AI compliance: Managing recordkeeping risk as AI use accelerates

And the question from the last two years has been.

You know, what are the record keeping obligations related to AI? You know, what about the communications aspects? Is it different than a Google search? I mean, we've covered a lot of territory.

And I guess the question still is on the table.

I mean, how do we see the regulators providing guidance here in terms of how firms should be dealing with AI outputs? Therese, what have you learned? What have we gathered from regulators as far as their obligations?

Yeah, I mean, I think from the regulatory perspective, what we're hearing from the regulators is what we always hear from the regulators, which is, well, there are rules out there.

And if the rules apply to, you know, the same rules that apply to other technology apply to AI.

And so if you're using AI and the output is a record under the existing regulations, then you need to keep them.

And I think this gets frustrating for a lot of our clients when you're trying to interpret it.

The regulators, particularly with new technology, tend to be deliberately vague, right? In some perspectives, they don't want to stop innovation and they don't want to stop development.

They're still feeling out what AI is and how it works and how it's being used in business.

And they don't want to be overly prescriptive.

They also don't want to be overly prescriptive with respect to particular kinds of technology because technology changes.

So a lot of what they like to say to our clients, and we've seen some guidance coming out from FINRA and the like that are essentially saying, look, AI is subject to the same regulations that we already have.

You need to be mindful of that.

If you are using AI, all of the existing laws apply and you need to make sure that you're applying them.

I think what gets challenging when you start talking about records from the legal perspective is the answer is it depends, which is frustrating because some uses of AI are absolutely creating records.

If you're using it within a very specific compliance process and it's evidence of your compliance process, well then it's maybe a record.

If it's creating a draft, that you're separately editing and saving somewhere else, it may not be a record.

But it really depends on the usage.

The other thing I would say is one of the areas where we have at least a little bit more guidance, but it's still incredibly difficult, is from a communications perspective.

In the financial industry, we have obligations to retain communications.

Sometimes depending on the content and the like.

And Frinder has come out with some guidance that said, look, if you're using AI chatbots and you're communicating with the public, right, it's going to be considered a communication.

Okay.

But that gives the indication that, look, AI tools can be communications, right? Well, then the question becomes, well, when is it a communication? When we talk about records outside of communications, you're talking about a final thing that is a representative, right? You're not talking about every version of it.