{"id":370,"date":"2026-07-22T12:09:05","date_gmt":"2026-07-22T16:09:05","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/artificialintelligence\/?p=370"},"modified":"2026-07-22T15:42:32","modified_gmt":"2026-07-22T19:42:32","slug":"ai-and-broker-dealer-compliance-what-firms-need-to-know-now","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/artificialintelligence\/2026\/07\/22\/ai-and-broker-dealer-compliance-what-firms-need-to-know-now\/","title":{"rendered":"AI and Broker-Dealer Compliance: What Firms Need to Know Now"},"content":{"rendered":"\n

By Walter Saurack<\/a> <\/p>\n\n\n\n

For most broker-dealers, generative AI continues to become more deeply integrated into day-to-day workflows.<\/p>\n\n\n\n

On July 13, 2026, Reuters reported<\/a> that Morgan Stanley will test digital assistants later this summer that will interact with wealth management clients at all hours of the day.  The bank already uses AI agents internally to support its financial advisors.<\/p>\n\n\n\n

This follows similar moves by Morgan Stanley\u2019s competitors, such as Goldman Sachs, which announced<\/a> in February its partnership with Anthropic to build agents for trading, transaction accounting, and client onboarding. A KPMG survey<\/a> conducted this past June found that 51% of banks were already piloting AI agents.<\/p>\n\n\n\n

The regulatory framework is struggling to keep up with adoption at such a scale, leaving firms to confront three pressing questions by themselves:  Are AI prompts and outputs records that firms should be legally required to retain?  What do firms owe customers if their data were to touch a third-party AI model?  And what should an AI-use policy actually say?<\/p>\n\n\n\n

Here is where regulators and the largest firms currently stand on each.<\/p>\n\n\n\n\n\n\n\n

Is an AI prompt a “record”?<\/strong><\/p>\n\n\n\n

Regulators have not decided yet.<\/p>\n\n\n\n

Broker-dealer recordkeeping is governed by Exchange Act Rules 17a-3<\/a> and 17a-4<\/a>, which require firms to preserve all business communications. Both those rules predate generative AI, however, and neither the SEC nor FINRA has stated yet whether a prompt or its output qualifies.<\/p>\n\n\n\n

As presented in a June 2026 Business Law Today analysis<\/a>, the core disagreement is around whether an AI prompt should be treated as a search query or a communication with a colleague. Historically, internet searches have not been considered records, whereas internal communications are captured by Rule 17a-4.<\/p>\n\n\n\n

Until regulators settle this question, firms are operating under recordkeeping principles that are, by design, technology neutral.<\/p>\n\n\n\n

FINRA’s 2026 Annual Regulatory Oversight Report<\/a> suggests caution. Its newly expanded GenAI section reiterates that supervision, communications, recordkeeping, and fair-dealing rules apply to AI exactly as they would to any other technology, treating AI-generated content no differently than any other communication.<\/p>\n\n\n\n

In practice, firms are moving toward treating AI interactions as records.  Legal advisors<\/a> are telling firms to classify prompt-and-output logs as business records, ahead of formal rules.  For now, routing business use through approved, logged platforms appears the safer approach to avoid any potential issue regarding retention.<\/p>\n\n\n\n

What firms should actually keep<\/strong><\/p>\n\n\n\n

Given the uncertainty, firms should consider:<\/p>\n\n\n\n