Imagine: A compliance officer at a broker-dealer is asked to draft a new written supervisory procedure on reviewing securities transactions of associated persons. The compliance officer asks his personal version of ChatGPT to draft him an appropriate policy. The compliance officer then has a number of interactions with ChatGPT, and it produces a final written supervisory procedure, which is adopted by the firm. Unfortunately, the written supervisory procedure lacked some key elements, and the Financial Industry Regulatory Authority (“FINRA”) asks who wrote the policy. The compliance officer admits that they asked ChatGPT to draft the procedure but failed to retain the prompts sent to ChatGPT or responses received from ChatGPT. FINRA enforcement alleges that the firm failed to keep records and failed to supervise the compliance officer.
Although this is a hypothetical example, it is likely to occur regularly. The promise of generative artificial intelligence is certainly seductive, but there are important issues for broker-dealers to consider. Should the broker-dealer have a policy on employee AI usage and if so, are the prompts and responses records that are required to be retained under Rule 17a-4 of the Exchange Act?
History of the SEC’s Recordkeeping Rule
In order to implement Section 17(a)(1) of the Exchange Act, in 1935 the Securities and Exchange Commission adopted Rules 17a-3 (records to be made) and 17a-4 (records to be preserved). Rule 17a-4(b)(4) still requires a broker-dealer to preserve “[o]riginals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer (including inter-office memoranda and communications) relating to its business as such . . . .”[1]
Though the SEC has modernized Rules 17a-3 and 17a-4 several times over the intervening ninety-one years, it has yet to cleanly advise as to the meaning of “communications” and “business as such.” As a result, compliance officers and lawyers will need to make informed decisions about whether generative AI prompts and responses are communications and whether they relate to the broker-dealer’s business as such.
How Generative AI Work Appears
Most generative AI operates using statistical probability to predict the most likely sequence of tokens (i.e., pieces of data like letters or words) when responding to prompts. If you enter “duck, duck . . .” generative AI will likely respond with the word “goose.” If you were to then prompt “Why goose?” the generative AI would likely respond with something like, “Because goose frequently appears after duck, duck” or explain the game duck, duck, goose. On review, it appears that the person and the AI system are “talking”; some data scientists even refer to the exchange as a “conversation.” This interaction allows the system to refine its outputs based on preceding context, mimicking the flow of natural dialogue between two people in real time. In short, generative AI looks and feels like talking with a person. That look and feel are at the heart of the issue of whether prompts and responses are communications.
Arguments That AI Prompts and Responses Are Not Required Records
There are several good arguments that certain AI prompts and responses should not be treated as 17a-4 records.
- Generative AI Conversations Are Not Communication. In common discourse, communication involves the transmission of information from one person to another person. After all, you don’t talk to a computer; you issue commands. In many respects, prompting is similar to entering a search query into a research database, instructing a spreadsheet to perform a calculation, or directing a word processing program to generate a document, none of which would generally be deemed communications for recordkeeping purposes.
- Many Prompts and Responses Are Not About “Business as Such.” A prompt and response about how to draft written supervisory procedures may not relate to a broker-dealer’s business as such. While they relate to the broker-dealer’s compliance policies, it could be argued that they do not relate to its actual business as such. The phrase “as such” clearly limits the application of Rule 17a-4 in a way that excludes some communications that relate to the broker-dealer’s business tangentially. Here, the AI prompt and response relate to compliance, which could be argued not to be about the trading of securities (i.e., the business as such).[2]
- Rule 17a-4’s “Inter-Office Memoranda” Parenthetical Confirms the Rule Only Applies to Select One-Sided Communications. If the SEC intended to capture all one-sided communications, it arguably would have said so. Instead, the SEC explicitly referenced one-sided communications in an exclusive way by providing that communications to be saved are “(including inter-office memoranda and communications)” in Rule 17a-4. Because the SEC did not use the phrase “among other things,” inter-office memoranda and communications could be the only one-sided communications required to be retained.
Arguments That AI Prompts and Responses Are Required Records
Conversely, there are several good arguments as to why AI prompts and responses should be treated as 17a-4 records.
- Prompts and Responses Are Indirect Communications with the AI Company’s Employees. Prompts and AI responses could be argued to constitute communication because they are transmitted to and processed by infrastructure controlled by humans. Prompts are sent to corporate entities, which have employees, and responses are received from those same entities and their employees. When a broker-dealer employee prompts a public AI system, that input is not merely an internal mental draft but rather a transmission to an external service provider whose personnel design, maintain, and monitor such inputs, and in some cases review or use them for system improvement or safety.[3] Moreover, a court recently determined that generative AI usage can invalidate the attorney-client privilege, which would only be possible if there were human viewers.[4]
- AI Output Has Been Deemed Communication in Another Context. Regulators have already treated correspondence between an AI chatbot and humans as “communications.” FINRA’s Advertising Regulation FAQs make clear that “Firms are responsible for their communications, regardless of whether they are generated by a human or AI technology. Accordingly, firms must ensure that AI-generated communications they distribute or make available comply with applicable federal securities laws and regulations and FINRA rules.”[5] The FAQs further reflect that communications made available through online or interactive platforms are considered communications with the public if they are accessible to investors, and firms must retain records of such communications in accordance with applicable recordkeeping obligations.[6] This framework supports the conclusion that prompts submitted to, and outputs generated by, AI or chatbot systems fall within existing communications and recordkeeping requirements without regard for whether there were two humans directly involved in the communication.
