AI Notetaking for Wealth Management Compliance: What Counts as a Record
The wealth management industry adopted AI meeting notetakers faster than compliance teams could write policies for them. The tools — Otter, Fireflies, Zoom AI Companion, Microsoft Copilot in Teams, Jump, Zocks, and increasingly built-in features of wealth management CRMs — capture client conversations, generate written summaries, and store both the audio and the text indefinitely. Most firms started using them organically, advisor by advisor, before any compliance review happened. By the time the compliance team got around to writing a policy, half the advisor base was already generating records the firm didn't know existed.
This article is for compliance officers and operations leads at independent broker-dealers, RIAs, and OSJs working through the policy and configuration questions that AI notetaking raises. The audience already understands that the tools are useful; the question is how to use them without creating regulatory exposure.
The records question
Every advisor-client conversation that is recorded and transcribed creates a record. The threshold question is whether that record is required to be preserved under FINRA Rule 4511 and SEC Rule 17a-4 — or, for RIAs, Investment Advisers Act Rule 204-2.
The honest answer is: many of these records are in scope, and firms that haven't thought about it carefully are accumulating preservation obligations they may not be able to satisfy.
The relevant test is whether the record relates to the firm's business and to advisor-customer communication. Almost all client-facing advisor meetings clear this bar. A meeting where an advisor discusses portfolio strategy, recommends investments, addresses client questions, or coordinates account activity is unambiguously a business record. The transcript and any summary generated from that meeting are also records.
The preservation requirements for these records depend on the category. Communications-related records (which is what most meeting transcripts are) have a three-year preservation requirement under Rule 17a-4. Supervisory review records (if compliance reviewed the meeting) have longer preservation requirements. Client-facing recommendations have additional documentation requirements under Reg BI for broker-dealers and under the fiduciary standard for RIAs.
A firm using AI notetakers without a records policy is making a default decision — typically, to preserve everything the tool generates for the tool's own retention period, which may or may not align with regulatory requirements. The decision should be deliberate.
Three configuration questions every firm needs to answer
Before approving AI notetakers for advisor use, compliance teams need answers to three questions. The answers determine the policy.
First: what gets recorded? Some tools record audio. Some record audio and video. Some only record their own AI-generated transcript without preserving the underlying audio. Each option has different preservation implications. Audio recordings are direct records of customer communications; transcripts are derived records that may or may not be accurate. The firm's choice between these depends on what's defensible in audit and what's operationally useful.
Second: where is the data stored? AI notetaking tools store data in their own cloud infrastructure. The location, the security controls, the access permissions, and the retention defaults vary by vendor. A firm relying on a third-party recordkeeping service has Rule 17a-4 obligations about that third party — contracts must include specific provisions about audit access, indemnification, and operating procedures. Vendors that cannot meet these obligations should not be used for client meetings.
Third: how is the data accessed and produced? When FINRA or the SEC requests records, the firm needs to be able to produce them. The production should include the original audio (or transcript, depending on the firm's policy), the metadata (date, time, participants), and any audit trail showing modifications. Tools that don't expose these as exportable artifacts are not viable for regulated firms even if the underlying recording is fine.
The three configuration questions intersect — the answer to one constrains the answer to another. A firm that wants comprehensive audio preservation needs a vendor whose storage can be configured for 6-year retention; a firm that's content with transcript-only preservation has more vendor flexibility.
The disclosure and consent layer
Beyond records preservation, AI notetaking creates a disclosure obligation that is more easily overlooked.
Most states have two-party consent laws for recording conversations. The advisor's recording of a client meeting requires the client's knowing consent. In practice, most AI notetakers display a notification ("This meeting is being recorded by [tool]") that satisfies the technical legal requirement, but firms should not rely on the tool's default behavior. The firm's policy should specify how consent is obtained, documented, and refreshed for ongoing client relationships.
Beyond the legal requirement, there is a fiduciary and ethical consideration. Clients have varying levels of comfort with AI recording. Some prefer it for the accuracy benefits (better follow-up, fewer missed details). Others prefer not to have their voice and conversation patterns stored in a third-party AI system. The firm's policy should accommodate both — typically by offering opt-out for clients who request it.
