AI meeting notes and SEC recordkeeping: what an RIA must keep under Rule 204-2 and Reg S-P

Where the time goes after a client meeting

A review meeting ends and the follow-through starts. Someone writes the note into Redtail or Wealthbox in the firm's format, starts the follow-up tasks, drafts the recap email and passes instructions to operations, such as a beneficiary form to send or a Roth conversion to start. Kitces Research found in its 2018 survey that the average lead advisor spent about 6 hours a week on follow-through client servicing, on top of 8.8 hours in client meetings.

AI notetakers took the first step off that list quickly. In the 2026 T3/Inside Information Software Survey, 42.86% of respondents used one. Schwab's study of 533 RIAs, published in January 2026, found 63% using AI in some capacity, with use concentrated on administrative tasks like notetaking and email drafting. On September 14, 2026, Schwab announced that its Advisor Services business is the first RIA custodian in Anthropic's Claude for Financial Advisors, which includes agents that handle pre- and post-meeting work and CRM updates.

The transcript is only the first step. After it come the note in the firm's own format, the CRM tasks, the recap email and the compliance items buried in an hour of conversation, and each takes staff time worth measuring at your firm. Cerulli found in January 2026 that 70% of billion-dollar RIAs use AI for notetaking or call documentation, while 25% use it for CRM updates and related tasks such as engagement tracking. Whichever tool drafts those steps, your firm still owns the record they leave behind.

What Rule 204-2 requires, and what it leaves to your policy

This section is general information about SEC rules, not legal or compliance advice. State-registered advisers follow their state's books and records rules, and dually registered firms also answer to FINRA, so check with your CCO and counsel before you set policy.

Rule 204-2 under the Advisers Act lists the books and records an SEC-registered adviser must keep, and four parts of it matter most for meeting notes. Paragraph (a)(7) covers written communications sent and received that relate to advice, recommendations, the movement of funds or securities, or the placing of orders. A recap email the advisor sends after a review relates to advice, so it is a required record and has to leave through a channel your firm archives. Paragraph (a)(3) requires a memorandum of any instruction from a client about buying, selling, receiving or delivering a particular security. When a client asks in the meeting to sell a fund, that instruction goes through your normal order process with its own memorandum.

Retention comes from paragraph (e)(1): five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser. Paragraph (g) allows electronic storage if the firm can index records for easy location and retrieval, produce a legible, true and complete copy, keep a duplicate, protect records from loss or alteration, and limit access to authorized staff.

The rule does not classify records by whether AI created them, and it does not say whether a transcript, a recording or an AI summary is itself a required record. What the document contains and how it is used both matter. A transcript that captures a client's instruction to sell a security sits differently from a note about scheduling. We could not find an SEC rule, proposal or staff statement written specifically about AI notetakers. Have counsel decide which transcripts and summaries fall within the required record categories. Then write the answer into your retention policy and apply it the same way every time. An approved CRM note does not replace any other record the rule requires.

The SEC has not adopted an AI rule for advisers. Its 2023 proposal on predictive data analytics was withdrawn in June 2025, and its regulatory agenda published in August 2026 lists nothing to replace it. Existing duties still apply, including fiduciary duty, the Marketing Rule, Reg S-P and books and records.

Reg S-P now that both compliance dates have passed

The SEC amended Regulation S-P in May 2024. Advisers with $1.5 billion or more in assets under management had to comply by December 3, 2025, and smaller advisers by June 3, 2026. Both dates have passed. The SEC's FY2026 examination priorities say examiners will check whether firms have developed and implemented policies under the new provisions, with a focus on oversight of third-party vendors.

The amended rule requires an incident response program. When unauthorized access to or use of customer information has occurred or is reasonably likely, the firm must notify affected individuals as soon as practicable, and no later than 30 days after becoming aware of it. The exception requires a reasonable investigation finding that sensitive customer information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience. Oversight policies must also be reasonably designed to make service providers notify the firm as soon as possible, and no later than 72 hours after becoming aware of a breach that gave unauthorized access to a customer information system they maintain. The firm still owns notice to its clients.

