AI has revolutionized the way many businesses operate. Firms in the financial sector are eager to take advantage of rapidly developing technologies but do not want to risk running afoul of relevant Securities and Exchange Commission (SEC) recordkeeping provisions. As service providers continue to expand and enhance available AI technologies, new AI functionality in messaging systems have raised questions and concerns about recordkeeping compliance.
This article discusses:
- Key functionalities of AI technology in the widely used Zoom and Microsoft applications.
- Relevant SEC rules, with a focus on the broker-dealer (BD) and investment adviser (IA) requirements regarding communications.
- The extent to which the use of those technologies implicate relevant recordkeeping or other rules.1
While current AI tools offer a range of functionalities, the newer developments in messaging systems likely do not present new challenges for recordkeeping compliance with respect to retained communications, except where such tools result in the subsequent transmission of relevant, AI-generated information. To illustrate, the generation of a meeting summary within Zoom, on its own, likely does not implicate the IA and BD rules regarding communications unless that summary is subsequently sent as a written communication, via email for instance.
Key Points
- AI-generated information that is not subsequently transmitted likely does not constitute a written communication that must be retained under relevant IA and BD recordkeeping rules.
- In contrast, AI-generated records that are transmitted through email, chat or otherwise, would trigger retention requirements, assuming the subject matter brings them within the rules.
- Depending on the nature of usage and retention of AI technologies, firms should scrutinize whether SEC rules relating to electronic recordkeeping systems require further steps to be taken.
- Separate from the SEC requirements, firms should consider retaining certain AI-generated records for other compliance or risk-mitigation purposes.
Functionalities of Relevant Technology
Many firms already leverage AI technology — which includes machine learning, deep learning and generative AI — in a number of ways, including for price forecasting, customer service, and automated planning and investment services. Service providers like Zoom and Microsoft have offered AI technology to users with paid service plans since 2023.2 This new technology aims to optimize communication functionalities. Because these are widely used, we will focus on them.
Among other things, AI features in Zoom and Microsoft can assist with drafting, transcribing, summarizing and prompting action items based on conversation content in the respective application. For instance, Zoom AI Companion and Microsoft Copilot can draft communications, generate transcriptions of conversations, identify points of agreement and disagreement of a discussion and summarize action items.3 Additional functionalities based on prompts include answering questions (e.g., “What action items have been assigned?”) and generating topics and content for discussion (in Zoom Whiteboard).4
More recently, Zoom and Microsoft expanded AI capabilities to reach beyond the communication platforms. For example, Microsoft Copilot, because it is embedded within Microsoft 365 applications, can broadly analyze and synthesize data across numerous sources to generate work product.5 Within Word, PowerPoint and Excel, Copilot can generate drafts based on prompts. One of Microsoft’s promotional videos uses the prompt, “Draft a product announcement based on [document],” as an example. And in response to a prompt like “Tell my team how we updated the product strategy,” the Business Chat function would analyze data within Microsoft applications such as Outlook or Word to generate a response.
Similarly, in May 2024, Zoom launched Ask AI Companion, which gathers and synthesizes information across third-party applications in addition to the Zoom workspace. The examples of tasks appear to be similar to those already made available by Zoom AI Companion (e.g., composing messages, suggesting content for first drafts), but the scope of data for sourcing appears to be broader.6
Relevant Rules
As discussed below, there are several SEC recordkeeping provisions that may be implicated by use of the AI capabilities offered by Zoom and Microsoft. Given that many of the functionalities are focused on communications, the recordkeeping rules relating to communications are most relevant, especially in light of the SEC’s heightened focus in recent years on unretained communications.
In general, broker-dealers must preserve communications relating to the broker-dealer business. Rule 17a-4(b) describes the categories of records that a broker-dealer must preserve, including “originals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer … relating to its business as such.”7 Examples include: (1) “communications sent (and any approvals thereof)”; (2) inter-office memoranda; and (3) communications “relating to its business as such, including all communications which are subject to rules of a self-regulatory organization of which the member, broker or dealer is a member regarding communications with the public.”8
Rule 204-2(a) requires investment advisers to maintain certain records “relating to [their] investment advisory business” including “written communications sent by such investment adviser relating to” four enumerated subjects: (i) any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) any receipt, disbursement or delivery of funds or securities; (iii) the placing or execution of any order to purchase or sell any security; and (iv) predecessor performance and the performance or rate of return of any or all managed accounts, portfolios, or securities recommendations (subject to certain exceptions). 17 C.F.R. §275.204-2(a)(7).9
Application
Required Communications
The AI functions offered by Microsoft and Zoom allow users to access and generate a wide variety of information within the applications. In determining whether an AI-generated record is a required communication under Rule 17a-4 or Rule 204-2(a)(7), a threshold question is whether the record was subsequently transmitted via email, chat, etc.
