Key facts
- Rule 204-2(a)(7) requires an SEC-registered adviser to keep "originals of all written communications received and copies of all written communications sent" relating to recommendations, advice, funds or securities, and orders.
- Rule 204-2(a)(11) requires a copy of each advertisement the adviser disseminates, and a memorandum of reasons where an advertisement recommends a specific security without stating them.
- Rule 204-2(a)(3) requires a memorandum of each order that identifies "the person connected with the investment adviser who recommended the transaction to the client and the person who placed such order."
- Required records must be kept for five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the adviser (204-2(e)(1)); advertisements for five years from last dissemination (204-2(e)(3)).
- Electronic records must be indexed for retrieval, producible promptly on request, safeguarded from loss or alteration, and duplicated on a separately stored copy (204-2(g)).
- Whether a particular document is a required record is the firm's determination; Rule 204-2 assigns the obligation to the adviser, not to any vendor.
Rule 204-2 lists categories of records, and AI does not add a category
The adviser books-and-records rule, 17 CFR 275.204-2, works by enumeration. Paragraph (a) lists what "every investment adviser registered or required to be registered" must "make and keep true, accurate and current," from journals and ledgers through written communications, advertisements, agreements, the code of ethics, and the Regulation S-P records added in 2024. Nothing in the rule turns on who or what produced a document. The word "artificial" does not appear. So the question for any AI-generated document is the same question as for any other: does it fall within one of the listed categories? If it does, it is a required record with the retention and storage rules that follow. If it does not, the firm may still choose to keep it, and there are good reasons to, but Rule 204-2 does not compel it.
A sent communication relating to advice is a record, whoever drafted it
Rule 204-2(a)(7) requires "originals of all written communications received and copies of all written communications sent by such investment adviser relating to" any recommendation or advice given or proposed, any receipt or disbursement of funds or securities, the placing or execution of orders, and performance. The category is defined by the communication's subject and by its being sent or received, not by its authorship. A client email that an AI system drafted and an advisor sent is a written communication sent relating to advice, and the copy the firm must keep is the version that was sent. The same applies to a meeting summary emailed to a client, a planning memo delivered through a portal, or a text message about a trade. The practical consequence is that the record is the sent version, and the firm must be able to produce it from its own systems, not from a screenshot in a vendor's history view.
An unsent draft is usually not a record under (a)(7), and that is where the reconstruction problem lives
Rule 204-2(a)(7) covers communications sent and received. A draft that was generated, edited, and discarded was neither. On the rule's text, most AI drafts are not required records. That is not the end of the analysis, for two reasons. First, if the draft was materially changed before sending, the sent version is the record and the draft is the evidence of what the person decided; a firm that keeps only the vendor's draft has the wrong document. Second, Rule 206(4)-7 requires policies reasonably designed to prevent violations, and a supervisor asked how AI-drafted client communications were reviewed will want to show what changed between draft and sent. The Firm Remembers What It Can Reconstruct makes the continuity argument for keeping the draft, the decision, and the sent version together. Rule 204-2 requires the third; good practice keeps all three; the firm decides where the line is and writes the decision down.
AI-drafted advertisements are advertisements under the Marketing Rule and (a)(11)
Rule 204-2(a)(11)(i)(A) requires "a copy of each advertisement" as defined in the Marketing Rule (17 CFR 275.206(4)-1(e)(1)) that the adviser disseminates, directly or indirectly. Paragraph (a)(11)(i)(C) adds that if any such communication "recommends the purchase or sale of a specific security and does not state the reasons for such recommendation, a memorandum of the investment adviser indicating the reasons therefor." AI changes the volume of marketing a small firm can produce, not its classification. A generated LinkedIn post, a personalized outreach email to prospects, or a market commentary sent to more than ten persons is an advertisement or an (a)(11)(i)(B) communication on the same terms as before. The retention clock for these is different from the general rule: five years from the end of the fiscal year in which the adviser "last published or otherwise disseminated" the communication (204-2(e)(3)(i)), which for evergreen web content means the clock has not started. When the Firm Arrives With a Product covers the substantiation side.
If an AI system participates in an order, the order memorandum must still name a person
Rule 204-2(a)(3) requires a memorandum of each order that "shall identify the person connected with the investment adviser who recommended the transaction to the client and the person who placed such order." The rule contemplates persons. An adviser using AI to screen, propose, or route trades still needs a memorandum that names the person who recommended and the person who placed, with the terms, the account, the date, and the broker. An AI system's involvement does not change the requirement; it raises the question of who the named person is when a system proposed the trade. One defensible answer is the professional who reviewed and approved the recommendation, and the order memorandum should be able to say so. A firm that lets a system propose trades should decide in advance whose name goes in that field and record the decision in its procedures, so the answer is settled before the first memorandum is written rather than reconstructed afterward.
