AI Governance Is Not a Policy. It Is an Operational Obligation.

The rules turn on the substance of a communication rather than the channel it travelled through, and there is no AI carve-out in them. Whether a specific interaction is a required record depends on your registration and what the interaction was about — a prompt analysing a client position is a different question from a prompt drafting an internal memo. The practical problem is that most firms cannot retrieve either, so the classification question never gets tested.

Sometimes, and it varies by product, edition and configuration. Some AI features route requests to model providers acting as sub-processors outside the tenant, which puts the interaction log on a third party’s retention schedule rather than yours. This is worth verifying for your specific licensing rather than assuming in either direction — the assumption is wrong roughly as often as it is right.

Any AI tool in use without approval or visibility. It matters because you cannot retain, supervise or govern what you cannot see — business is being conducted on a channel outside every control the firm operates. It is also the most common finding, because staff adopt tools faster than committees approve them and consumer accounts leave no trace in the tenant.

Almost certainly not. Examiners write findings when a firm commits to a procedure and then does not follow it, so a policy promising comprehensive monitoring you cannot sustain creates an examinable obligation where none existed. Scope deliberately — name the approved tools, the captured channels and the retention period — then prove that narrower commitment completely.

Inventory and attestation, before technology. Knowing which AI tools are actually in use, and having staff formally acknowledge a scoped policy, produces the two artefacts asked for first and can be completed in weeks. Retention and monitoring follow once you know what you are retaining and monitoring.