Regardless of whether the content is a meeting summary or list of action items, the transmission would constitute a communication for purposes of Rule 17a-4(b)(4) or Rule 204-2(a)(7), assuming the content falls within the scope of either rule. While the IA and BD recordkeeping rules would be triggered under these circumstances, in practice this is unlikely to pose a recordkeeping issue assuming the transmission was through an on-channel platform (e.g., Outlook) where the communication is preserved automatically.
If, however, the record or information that is generated simply exists or is stored in the application or the cloud, Rule 17a-4(b)(4) and Rule 204-2(a)(7) are likely not implicated, as those rules apply to written communications that are sent and received.10 The generation of information in an application cannot reasonably be interpreted as a sent or received communication. If, however, this information is subsequently transmitted in written form, for example in a chat or an internal email, then SEC recordkeeping requirements may apply to that written transmission.
Other Recordkeeping Considerations
Though not necessarily required under relevant recordkeeping rules, there are some records for which it would be in the best interest of a firm to retain to address potential issues arising from the use of AI. For instance, firms should carefully track and document the datasets used by their AI models to ensure that nonpublic information is not used. Likewise, firms should diligently monitor and document the use of AI technologies to ensure that any public representations about their use are fair and accurate.11
Outside the SEC recordkeeping context, companies would be prudent to closely track and monitor the use of AI to prevent running afoul of certain prohibited uses and disclosure regimes. For instance, in the context of copyright registrations, the U.S. Copyright Office requires disclosure of the use of AI where the AI-generated contributions are more than de minimis.12 And service provider contracts may restrict a firm’s use of AI-generated information or documents, including by prohibiting the use of such information for the purpose of training a competing or similar AI system.
Conclusion
Broker-dealers and investment advisers should continue to closely monitor and track their use of AI, but can likely take advantage of certain Microsoft Copilot and Zoom functionalities without violating the IA and BD rules on retained communications.
With respect to broader use of AI technology used to generate substantive work product, firms should proceed with more caution to ensure compliance with relevant disclosure rules or prohibited proprietary uses.
_______________
1 This article focuses solely on recordkeeping requirements for communications. AI-generated content may be subject to other recordkeeping requirements and federal securities laws. See our February 23, 2024, article “Understanding SEC’s Focus Amid Lack of Final AI Rules.”
2 See Yusef Mehdi, “Announcing Microsoft Copilot, Your Everyday AI Companion,” Microsoft (Sept. 21, 2023); Robin Bunevich, “Zoom Workplace Takes AI to the Next Level, Introducing Ask AI Companion and AI Companion Capabilities for Zoom Phone” (March 25, 2024).
3 Lauren Reed, “Favorite AI Companion Tips and Tricks From Actual Zoomies, Zoom” (Jan. 11, 2024); Zoom, “Using Smart Recording With AI Companion” (July 9, 2024); Zoom, “Using Audio Transcription for Cloud Recordings” (March 6, 2024); Jared Spataro, “Introducing Microsoft 365 Copilot – Your Copilot for Work,” Microsoft (March 16, 2023).
4 Reed, supra note 3.
5 Spataro, supra note 3.
6 Bunevich, supra note 2.
7 17 C.F.R. §240.17a-4(b)(4).
8 Id.
9 On July 26, 2023, the SEC proposed new rules regarding the use of predictive analytics and similar technologies by broker-dealers and investment advisers in their interactions with investors. In addition to Proposed Rule 211(h)(2)-4, which would require broker-dealers and investment advisers to take a number of actions to address conflicts of interest associated with the use of those technologies, the SEC also proposed amending Exchange Act Rules 17a-3 and 17a-4 and Advisers Act Rule 204-2 to require broker-dealers and investment advisers to maintain books and records related to the requirements of the proposed conflict rules. See our August 10, 2023, client alert “SEC Proposes New Conflicts of Interest Rule for Use of AI by Broker-Dealers and Investment Advisers.” Under the proposed rule, required books and records include disclosures to investors of the use of covered technologies, documentation of the evaluation, determination and resolution of any conflict, testing, and instances in which a covered technology was overridden, among others. These rules are not currently in effect and may be subject to change during the rulemaking process.
10 See 17 C.F.R. §275.204-2(a)(7) (“Originals of all written communications received and copies of all written communications sent”); 17 C.F.R. §240.17a-4(b)(4) (“Originals of all communications received and copies of all communications sent”).
11 See SEC Chair Gary Gensler, Chair Gary Gensler on AI Washing (March 18, 2024).
12 United States Copyright Office, “Artificial Intelligence and Copyright” (Aug. 30, 2023), at 5. See our August 2, 2023, client alert “Copyright Office Provides Guidance on the Registration of Works That Include AI-Generated Material.”
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.