off dates prove they happened.

For the vendor side of retention, deletion and export questions, questions to ask before buying AI that touches client data gives a list you can reuse, and an AI governance checklist for small financial advice firms places records alongside oversight and training. If you are comparing assistants for meeting preparation, Claude versus ChatGPT for meeting prep and records looks at the same retention questions from the tool side.

Finally, the single most useful step is a dry run. Pick a past client meeting and ask a colleague, as an examiner would, to produce everything your firm holds about it that AI touched. If they can do it in half an hour, your archive works. If not, you have your task list.

Recordkeeping questions advisers ask about AI

Is an AI summary of a client meeting a required record?

Often yes if the firm relies on it as the record of advice, or it is sent to the client. A summary that stays a private draft is harder to call. Many firms resolve the doubt by deciding in writing that the reviewed note is the record and archiving the transcript and original AI output as support.

Do I have to keep every ChatGPT or Claude conversation?

Not every one. Material interactions, such as drafting client communications, analysing a recommendation or producing marketing, are the ones that may be records. Brainstorming with no client link usually is not. Write down the dividing line in your policy and have staff apply it consistently.

How long must the records be kept?

Rule 204-2 generally requires five years from the end of the fiscal year of the last entry, with the first two years in an appropriate office of the adviser. Check the exact paragraph for each record type, and confirm with your compliance consultant or counsel.

Does this apply to state-registered advisers?

State-registered advisers follow their state's books-and-records rule, which may differ from Rule 204-2 in scope and retention. Read your state securities regulator's rule, and ask your compliance consultant to confirm how it treats AI-generated notes and chats.

Further reads

• AI for Wealth Management Firms: A 90-Day Rollout Plan for Small Firms — A rollout plan that builds the archive in from week one.
• AI CRM for Financial Advisers: What Is Built In and What Is Bolted On — Where notes live when AI is built into the CRM.
• Jump AI With Wealthbox: Syncing Notes, Tasks and Contacts — How one notetaker syncs notes into a CRM record.
• AI Software for Wealth Management: A Small Firm's Evaluation Checklist — An evaluation checklist that includes retention features.
• AI for Wealth Managers: Drafting Proposals With a Compliance Review — Proposal drafts with the compliance review step built in.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: 17 CFR 275.204-2 (Investment Advisers Act books and records rule), read on Cornell LII on 4 November 2026; Kitces.com guest article, 'Major Compliance Risks Advisors Face When Using AI Tools', 30 July 2025, read on 4 November 2026. This is general information, not legal or compliance advice; confirm with your compliance consultant or counsel.