The disclosure language matters. A casual "we use AI to take notes" disclosure is not the same as "this conversation is being recorded, transcribed by AI, stored by [vendor] for [period], and may be reviewed by supervisors and used to inform our service to you." The latter is more transparent and more legally defensible. Firms should write the disclosure language explicitly and train advisors to deliver it.
Common misconfiguration patterns
Firms that adopt AI notetakers without compliance review tend to land in one of four misconfiguration patterns.
The first is "no policy at all." Advisors use whichever tools they prefer, with whichever configuration, generating records the firm doesn't know exist. When a regulatory request comes in, the firm cannot produce records it doesn't know about. The discovery process is uncomfortable.
The second is "policy that ignores records preservation." The firm publishes an AI usage policy that addresses client disclosure and data security but does not address the records preservation obligation. Records generated under this policy are typically not retained for the required preservation period because the AI vendor's default retention is shorter than 17a-4 requires.
The third is "preservation through the AI vendor only." The firm relies on the AI vendor's storage to satisfy 17a-4. This may or may not work depending on the vendor's specific configuration and contract. Many vendors offer storage that is functional for everyday use but does not meet 17a-4's immutability and audit-trail requirements. Firms should not assume vendor storage suffices without explicit confirmation.
The fourth is "duplication for safety." The firm preserves the AI transcript in its own document management system in addition to the vendor's storage. This is the cleanest approach when feasible. The challenge is operational — moving transcripts from the AI tool to the document management system in a timely and complete way requires explicit workflow design.
The supervisory review question
AI notetakers create a new category of supervisable communication for firms.
Under FINRA Rule 3110 (Supervision), member firms must establish and maintain supervisory systems reasonably designed to achieve compliance with applicable rules. The traditional approach has been to sample-review advisor communications — typically email and recorded calls — at defined frequencies.
AI meeting transcripts can be reviewed in the same way. They can also be reviewed differently. The volume of meeting transcripts is typically much higher than the volume of recorded calls; advisors may have 10 to 30 client meetings per week, each generating a 20 to 60 minute transcript. Sample-review at 5 percent — a typical email sampling rate — produces 50 to 100 hours of review time per advisor per year.
This is impractical for most firms. The solution most firms are converging on is keyword-driven review rather than time-based sampling. Compliance establishes a list of trigger phrases that warrant supervisor attention — recommendations about specific securities, discussions of risk tolerance changes, complaints, requests for distributions or transfers. The AI tool flags meetings containing these triggers; the supervisor reviews flagged meetings only. This reduces review volume by 90 to 95 percent while focusing on the meetings where supervision adds value.
This approach has its own regulatory consideration. The keyword list, the trigger logic, and the review documentation all become part of the firm's supervisory system. Firms should document the methodology explicitly and update the keyword list periodically as the regulatory environment changes.
Practical implementation steps
For firms working through AI notetaker adoption with compliance in mind, the implementation sequence has six steps.
Step 1: inventory current usage. List every AI tool being used by any advisor in any context. The list is usually longer than expected. Some tools may be used in shadow IT mode without firm sanction.
Step 2: draft the records preservation policy. Determine what gets preserved (audio, transcript, or both), where it's preserved (firm system, vendor system, or both), and for how long (meeting the longest applicable Rule 17a-4 obligation).
Step 3: select sanctioned vendors. Evaluate vendors against the records preservation requirements. The list of vendors that can meet Rule 17a-4 obligations is shorter than the list of vendors that produce good transcripts. The intersection is the sanctioned list.
Step 4: build the workflow. Define how transcripts move from AI tool to firm storage (if both), how supervisory review happens, how client disclosure is handled, how opt-out requests are processed.
Step 5: train advisors. Most advisors using AI notetakers are not thinking about compliance implications. Training should explicitly walk through the records they're generating, the workflow obligations, and the disclosure language.
Step 6: monitor and review. The policy needs to be enforced. Quarterly reviews should check which tools are in use, whether the workflow is being followed, and whether new tools or features have emerged that require policy updates.
The full implementation typically takes 60 to 120 days. Firms that have skipped the work and are operating in default mode should not delay further — the records being generated today will be discoverable in future regulatory engagements regardless of when the policy is written.