- Prompts and Responses Look Like Communication. Prompts and AI-generated responses could be treated as required records because, functionally, they fit squarely within the regulatory concept of a “communication.” The SEC has long emphasized that communications subject to recordkeeping obligations under Rules 17a-3 and 17a-4 include any written or electronic messages relating to a firm’s business, regardless of format or technology.[7] Furthermore, due to the natural language search and response patterns as well as the ability to interact and train your AI agents, sessions with generative AI are analogous to communication.
- Retention Is Consistent with the Purpose of Rule 17a-3 and 17a-4. The classification of AI prompts and responses as required records hinges on their role as primary source material for a firm’s supervisory framework. Would retaining these provide evidence that could be useful in an enforcement action or examination? Here, the conversations function as the modern equivalent of compliance work papers or internal memoranda. The digital exchanges possess significant probative value as an audit trail revealing the firm’s intent, the depth of its due diligence, and whether the resulting policies were “reasonably designed” to ensure regulatory adherence. Failing to retain these records would undermine the purpose of the recordkeeping requirements, as staff could effectively hide the decision-making process and any potential shortcuts or misunderstandings from regulatory oversight during enforcement action.
The SEC’s Past and Current Positions
Past SEC Chair Gary Gensler brought a series of high-profile enforcement actions against broker-dealers for allowing their staff to use “off-channel” communications methods that created records but did not retain them and for allowing written communications that could not be supervised.[8] More recently, Commissioner Hester M. Peirce criticized the prior enforcement program as overreaching and as an example of regulation through enforcement.[9] As a result, under the current administration, it is unlikely that the SEC would bring high-dollar enforcement actions against firms that do not treat their use of generative AI as creating records that must be preserved. However, broker-dealers should carefully consider their tolerance for compliance risk in the event that an administration chooses an enforcement approach or if the firm is already in a precarious position.
Risk Tolerance
Because the SEC and FINRA have not issued guidance on the question of whether generative AI prompts and responses are communications subject to Rules 17a-3 and 17a-4, and they are unlikely to provide a dispositive answer other than the statement that the rules are technologically neutral, firms must make a risk decision on how to treat the data. Usually, each broker-dealer’s risk management program has buckets for risk acceptance, including a bucket for compliance or regulatory risk. Typically, firms adopt a low tolerance for compliance risk. Those firms should carefully consider whether their staff, including management, is using generative AI on unapproved and unmonitored providers for business purposes. Firms with a low compliance risk tolerance should consider a policy restricting generative AI use to approved providers, where records of prompts and responses are retained and the activity is supervised.
17 C.F.R. § 240.17a-4(b)(4) (2026). ↑
See SEC v. Arete Wealth Mgmt., LLC, No. 25 C 616, slip op. at 27–32 (N.D. Ill. Feb. 26, 2026). Arete argued unsuccessfully that text messages concerning outside sales activities and compliance matters were not required to be retained because “business as such” was unconstitutionally vague, violating due process, and that some texts did not relate to the firm’s securities business. ↑
For example, OpenAI’s Terms of Use state, “We may use Content to provide, maintain, develop, and improve our Services, comply with applicable law, enforce our terms and policies, and keep our Services safe.” Terms of Use, OpenAI (Jan. 1, 2026). ↑
See United States v. Heppner, No. 1:25-cr-00503-JSR, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026) (finding that sourcing documents from a generative AI system invalidated a claim that the documents were privileged, even if the documents were subsequently provided to counsel). ↑
FINRA Rule 2210 Frequently Asked Questions D.8, FINRA (Dec. 22, 2025). ↑
Id. at FAQ B.4. ↑
Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants, 87 Fed. Reg. 66412, 66428 (Nov. 3, 2022) (“One of the goals of this rulemaking is to make Rules 17a–4 and 18a–6 more technology neutral.”). ↑
SEC Charges 16 Wall Street Firms with Widespread Recordkeeping Failures, Sec. & Exch. Comm’n (Sept. 27, 2022). ↑
A Catalyst: Statement on Qatalyst Partners LP, Hester M. Peirce and Mark T. Uyeda, Comm’rs, Sec. & Exch. Comm’n (Sept. 24, 2024). ↑
