When are AI communications a business record?

The world of the compliance team is not black and white. Much of the day-to-day sees them working in the “gray area” between regulation, interpretation, and application. A company policy or regulatory guidance might appear to be definitive and “black and white” on paper, but finding a definitive answer as simple as “yes” or “no” can be elusive in practice.

Unsurprisingly, AI is raising compliance questions. Many across the industry are grappling with whether AI inputs or outputs can be considered “business communications,” and whether all of the associated recordkeeping and archiving expectations apply.

Regulators have yet to impose new AI-specific recordkeeping requirements, although 45% of financial services professionals believe the industry would benefit from specific AI regulation. But the application of existing recordkeeping requirements may be broad enough to be seen to cover AI communications, and some regulators have updated guidance to account for AI:

• SEC Rule 17a-4: Requires firms to keep originals of “all communications received and sent … relating to its business as such.”
• FINRA Rule 4511: Outlines that firms retain “communications relating to their business as such,” linked to SEC Rule 17a-4
• FCA SYSC 10A: Obligates firms to “take steps to keep a copy of electronic communications … that are made with, sent from, or received on equipment provided by the firm to an employee.”
• Department of Justice ECCP: Recent updates specifically outline expectations that firms implement governance and compliance for AI, and the ECCP requires that firms ensure “business-related electronic data and communications can be preserved and accessed.”

The range of business applications that generative AI (GenAI) platforms like Claude, ChatGPT, and Microsoft Copilot are being used for means that firms looking to bring AI into the scope of their compliance and recordkeeping must consider how to account for a new influx of data in multiple formats. With regulators having set clear expectations that businesses demonstrate a high level of data completeness, it is imperative that firms take a holistic view of AI communications capture.

What types of AI communications data could be counted as business records?

• AI prompts, outputs, and artifacts: The back-and-forth between employees and AI platforms could be viewed in the same way as an email or WhatsApp thread between colleagues. 
• Shared documents/attachments: Firms must have oversight of the information and documentation that employees are sharing with GenAI assistants, and the output versions that AI platforms produce, to maintain a full compliance picture.
• Edits and deletions: Similarl to digital communications records, capturing any history of data that has been changed enables compliance teams to flag and focus on potential issues.
• Metadata: Knowing the “who, what, and when” of AI communications by capturing data like timestamps and user IDs will enable firms to build a full audit trail of interactions as required.
• History and chat logs: A singular file output or prompt input taken in isolation could result in compliance flagging an employee’s AI use — access to the full chat history gives the vital context needed to establish whether it is part of a concerning pattern.

What risks could firms be missing?

Many of the potential risks that could be hiding in uncaptured AI communications data will feel familiar, as they are the same risks that could be manifesting in business communications across “traditional” channels. However, the unique nature of AI platforms means some of these risks will appear in new ways, and present novel risks firms need to be aware of:

• Financial misconduct: AI platforms excel at pattern recognition and data analysis at scale, and bad actors may see this as an opportunity to leverage these platforms for their own gain. This may result in individuals sharing material non-public information with AI assistants in order to generate trading advice outputs. While it is unlikely that a prompt would be as bold as “help me conduct insider trading,” trading jargon, slang, or coded inputs may be used in an attempt to obfuscate misconduct.
• Non-financial misconduct: A growing focus area for regulators, non-financial misconduct like bullying or harassment may manifest in AI spaces. This could include visible comments or edits left in AI collaboration platforms, or individuals using AI to generate hurtful or explicit images of colleagues.
• Off-channel communications: Comments and discussion in collaborative AI spaces could already be considered “off-channel” if they are not part of a firm’s recordkeeping efforts. Should these channels be brought into scope, they may be able to identify instances where individuals suggest moving conversations to channels that aren’t being captured.
• Data sensitivity: Firms that use AI will have strict guidelines in place for what data can and should be shared with AI assistants. This is particularly important for financial services firms that work with incredibly sensitive customer data. By capturing data on the files that are shared with GenAI assistants, firms can identify when such data may have been shared and internal policies breached.
• Explainability and transparency: Regulators expect that firms leveraging AI be able to explain and evidence that models are working as intended and why they reached particular decisions or outcomes. Organizations that are not yet capturing AI communications data may be missing warning signs of models not acting as intended.

Is AI the future of compliant communications?

Regulators are placing less focus on enforcement action around firms’ recordkeeping currently, certainly compared to the peak of the off-channel communications enforcement wave over the last few years. But this doesn’t mean that benchmark has been lowered, and savvy firms will have learned lessons from that time that they will be applying to their use of AI.

Building an effective AI communications data capture program now will not only ensure that firms are meeting recordkeeping expectations as they stand today, but are “future-proofed” against any AI-specific retention obligations (or enforcement scrutiny) that may be yet to come.

Firms that are proactively capturing and monitoring their AI platform data (and using AI-enabled tools to do so) will also be well placed to identify and mitigate a range of risks that would otherwise be out of their line of sight by bringing AI communications into existing compliance and monitoring workflows.

Firms capturing this data will not only be able to use it for monitoring and recordkeeping purposes, but also for internal and external audits and investigations, and advanced eDiscovery. When assessing capture solutions, firms should prioritize those that capture full AI interactions, including prompts, responses, attachments, and metadata, and those that leverage capture from native APIs to ensure data is captured accurately and completely.

AI is raising many questions, not least whether AI communications count as business records for the purposes of retention. Among those questions, firms that don’t consider AI data capture as a priority should be asking themselves what their risk tolerance is, whether they are comfortable only seeing part of the compliance picture, and, ultimately, whether they are prioritizing compliance — because the answer to that should always be “yes.”

Firms are employing a wide range of AI communications tools, from Claude to Microsoft Copilot and ChatGPT. Learn how Global Relay’s Connectors can help compliance teams bring AI communications data into their workflows, archive, and proactive risk monitoring.