How to Retain AI Chat Histories Under SEC Rule 17a-4

Registered representatives now draft client emails, summarize research and prepare meeting notes with AI assistants. Each of those sessions leaves a chat history somewhere, often in a vendor's system the firm does not control. For a broker-dealer or dual-registered firm, the question is which of those histories are books and records, and whether the firm can produce them in the form Exchange Act Rule 17a-4 requires.

Are AI chat histories records under Rule 17a-4?

Some are. Rule 17a-4 looks at what a communication is about, whatever tool produced it, so an AI chat that is a business communication is a record. No SEC or FINRA rule names AI chats, so each firm has to decide in its written procedures how they are treated.

Rule 17a-4(b)(4) requires broker-dealers to keep "originals of all communications received and copies of all communications sent" relating to the business as such, for at least three years, the first two in an easily accessible place. An AI-drafted email sent to a customer is covered like any other email. A chatbot answering customers is sending communications. Internal prompts that discuss a specific customer's account or a recommendation are the gray area firms need to address on paper.

FINRA has said its rules apply. Regulatory Notice 24-09 reminds firms that FINRA's rules are technology neutral and continue to apply when firms use generative AI. FINRA's 2026 Annual Regulatory Oversight Report lists "storing prompt and output logs for accountability and troubleshooting" and "tracking which model version was used and when" among the practices firms may use to monitor GenAI.

What do the off-channel cases mean for AI chat histories?

They show the SEC will penalize firms that fail to preserve business communications on unapproved channels, and a personal AI account used for client work is one more unapproved channel.

On September 27, 2022, the SEC announced charges against 15 broker-dealers and one affiliated investment adviser, with combined penalties of more than $1.1 billion. The SEC said the firms "did not maintain or preserve the substantial majority" of off-channel communications sent by text and messaging apps. If a representative drafts customer correspondence in a personal AI account and the firm has no copy, the same gap exists. For the broader picture on chat, text and notetaker capture, see whether your Teams chats, texts and AI notetakers are archived.

What does Rule 17a-4(f) require of the system that stores AI chats?

The archive must meet the electronic recordkeeping requirements in Rule 17a-4(f), whatever the source of the record. FINRA Rule 4511 points to the same standard.

Since the SEC's 2022 amendments, Rule 17a-4(f)(2) requires an electronic recordkeeping system to:

• Either keep a complete time-stamped audit trail of all modifications and deletions for the full retention period, or preserve records exclusively in a non-rewriteable, non-erasable format.
• Automatically verify the completeness and accuracy of the storage process.
• Time-date the required retention period for each record and, where applicable, serialize the storage media.
• Readily download and transfer copies of a record and its audit trail in both a human readable format and a reasonably usable electronic format.
• Keep a backup recordkeeping system, or other redundancy, that ensures access to the records.

Rule 17a-4(f)(3)(v) also requires an undertaking signed by a designated executive officer or designated third party, and Rule 17a-4(j) requires the firm to furnish records promptly when the SEC asks. FINRA Rule 4511 requires members to preserve FINRA-required books and records in a format and media that complies with Rule 17a-4, and to keep records with no specified period for at least six years.

Where are AI chat histories stored?

AI chat histories are stored wherever the AI vendor keeps them unless your firm captures them into its own systems. What a user sees in the chat window says little about what is retained.

Microsoft is a useful example. As of October 2026, its retention documentation for Copilot and AI apps says data from these interactions "is stored in a hidden folder in the mailbox of the user who runs the AI app," searchable with eDiscovery. Retention policies have separate locations for Microsoft Copilot experiences, enterprise AI apps such as ChatGPT Enterprise, and other AI apps such as consumer ChatGPT and Google Gemini. Prompts and responses in Microsoft 365 Copilot and Copilot Studio are included by default; other Copilots and AI apps are captured only when a collection policy is set to capture content. Microsoft also warns that "messages visible in your AI apps are not an accurate reflection of whether they are retained or permanently deleted."

Retention in a productivity tenant is not the same as a compliant archive. Whether a given configuration meets Rule 17a-4(f) is a question for your compliance team and archive vendor, supported by the vendor's documentation and any third-party assessment it provides. A personal account on a consumer AI service gives the firm no capture at all.

How do you set up AI chat retention under Rule 17a-4?

Set up AI chat retention the way most firms handled texting: approve the AI tools you can capture, archive what they produce, and block the rest.

1. Inventory the AI tools representatives and staff actually use, including AI features inside CRM, planning and email software.
2. Decide in written procedures which AI interactions the firm treats as records: customer-facing chatbot exchanges, AI-drafted communications that are sent, and prompts about specific customers or recommendations.
3. Approve only AI tools whose interactions the firm can capture, and block personal AI accounts on firm devices.
4. Configure capture. For Microsoft 365 Copilot, that means a retention policy on the Copilot location. For other business AI tools, use the vendor's compliance export or API and route it to your archive.
5. Confirm the archive meets Rule 17a-4(f): audit trail or non-rewriteable storage, automatic verification, retention dating, human readable export and a backup or redundancy, plus the required undertaking.
6. Set retention periods by record type, at least three years for communications under Rule 17a-4(b)(4).
7. Test production. Search and export one user's AI interactions for a date range and keep the result as evidence.
8. Supervise. Sample AI interactions under your Rule 3110 procedures. Our guide to sampling AI prompts for supervisory review covers a monthly routine.

What should you do this quarter?

A focused quarter closes most of the gap:

• Write or update the procedure that says which AI interactions are records.
• Compare the AI tools in use against the ones the archive can capture.
• Turn on capture for your approved AI tools and block personal accounts.
• Run one test export and file it with your compliance records.
• Add AI chat retention to your next annual review of written supervisory procedures.

For more on supervision itself, see what to log when supervising GenAI under FINRA Rule 3110.

How can s90 help?

s90 helps broker-dealers and dual-registered firms in Los Angeles and Orange County configure AI tool capture, block unapproved AI accounts and produce test exports as evidence for FINRA and SEC exams. Our agreements include 24-hour evidence production, so you are not waiting on IT when a request arrives. If you want to see where your firm's AI chat histories live today, we can walk through it with you.