AI notetakers for financial advisers: consent, records and supervision

Why does an AI note taker raise compliance questions for financial advisers?

An AI note taker raises compliance questions because one tool does three regulated things at once: it records a conversation, it creates a written record of that conversation, and it sends client information to a third party. Each of those activities has its own rule, and each needs a decision before the tool joins a client meeting.

Notetakers now arrive as features inside video meeting platforms and CRM systems as well as standalone apps, so many firms have one running before compliance has reviewed it. FINRA's Regulatory Notice 24-09 addresses that directly: its rules apply when firms use generative AI, whether they build the tools themselves or use a third party's technology, "including through embedded features in existing third-party products." FINRA's 2026 Annual Regulatory Oversight Report names summarization and information extraction as the top GenAI use case among member firms. Meeting summaries are exactly that use case.

Who has to consent before an AI notetaker records a client call?

Under federal law, one party's consent is enough. In California, every party to a confidential conversation must consent. 18 U.S.C. 2511(2)(d) allows a person who is a party to a communication, or who has one party's prior consent, to intercept it. California sets a higher bar.

California Penal Code 632(a) prohibits recording a confidential communication "without the consent of all parties," with a fine of up to $2,500 per violation. Penal Code 637.2 gives anyone injured by a violation a civil claim for the greater of $5,000 per violation or three times actual damages, and the plaintiff does not have to prove actual damages to sue.

Section 632(c) defines a confidential communication as one carried on in circumstances that reasonably indicate any party wants it confined to the people taking part. A review of a client's portfolio, estate plan or tax position fits that description easily. Other states have their own all-party consent laws, and which state's law governs a call between a California adviser and an out-of-state client is a question for counsel. A firm can simplify the problem by applying the strictest standard in its client base to every meeting.

How should a firm capture consent?

Make consent part of the meeting itself. A platform banner that announces recording is a start, and it is weak evidence on its own if a client later says they did not see it. Elements that hold up better:

• Notice in the meeting invitation that an AI notetaker will record, transcribe and summarize the call, and why.
• A spoken notice at the start of the recording, so the client's agreement is captured on the record.
• A simple way for the client to decline, and a procedure for turning the tool off when they do.
• Consent from everyone on the call, including a spouse, CPA or attorney who joins partway through.
• The client's preference recorded in the CRM, so the next meeting starts from the right default.

Are AI meeting transcripts and summaries books and records?

They can be, and the firm needs to decide before the tool goes live. No SEC or FINRA rule names AI notetakers, so firms apply the existing content tests.

Rule 204-2(a)(7) requires advisers to keep originals of written communications received and copies of those sent relating to recommendations or advice, the receipt or delivery of funds or securities, and the placing or execution of orders. Broker-dealers must keep originals of all communications received and copies of all communications sent relating to their business under Rule 17a-4(b)(4), and FINRA Rule 4511 requires members to preserve their books and records in a format and media that comply with Rule 17a-4.

A summary emailed to the client after the meeting is a written communication sent. A transcript sitting in the vendor's cloud that discusses a recommendation is harder to classify, and firms reach different answers. What an examiner looks for is a written decision, applied consistently, and the ability to produce whatever the firm said it keeps. If the outputs are records, they need to land in a system that meets the retention and production requirements, and a notetaker vendor's default storage often does not. Our guide to archiving Teams chats, texts and AI notetakers covers the archiving side.

What does supervision of an AI notetaker look like?

It covers two things: what the tool produces, and the vendor that holds it.

Summaries are generated text, and they can misstate what was said, including a client's risk tolerance, goals or instructions. If a summary goes into the client file or to the client, someone should check it for accuracy first, and the firm should be able to show that check happened. For broker-dealers, FINRA Rule 3110(b)(4) requires procedures for reviewing incoming and outgoing written correspondence, which reaches summaries sent to customers. FINRA's 2026 report lists "validation and human-in-the-loop review of model outputs" among effective GenAI practices. For advisers, the policies required by Rule 206(4)-7 are the natural home for the same review step.

On the vendor side, a notetaker that stores recordings and transcripts of client conversations has access to customer information. 17 CFR 248.30(a)(5)(i) requires written policies reasonably designed to require oversight of service providers, "including through due diligence and monitoring," and to ensure they notify the firm no later than 72 hours after becoming aware of a breach of a customer information system they maintain. Retention periods, deletion on request and whether recordings are used to train models all belong in that review. Our guide to Reg S-P service provider contracts covers the 72-hour notice terms.

What should a firm do this quarter?

Start with what is already running, then set the rules for what is allowed. A practical sequence:

• Inventory every meeting platform and CRM in use and check which have AI notetaking or summary features switched on.
• Decide which tools are approved, and turn off or block the rest.
• Write a consent procedure set to the strictest state in your client base, and add notice language to meeting invitations.
• Make and document the books and records decision for recordings, transcripts and summaries, and confirm the approved tool can retain and produce them.
• Add the vendor to your Reg S-P service provider list, review its retention and training terms, and confirm the 72-hour notice commitment in writing.
• Update supervisory procedures to require review of summaries before they reach a client or the file.
• Train advisers and staff, then test the procedure on a sample of meetings next quarter.

How does s90 help?

s90 helps RIAs, broker-dealers and family offices find the AI features already active in their meeting and CRM platforms, configure the approved notetaker so its outputs land where the firm's retention policy says they should, and keep vendor due diligence files current for Reg S-P. Our own agreements include 72-hour breach notification and 24-hour evidence production. If you want to know which notetakers are already running in your environment, that is a good place to start the conversation.