The electronic storage requirements apply to AI output kept as records
Rule 204-2(g) permits required records to be kept on electronic storage media if the adviser can "arrange and index the records in a way that permits easy location, access, and retrieval," can "provide promptly" a legible copy and the means to access, view, and print, and stores "a duplicate copy of the record on any medium allowed by this section" separately (204-2(g)(2)). For electronic media the adviser must also maintain procedures to safeguard the records "from loss, alteration, or destruction," to limit access to authorized personnel and the Commission, and to ensure reproductions are "complete, true, and legible when retrieved" (204-2(g)(3)). Applied to AI tools, this means a record that exists only inside a vendor's application, retrievable only through the vendor's interface and only while the subscription lasts, does not obviously satisfy the duplicate-copy or the retrieval requirement. The firm needs its own copy, in its own system, indexed its own way.
What vendor terms typically say about records, and why it matters
Of the nineteen AI vendors whose public documents ValaisOS reviewed in August 2026, three say in their terms that the service does not satisfy or replace regulatory recordkeeping and that the customer must keep its own records, and three more put responsibility for backups, data, or retention settings on the customer (counted September 9, 2026; the register page links each document). The disclaimer is not improper; Rule 204-2 places the obligation on the adviser regardless of what any vendor says. What the disclaimer does is remove any expectation that the vendor's logs, history views, or exports will satisfy 204-2(g). A firm relying on a vendor's retention to meet its own obligation should ask, in writing, whether the vendor's records satisfy Rule 204-2 or whether its terms disclaim that. That is question eight of the nine questions. The answer determines whether the firm needs a deliberate step that moves sent communications into a system it controls.
What should a small SEC-registered adviser do with AI output this quarter?
A workable sorting rule for a small firm has three bins. Sent or disseminated: any AI-assisted document that went to a client, a prospect, a counterparty, or the public relating to advice, funds, orders, performance, or marketing is a required record; keep the sent version in the firm's own system with the date and the sender. Internal and material to a decision: drafts, transcripts, summaries, and analyses that shaped a recommendation or a client conversation are not clearly required by (a)(7), but they are the evidence that judgment was applied; the firm should decide, in writing, which of these it keeps and for how long, and keep the approval trace alongside. Ephemeral: prompts, rejected drafts, and system chatter that shaped nothing; the firm can decide not to keep these, and should say so in policy rather than by default. The sorting rule itself belongs in the compliance manual, so an examiner sees a decision rather than an accident.
What should the record contain when an examiner asks?
For the compliance officer, the file for any AI-assisted client communication should let a reviewer answer four questions from the record alone: what was sent, to whom, when, and by whom; what the system was given and produced, where the firm has decided to keep that; what the person changed or approved; and where the record lives and how it is retrieved. For advertisements, add the substantiation for any material statement and, for a specific-security recommendation without stated reasons, the (a)(11)(i)(C) memorandum. For any order an AI system touched, the (a)(3) memorandum naming the person who recommended and the person who placed. The retention period is five years from the end of the fiscal year of the last entry under (e)(1), or from last dissemination for advertisements under (e)(3). A Policy Without a Record Is a Promise Without Receipts is the shorter version of this section, and the vendor side of the file is the subject of the Technology governance articles as a set.
Questions
Does Rule 204-2 say anything about AI?
No. The text of 17 CFR 275.204-2 does not mention artificial intelligence. It lists categories of records, and an AI-generated document is a required record if it falls into a category, on the same terms as a human-written one.
Is an AI-generated meeting summary a required record?
If it is sent to the client it is a written communication sent relating to advice under 204-2(a)(7) and the sent version is a record. If it stays internal, the rule does not clearly require it; the firm should decide in writing whether to keep it as evidence of the judgment applied.
Can I rely on my AI vendor's retention to satisfy Rule 204-2?
Only if the vendor's records meet 204-2(g): indexed for retrieval, promptly producible, safeguarded from alteration, with a separately stored duplicate. Several vendor terms disclaim any recordkeeping role; three of nineteen reviewed say so outright. Ask in writing and keep the answer.
How long must AI-assisted client communications be kept?
Five years from the end of the fiscal year during which the last entry was made on the record, the first two years in an appropriate office of the adviser (204-2(e)(1)). Advertisements run five years from last dissemination (204-2(e)(3)).
Who is the "person who recommended" when an AI system proposed a trade?
Rule 204-2(a)(3) requires the order memorandum to identify a person. One defensible answer is the professional who reviewed and approved the recommendation, and the memorandum should be able to name that person.
Advisor Insights provides general professional information, not individualized investment, legal, or compliance advice. Which documents are required records is a determination each firm makes with its compliance and legal advisers; this article describes the rule's categories and does not make that determination for any firm. Regulatory descriptions are U.S. federal and current as of September 2026.
Primary sources
General information from ValaisOS LLC, not legal, compliance, tax, or investment advice. Confirm requirements for your firm with counsel. See Terms of Use.