FINRA Books and Records: What the Rule Actually Requires When Your Firm Uses AI

Your compliance officer drafted the firm's AI policy. It prohibits using personal AI accounts for business communications and requires employees to use only approved tools. It has been reviewed by outside counsel and circulated to the team.

But here is the question FINRA examiners will ask: can you show me the records of what your AI tools are actually producing?

If the answer is no — if your firm lacks a technical mechanism to capture, archive, and retrieve AI-generated outputs — you have a books and records problem. The policy exists. The records do not.

The Rule Hasn't Changed. The Technology Has.

FINRA Rule 4511 requires every member firm to make and preserve books and records as required under FINRA rules, the Exchange Act, and applicable SEC rules and regulations. The rule does not specify AI. It was written in an era when "business records" meant paper documents and email threads.

But records requirements follow the nature of the communication, not the medium that carries it. This principle was established when fax became standard, when email replaced fax, when instant messaging entered the office, and when mobile text messaging spread to every employee's pocket. FINRA and the SEC have issued billions of dollars in fines for firms that allowed business communications to migrate to new platforms without corresponding records controls.

AI-generated content is the next migration. And the same principle applies.

When an employee uses an AI tool to draft a client email — even if the employee edits the draft before sending — the AI output is part of the record of how that communication was prepared. When an AI tool is used to research a security recommendation, summarize regulatory requirements, or generate compliance documentation, those outputs are records of the firm's business processes.

What Qualifies as a Record Under 17a-4

SEC Rule 17a-4 establishes the technical standards for electronic records at broker-dealers. It applies to records required to be preserved under Exchange Act Rule 17a-3, and it governs format, indexing, auditability, and accessibility requirements.

Under 17a-4, electronic records must be:

Preserved in non-rewritable, non-erasable format. AI outputs that are simply kept in a chat interface or AI platform log — accessible to the vendor, potentially subject to the vendor's deletion policies — do not meet this standard. Records must be preserved in a format that prevents alteration.

Accessible and retrievable. Records must be capable of being produced promptly in response to regulatory requests. If your AI interaction history lives in a vendor's interface and you cannot export it in an auditable format, you cannot produce it in an examination.

Available for the required retention period. General correspondence: three years, with the first two years in an accessible location. Customer account records: six years. Some records have longer retention requirements. Your AI records must meet the same standard as their paper and email equivalents.

Auditable. The system preserving the records must be capable of demonstrating that records have not been altered since they were created. Third-party AI platforms do not typically provide this guarantee as a standard feature.

The Supervision Problem: FINRA Rule 3110

Books and records obligations do not exist in isolation. They intersect with FINRA Rule 3110, which requires broker-dealers to establish and maintain a system to supervise the activities of each registered representative and associated person.

When AI tools are used to draft communications, generate research, or support compliance functions, the supervision obligation extends to reviewing those AI-generated outputs before they are used. That review must be documented. A supervisor cannot approve a client communication drafted with AI assistance without a record of that review.

The supervision failure FINRA is most likely to find is not a firm that has prohibited AI use. It is a firm that has policies governing AI use but lacks technical controls to verify those policies are being followed — and therefore cannot demonstrate to an examiner that its supervision system is working.

What FINRA Is Telling Firms About AI

FINRA has been specific in recent guidance about AI and books and records. The key positions firms must understand:

AI-generated communications are communications. If an AI tool drafts a message that is sent to a customer — whether edited or not — that is a customer communication subject to all applicable content standards, approval requirements, and records obligations. The fact that AI generated the first draft does not change the firm's responsibility for the final output.

AI tools that assist in research create records. If an employee uses AI to research a security, summarize a company's financials, or identify regulatory requirements, those AI outputs are records of the research process. FINRA has made clear that firms cannot claim to have conducted adequate research while lacking the records of how that research was actually conducted.

Vendor contracts must address records obligations. If your firm uses a third-party AI platform, your contract with that vendor must ensure that records can be captured and produced in compliance with 17a-4. Most standard AI vendor agreements do not include these provisions. Firms must negotiate them or choose platforms that support compliant records capture natively.

The Practical Records Gap Most Firms Have

Here is the gap pattern FINRA examiners are finding at broker-dealers that have begun implementing AI tools:

The firm has an AI policy. The policy says employees must use only approved AI tools and must not input customer data into unauthorized platforms. The firm has identified a set of approved tools.

But the firm has not deployed any technical mechanism to capture what employees are doing with those approved tools. The AI interaction logs live in each employee's individual account on the AI platform. There is no centralized archive. There is no non-rewritable preservation. There is no ability to produce specific interactions in response to an examination request.

The policy exists. The records do not.

What a Compliant FINRA AI Records Program Requires

A books-and-records-compliant AI governance program for a broker-dealer has five technical components:

Firms that have built this infrastructure are in a defensible position in examinations. Firms that have policies without infrastructure are accumulating records violations with each AI interaction that goes uncaptured.

The Dually Registered Firm: Two Sets of Standards

Firms that are both broker-dealers (regulated by FINRA) and registered investment advisers (regulated by the SEC) face overlapping records requirements. Rule 17a-4 governs broker-dealer records. Rule 204-2 under the Investment Advisers Act governs adviser records. The standards are similar but not identical — and the intersection creates complexity for firms using AI across both business lines.

For dually registered firms, the more conservative standard generally applies. AI records must be preserved in a format that satisfies both 17a-4 and 204-2 requirements. The retention period is the longer of the two applicable periods. Supervision documentation must satisfy FINRA Rule 3110 for broker-dealer activities and the compliance program requirements of Rule 206(4)-7 for advisory activities.