Is AI the next chapter of communications capture?

Firms have moved far past asking “when will we use AI?” to “how will we scale AI?” A survey from the Cambridge Centre for Alternative Finance found that more than 80% of firms now use or adopt AI at some level, with 40% of respondents reporting advanced adoption.

Many organizations are adopting a range of AI-enabled tools to boost efficiency, from generative AI (GenAI) to internal chatbots to AI-enabled meeting notetakers. But this influx of tools is also driving an influx of new data — and a new compliance challenge.

Without proper oversight of AI-generated outputs, firms could miss risks that impact consumer protection, business credibility, and market integrity. They may also find themselves on the wrong side of regulation if regulatory obligations to capture and retain business communications extend to AI outputs in the future.

Reading between the (existing) lines

While 45% of compliance professionals working in financial services think specific AI regulation is warranted, regulators are currently focused on applying existing frameworks to AI technologies.

The Financial Conduct Authority (FCA) said it is taking this approach to give firms flexibility to innovate with AI instead of creating specific rulebooks that could be too prescriptive – despite criticism of insufficient guidance from the U.K. government. The FCA’s communication recording requirements also state that firms should capture “all relevant communications”, regardless of the device or platform used.

Like the FCA, the Financial Industry Regulatory Authority (FINRA) has also stated that it would govern AI using existing guidelines to “function dynamically with evolutions in technology and firms’ processes.” In its 2026 Annual Oversight Report, FINRA clarified that using GenAI could “implicate rules regarding supervision, communications, and recordkeeping.”

There are a range of existing rules that could apply to AI-generated communications:

REGULATOR	RULE	APPLICABLE REQUIREMENTS
SEC	Rule 17a-4	Firms need to keep originals of “all communications received and sent…relating to its business as such”
SEC	Rule 204-2	Investment advisers need to keep originals of “written communications received relating to any recommendation made or proposed to be made and any advice given or proposed to be given”
FINRA	Rule 4511	Firms must retain “communications relating to their ‘business as such’”
FINRA	Rule 2210	Depending on the nature and number of persons receiving chatbot communications, “they may be subject to FINRA communications rules as correspondence, retail communications, or institutional communications”
FCA	SYSC 10A	Firms must “take steps to keep a copy of electronic communications…that are made with, sent from, or received on, equipment provided by the firm to an employee” or “the use of which an employee has been accepted or permitted by the firm”

While these regulations don’t specifically reference AI communications, firms should ask whether AI communications data could now or later be considered a “business record” under these definitions.

Where is AI creating communications gaps?

Businesses are leveraging AI for a wide range of beneficial use cases. But as with any technology an organization uses, compliance teams may not have full oversight of what AI is being used for, by who, and the scale of outputs it might be generating.

While seemingly innocuous, those outputs could present risks if left unchecked. Firms need to assess where there may be gaps in their data retention and how to address them.

1) AI-enabled notetaking

AI-enabled notetaking offers firms major productivity benefits, like recording entire meetings and automatically circulate summarized meeting actions.

However, these communications could include offhand comments about clients, deals, or competitors that might have otherwise been kept private. If this information includes material non-public information that is accidentally stored or sent across the business, it could enable bad actors to engage in financial misconduct.

If an AI-generated transcript contains inaccurate or misattributed information that is circulated before human review, it could cause a range of issues. Firms that capture AI notetaking applications will have a comprehensive record of every meeting they are used for and evidence at hand to cover themselves if necessary.

2) Generative AI

Several firms are leveraging enterprise versions of familiar Gen AI applications, like ChatGPT and Claude, for various business use cases. While organizations will have policies in place to prevent sensitive or personal data from being input into these platforms, mistakes can happen.

If firms don’t have oversight of internal GenAI prompt logs, they could miss a wealth of potential risks, such as employees using platforms to produce insider trading strategies or generating images of colleagues that could constitute non-financial misconduct.

3) Customer-facing chatbots and roboadvice

If an employee asks a chatbot for advice about financial services they plan to discuss with a client, or if a firm’s chatbot shares information about a product, firms should review these interactions to make sure that AI-generated outputs are accurate and factual. Should an employee relay inaccurate financial guidance or fabricated data generated by a chatbot, firms can face serious reputational and regulatory repercussions.

Under Rule 2210, FINRA explicitly states that chatbot communications are subject to recordkeeping rules depending on the nature and number of persons receiving them.

4) Collaborative AI platforms

Collaborative platforms, like workspaces or shared projects with AI functionalities, allow employees to generate advice, draft pitches, or even work through trades. Employees could share sensitive or material non-public information with these tools, which could be a breach of confidentiality or privacy if unauthorized groups get access.

In other situations, bad actors could cover up misconduct by changing or editing documents that are stored on collaborative AI platforms. If firms don’t have tools to retain and monitor changes to these documents, they could be overlooking potential misconduct.

The next chapter of communications capture

The pace of AI adoption continues to increase, but so does the number of previously unforeseeable potential risks. By retaining AI-generated communications in a centralized archiving system and monitoring them, firms can proactively identify inaccurate information or concerning outputs and act to mitigate issues.

Firms can take a range of steps to ensure they are across AI, including:

• Performing an audit of all business areas where AI tools are in use, and the number and type of outputs these tools produce
• Updating policies to reinforce human oversight of all AI communications and assign a group of owners who are responsible for reviews, as well as policies around what data employees can — and cannot — enter into AI systems
• Proactively capturing use cases where there is clear potential risk and high regulatory expectation, such as customer-facing chatbot logs and enterprise prompts/outputs
• Monitoring all AI communications to identify and address potential risks

By proactively capturing AI communications data, firms can develop “good habits” and workable controls now rather than build them under regulatory scrutiny later. Capturing AI communications will also help firms build substantial records and evidence should an investigation arise down the line.

The right AI technology partner will not only enable firms to connect current AI channels to a compliant archive but will also offer solutions to capture new AI communications and platforms as the industry evolves.

Learn more about how you can compliantly capture GenAI channels to minimize risk and meet regulatory recordkeeping requirements here.