Frequently Asked Questions
Are AI-generated meeting transcripts subject to FINRA books and records rules?
Yes. Most advisor-client meeting transcripts generated by AI notetakers qualify as records related to the firm's business under FINRA Rule 4511 and incorporated SEC Rule 17a-4 (or Investment Advisers Act Rule 204-2 for RIAs). Communications-related records typically require three-year preservation. Supervisory review records and client recommendation records may require longer retention. Firms using AI notetakers without a records preservation policy are accumulating preservation obligations they may not be configured to satisfy.
What configuration questions do firms need to answer before approving AI notetakers?
Three questions. First: what gets recorded — audio only, audio plus video, or only the AI-generated transcript without the underlying audio? Each option has different preservation and accuracy implications. Second: where is the data stored — vendor cloud, firm systems, or both — and does the storage meet Rule 17a-4 requirements for immutability, audit trail, and retention? Third: how is the data accessed and produced for regulatory requests — what export formats are available, and does the audit trail come with it?
What disclosure should advisors make when using AI notetakers in client meetings?
Disclosure should be explicit rather than relying on the AI tool's default notification. Effective disclosure language identifies what is happening (the conversation is being recorded and transcribed by AI), who the vendor is, how long data is stored, who may review it (including supervisors), and how the data informs ongoing client service. Many states have two-party consent laws that require client awareness. The disclosure should be delivered consistently across meetings and refreshed for new clients and after significant relationship changes.
How should firms handle clients who do not want to be recorded?
Firms should accommodate opt-out requests as part of policy. Clients have varying comfort with AI recording — some prefer the accuracy benefits, others prefer not to have voice and conversation patterns stored in third-party AI systems. The firm's policy should specify how opt-out is requested, how it is documented, and how the advisor conducts the meeting without AI capture (typically by disabling the AI tool for that meeting and taking manual notes). Opt-out records themselves should be preserved as part of the client file.
How does supervisory review work for AI meeting transcripts?
Most firms are converging on keyword-driven review rather than time-based sampling, given the volume of transcripts generated. Compliance establishes a list of trigger phrases — specific security recommendations, risk tolerance changes, client complaints, distribution requests — that warrant supervisor attention. The AI tool flags meetings containing these triggers, and supervisors review flagged meetings only. This reduces review volume by 90 to 95 percent while focusing on meetings where supervision adds value. The keyword list and trigger logic become part of the firm's supervisory system and should be documented and updated periodically.
What are the common misconfiguration patterns in AI notetaker adoption?
Four patterns. First: no policy at all, where advisors use whichever tools they prefer and the firm doesn't track records being generated. Second: a policy addressing disclosure and security but ignoring records preservation, resulting in records that are not retained for the required period. Third: relying on the AI vendor's default storage to satisfy Rule 17a-4, when vendor storage often does not meet immutability and audit-trail requirements. Fourth: preservation duplication into the firm's document management system, which is the cleanest approach but requires explicit workflow design to be reliable.
How should firms evaluate AI notetaker vendors for compliance suitability?
Vendor evaluation should specifically address Rule 17a-4 obligations. Required diligence questions include: Does the platform support immutable storage with cryptographic audit trail? Are retention periods configurable for the firm's required period (typically 6 years)? Does the contract include third-party recordkeeping provisions (audit access, indemnification, operating procedures)? Can complete records — audio, transcript, metadata, audit trail — be exported on demand? What is the vendor's SOC 2 posture and breach notification commitment? Vendors that cannot answer all these questions specifically should not be used for client meeting capture by regulated firms.
What is the typical timeline to implement a compliance-aware AI notetaker policy?
Implementation typically takes 60 to 120 days across six steps: inventory current usage, draft the records preservation policy, select sanctioned vendors that meet the requirements, build the workflow for transcript movement and supervisory review, train advisors on records and disclosure obligations, and establish quarterly monitoring. Firms that have not yet implemented a policy should not delay further — records being generated today under default vendor settings will be discoverable in future regulatory engagements regardless of when the policy is written.
Related: Advisor Transitions Platform · For Transition Consultants
