Reference · Securities

SEC Rule 17a-4 and Advisers Act Rule 204-2: Recordkeeping for AI

How the SEC's books and records rules reach AI outputs, prompts, transcripts and agent actions

Last reviewed October 9, 2026

At a glance

AI-specific rule: None. Existing books and records rules decide which AI artifacts are records.
Rules: SEA Rule 17a-4 (broker-dealers), Advisers Act Rule 204-2 (investment advisers), FINRA Rule 4511 (FINRA member firms)
Retention: Broker-dealer communications 3 years; core broker-dealer records 6 years; adviser books and records 5 years from the end of the fiscal year
Electronic storage: Broker-dealers: a non-rewriteable, non-erasable format or a complete time-stamped audit trail, since 3 May 2023. Advisers: Rule 204-2(g).
Official text: 17 CFR 240.17a-4 (eCFR via Cornell LII)

The SEC has no recordkeeping rule written for AI. Whether a prompt, an output, a meeting summary or an agent's action has to be kept is decided by rules that predate the technology: Exchange Act Rule 17a-4 for broker-dealers, Advisers Act Rule 204-2 for investment advisers, and FINRA Rule 4511 for FINRA member firms.Rule 17a-4 Rule 204-2 Rule 4511 FINRA's position is that its rules are technology-neutral and apply when member firms use generative AI.Notice 24-09

These rules define a record by what it is about. An AI output a firm sends about its business falls under them like any other message. The open questions sit upstream of that output: the prompt, the draft nobody sent, the answer an employee read and acted on.

An AI output sent to a client is a business communication

A broker-dealer keeps originals of all communications it receives and copies of all communications it sends relating to its business as such, inter-office memoranda included, for at least three years, the first two in an easily accessible place.Rule 17a-4 · (b)(4) The test is whether the communication relates to the business, and a message a model drafted meets it the same way an email an employee typed does.

FINRA says so for AI-created communications: a firm is responsible for its communications "regardless of whether they are generated by a human or AI technology," and that responsibility includes the applicable FINRA and SEC recordkeeping requirements.FINRA FAQ · D.8

An investment adviser keeps originals of the written communications it receives and copies of those it sends on four subjects: advice or recommendations given or proposed, the receipt, disbursement or delivery of funds or securities, the placing or execution of orders, and performance or rate of return.Rule 204-2 · (a)(7) They are kept for five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser.Rule 204-2 · (e)(1) The adviser rule is a list of subjects, so the question for an AI-drafted note is whether it concerns one of them.

Bars

Minimum retention periods in the books and records rules, in years

Minimum periods from 17 CFR 240.17a-4 (a) and (b), 17 CFR 275.204-2 (e)(1) and FINRA Rule 4511 (b). The adviser period runs from the end of the fiscal year in which the last entry was made.

Prompts, drafts and internal answers need a written firm position

No SEC or FINRA rule, release or notice says whether a prompt, or a draft a model produced that nobody sent, is a record. FINRA's 2026 Oversight Report lists storing prompt and output logs for accountability and troubleshooting among the monitoring practices a firm may consider.FINRA 2026 Report, GenAI · Current Practices

Until a regulator says more, the classification is the firm's to make in writing, and the records it keeps have to match it. It is a legal judgment for the firm and its counsel. A written policy usually has to settle:

Which AI tools are in scope, and whether each tool's outputs are communications relating to the business under 17a-4(b)(4), or concern one of the four subjects in 204-2(a)(7).
Whether prompts are kept with the outputs they produced, so a retained output can be read next to the input that shaped it.
Whether drafts a model generated and an employee edited or discarded are kept, and which version is the record.
Whether AI answers that circulate among staff are inter-office communications.
Which retention period applies to each class of AI record, and who approved the classification.

Electronic records: WORM or a complete time-stamped audit trail

Amendments the SEC adopted on 12 October 2022 give broker-dealers two ways to keep records electronically, with compliance required from 3 May 2023.Release 34-96034 The system either keeps a complete time-stamped audit trail of every modification and deletion, with the date and time of each action and, where applicable, the person who took it, so the original record can be re-created; or it preserves records exclusively in a non-rewriteable, non-erasable format.Rule 17a-4 · (f)(2)(i)

Under either option the system also verifies the accuracy of what it records, lets records be downloaded in a human-readable and usable format, and keeps a backup set. A designated executive officer or a designated third party files an undertaking to furnish the records to the Commission on request.Rule 17a-4 · (f)(2), (f)(3)(v)

The 2022 release covers broker-dealers and security-based swap entities. Advisers keeping records electronically are under Rule 204-2(g): records arranged and indexed for easy location and retrieval, a legible, true and complete copy produced promptly on request, a duplicate stored separately, and procedures that reasonably safeguard the records from loss, alteration or destruction.Rule 204-2 · (g) Rule 204-2(g) does not prescribe a non-rewriteable format.

An AI record kept as a required record goes into a system that meets one of these standards. A tool's own conversation history, if a user or administrator can edit or delete it without leaving a trail, does not meet the broker-dealer standard by itself.

