For most broker-dealers, generative AI continues to become more deeply integrated into day-to-day workflows.
On July 13, 2026, Reuters reported that Morgan Stanley will test digital assistants later this summer that will interact with wealth management clients at all hours of the day. The bank already uses AI agents internally to support its financial advisors.
This follows similar moves by Morgan Stanley’s competitors, such as Goldman Sachs, which announced in February its partnership with Anthropic to build agents for trading, transaction accounting, and client onboarding. A KPMG survey conducted this past June found that 51% of banks were already piloting AI agents.
The regulatory framework is struggling to keep up with adoption at such a scale, leaving firms to confront three pressing questions by themselves: Are AI prompts and outputs records that firms should be legally required to retain? What do firms owe customers if their data were to touch a third-party AI model? And what should an AI-use policy actually say?
Here is where regulators and the largest firms currently stand on each.
Is an AI prompt a “record”?
Regulators have not decided yet.
Broker-dealer recordkeeping is governed by Exchange Act Rules 17a-3 and 17a-4, which require firms to preserve all business communications. Both those rules predate generative AI, however, and neither the SEC nor FINRA has stated yet whether a prompt or its output qualifies.
As presented in a June 2026 Business Law Today analysis, the core disagreement is around whether an AI prompt should be treated as a search query or a communication with a colleague. Historically, internet searches have not been considered records, whereas internal communications are captured by Rule 17a-4.
Until regulators settle this question, firms are operating under recordkeeping principles that are, by design, technology neutral.
FINRA’s 2026 Annual Regulatory Oversight Report suggests caution. Its newly expanded GenAI section reiterates that supervision, communications, recordkeeping, and fair-dealing rules apply to AI exactly as they would to any other technology, treating AI-generated content no differently than any other communication.
In practice, firms are moving toward treating AI interactions as records. Legal advisors are telling firms to classify prompt-and-output logs as business records, ahead of formal rules. For now, routing business use through approved, logged platforms appears the safer approach to avoid any potential issue regarding retention.
What firms should actually keep
Given the uncertainty, firms should consider:
- Treating AI interactions tied to customer information as records by default.
- Applying existing retention schedules, which under Rule 17a-4 generally require most business records to be kept for at least three years.
- Preserving version and audit trails for any AI used in a supervisory capacity.
Reg S-P and the privacy dimension
In addition to recordkeeping obligations, firms face a compliance obligation that bears directly on AI use: the SEC’s amended Regulation S-P. For larger firms – i.e. those with at least $1.5 billion under management, funds with at least $1 billion in net assets, and most broker-dealers – compliance was required by December 2025; smaller firms below that threshold had until June 2026. The amended rule requires firms to notify customers within 30 days of discovering unauthorized access to their personal data, whether the breach originated inside the firm or at a vendor.
The amendments extend a firm’s safeguarding obligations to any third-party service provider that accesses customer data, so an AI that draws on client data to generate responses may qualify. Before using such a tool, firms should confirm that their vendor is contractually bound to the same safeguarding and breach-notification standards the firm owes its own customers, and that the vendor does not use client data to train its models.
Consumer-tier chatbots, like free versions of ChatGPT or Gemini, may retain submitted conversations and use them in training future models. Reg S-P and the parallel FTC Safeguards Rule, which covers nonbank financial institutions more broadly, are both designed to prevent this type of exposure.
How large firms Are Using AI
In the absence of formal regulatory guidance, the market’s largest broker-dealers are moving ahead with agentic AI on their own terms. A common approach is to keep AI internal and supervised first and extend it to clients only cautiously and gradually.
- Morgan Stanley will test client-facing digital assistants this summer that will interact with wealth management clients at all hours, analyzing investments and suggesting strategies. The firm’s head of AI for wealth management, told Reuters that human oversight will remain constant and that agents will not be given autonomy over portfolio decisions.
- Goldman Sachs has partnered with Anthropic to build agents for trade and transaction accounting, and client vetting and onboarding. It rolled its GS AI Assistant out firmwide after starting with roughly 10,000 employees in January 2025. The tool is handling document summaries and first-drafts, so junior bankers can spend more time checking outputs and adding client context.
- Citigroup uses internal tools called Citi Assist and Citi Stylus for policy and document work and has said it plans on developing an AI-powered virtual “team member” for wealth management.
- BNY has gone furthest on integration. It has 134 “digital employees” with their own login credentials, nicknames, and an assigned human manager responsible for training and quality control.
Best practices
Considering the regulatory guidance and what larger institutions have already implemented, a broker-dealer’s AI-use policy should consider addressing:
- Which tools are approved for use
- What data can never be entered into any AI tool, such as confidential client information
- How prompts and outputs will be logged
- Whether AI-assisted client communications go through the same pre-use approval and archiving process as any other communication
- Whether human review of AI generated content is needed before it reaches clients
- Requirements for any new AI tool, including prohibitions on vendor use of client data for model training, and the vendor’s compliance with Reg S-P’s oversight requirements
- Any onboarding or refresher training required for staff
Where this is heading
FINRA has not started formal rulemaking specific to AI, but has indicated that firms should expect further guidance—and eventually rules—addressing AI in customer communications and supervisory systems.
Outside the U.S., the UK Competition and Markets Authority’s March 2026 guidance on agentic AI provided a preview of what that could look like, reinforcing obligations around transparency, human oversight, and compliance-by-design for consumer-facing AI agents.
For now, U.S. firms are still operating under general, technology-neutral rules being applied to a technology that did not exist when those rules were written. The firms best positioned for the regulatory future likely will be those that already treat AI logs as records, already vet their AI vendors under Reg S-P, and already have a written AI-use policy in place.
For More Information
If you have any questions about this blog post, please contact Walter Saurack, any of the attorneys in our Securities Litigation Group, or the attorney with whom you are regularly in contact.
Thanks to our intern Maddie Stoll for her invaluable assistance in the preparation of this post.