Glossary: WORM →

Agents and notetakers create records nobody typed

An AI notetaker that joins a client meeting produces a transcript and a summary. A summary emailed to the client afterwards is a communication sent for a broker-dealer, and for an adviser a written communication about the advice given.Rule 17a-4 · (b)(4)Rule 204-2 · (a)(7) The transcript held inside the notetaker is the harder case, and the firm's policy has to decide it.

An agent that places an order, updates a client record or sends a message leaves records of its own: the action, the instruction it acted on and the result. The order and the message are records under the existing rules whether a person or an agent produced them. FINRA's 2026 report asks firms to consider how they track an agent's actions and decisions; the reference page on that report sets out FINRA's agent expectations.FINRA 2026 Report, GenAI · Agents

Examiners are asking about AI supervision and AI claims

The SEC Division of Examinations published its fiscal year 2026 priorities on 17 November 2025. The Division will review the accuracy of registrants' representations about their AI capabilities, and whether firms have adequate policies and procedures to monitor or supervise their use of AI, including for fraud prevention, back-office operations, anti-money laundering and trading.SEC FY2026 Priorities · Emerging Financial Technology

Both reviews run on records. A representation is tested against what the tool did, and a supervision procedure against evidence that it ran. For FINRA member firms, Rule 4511 requires books and records to be made and preserved as FINRA and Exchange Act rules require, in a format and media that complies with SEA Rule 17a-4.Rule 4511 · (a), (c)

The 2023 predictive data analytics proposal was withdrawn

On 26 July 2023 the SEC proposed rules on conflicts of interest in broker-dealers' and advisers' use of predictive data analytics (File S7-12-23). On 12 June 2025 it withdrew that proposal along with 13 others, effective 17 June 2025.SEC withdrawal The recordkeeping rules on this page apply as written.

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Communications (SEA 17a-4(b)(4))	Keep AI outputs sent about the business, and inter-office communications, for three years	Retained outputs with sender, recipient, timestamp and the tool that produced them
Adviser communications (204-2(a)(7))	Keep written communications on advice, funds and securities, orders and performance for five years	Retained AI-drafted client communications, indexed for retrieval
Written classification	Decide in writing which prompts, drafts and internal AI answers are records	A policy naming each AI tool, its record classes, their retention periods and the approver
Electronic storage (SEA 17a-4(f))	Keep records in a non-rewriteable, non-erasable format or with a complete time-stamped audit trail	Storage configuration showing the retention lock or the audit trail, and the filed undertaking
Adviser electronic storage (204-2(g))	Index records, produce copies promptly, keep a duplicate, and safeguard records from alteration	Retrieval test results and access controls on the record store
Agent actions	Keep the records an agent's actions produce, such as orders and messages	A record of each action: agent, instruction, tool call, result and time
Supervision of AI use	Monitor and supervise AI use under written policies and procedures	The procedures, and records of the reviews they call for

Key dates

Timeline, drawn to scale

SEC and FINRA recordkeeping and AI since 2022

In effect as of October 9, 2026Electronic recordkeeping amendments

Dates from SEC Release 34-96034, FINRA Regulatory Notice 24-09, the SEC withdrawal of File S7-12-23, the SEC FY2026 Examination Priorities and FINRA's release on the 2026 report. Status as of October 9, 2026.

12 October 2022SEC adopts amendments to the Rule 17a-4 electronic recordkeeping requirements (Release 34-96034).
3 May 2023Compliance date for broker-dealers under the amended Rule 17a-4.
26 July 2023SEC proposes rules on predictive data analytics (File S7-12-23).
27 June 2024FINRA Regulatory Notice 24-09 issued.
12 June 2025SEC withdraws the predictive data analytics proposal, effective 17 June 2025.
17 November 2025SEC Division of Examinations publishes its fiscal year 2026 priorities, including AI.
9 December 2025FINRA publishes the 2026 Annual Regulatory Oversight Report.

Sources cited

Common gaps

Where a firm's AI recordkeeping usually falls short of the rules above.

Retention set by the tool. An AI tool that expires its history on its own default schedule can delete a required communication before three or five years have passed.
Outputs kept, prompts dropped. A retained output without the prompt behind it cannot show what the model was asked, which is where a supervision review usually starts.
Notetakers outside the archive. Transcripts and summaries that stay inside the notetaker never reach the firm's records system, so they are neither indexed nor preserved in the required form.
Editable chat history treated as the record. A history a user or administrator can change without a trail meets neither the non-rewriteable option nor the audit-trail option in 17a-4(f)(2).Rule 17a-4 · (f)(2)(i)
No written position on prompts. Without one, each team decides for itself, and the firm cannot show an examiner a consistent rule.
Agent actions logged as text. A transcript of what an agent said leaves out what it did. The tool calls and their results tie an order or a message to the agent that produced it.

In practice

How the Meilynx audit trail records AI activity →

Last reviewed October 9, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.