The rule defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through services provided directly to the firm. An AI notetaker your firm contracts with directly can fit that definition, and so can a firm like QueryNow that builds or runs an agent on your client data. Their subprocessors may fall outside it, so assess them as part of each provider's due diligence. Transcripts often hold the data the rule treats as most sensitive, such as a Social Security number read out to fill in a form.

In practice, list which providers meet the definition and keep a due diligence file for each. The final rule dropped a proposed written contract requirement, but written notice terms that match the 72-hour standard are still the control we recommend.

Who does what when an agent drafts the note

Give the agent anything a careful new CSA could do from the transcript and the CRM, and keep judgment and client contact with people. The table shows how we split the work.

Two rules are worth making absolute. Recap emails leave only from your archived email system, never from a notetaker's own app, because a tool that can email or text clients is a new communication channel your firm would have to approve and archive. The second rule covers trade instructions: the agent flags them, and operations handles them through the order process with the memorandum paragraph (a)(3) requires.

The SEC has shown what gaps in communications records cost. In August 2024 it charged 26 firms over failures to keep electronic communications, with $392.75 million in combined penalties. In January 2025 it charged nine advisers and three broker-dealers over off-channel communications, $63.1 million combined. Those cases involved texts and messaging apps, and an AI tool that messages clients raises the same question.

Controls to put in place before go-live

FINRA's 2026 Annual Regulatory Oversight Report names summarization and information extraction as the top generative AI use among member firms. Its effective practices include storing prompt and output logs and tracking which model version was used and when. For AI agents, it lists the risk of agents acting autonomously without human validation and approval. FINRA writes for broker-dealers, but the same controls answer the SEC's FY2026 focus on how advisers supervise their use of AI in back-office operations. These are the controls we build in:

• Each approved note is stored in the CRM with the draft and the approver's name and time.
• Recap emails go out only through your archived email system, after the advisor approves them.
• Trade instructions route to operations automatically, with the transcript quote attached. Complaints and third-party money requests go to a person for review.
• Recordings and transcripts follow a written retention and disposal policy that counsel reviewed and your CCO signed.
• Participants consent before any recording, and counsel confirms the recording and privacy rules that apply to your clients.
• Each provider that meets the Reg S-P definition has a due diligence file covering data location, retention, training on client data and subprocessors.
• Notice terms with each provider match the 72-hour standard, and the AI system has an entry in your incident response program.
• Access follows least privilege: the agent reads what it needs and writes only drafts.
• A log records each prompt, output, model version and approval, kept as long as the record it supports.

Worked example: follow-up time at a five-advisor firm

This is an illustrative example with assumed numbers, not a client result. Take a firm with five lead advisors who each hold 8 client meetings a week, so 40 meetings. Today each meeting costs 30 minutes of follow-through by the advisor or a CSA, covering the note, the CRM tasks, the recap email and filing. That is 1,200 minutes, or 20 staff hours a week. For comparison, Kitces reported about 6 hours of follow-through per lead advisor in its 2018 survey.

Now assume 32 of the 40 meetings are routine, with no trade instruction or major life event to handle. With an agent drafting, the advisor spends about 8 minutes reviewing and approving each one, 256 minutes in all. The other 8 meetings still take the full 30 minutes, another 240 minutes. Total time falls to 496 minutes, about 8.3 hours, which gives back about 11.7 staff hours a week.

The routine share moves the result more than any other number. If half the meetings carry instructions or life events, the saving falls to about 7.3 hours a week. Count a real week before you trust any estimate, ours included.

The records add up as well. Forty approved notes a week over 50 working weeks is 2,000 notes a year, or 10,000 over five years. Required retention runs from the end of a fiscal year and may extend beyond that period. A useful test before go-live: ask someone to pull every record for one household and time it.

Starting small with meeting follow-up

Pick one advisor and one ordinary week. Time the follow-through after each meeting and tag each meeting as routine or not. Write down your current policy on transcripts and recordings. Then run an agent against copies of last month's transcripts, with nothing written to the CRM or sent to clients, and compare its notes and flags with what your team recorded.

That test is close to what our five-day AI Workflow Sprint does. You get a working prototype on your redacted transcripts, then a fixed build quote with the staff hours behind it. The sprint costs $2,500 and comes off the build if you go ahead, with a full refund if we do not find 10 staff hours a week. Whoever you work with, ask for that test on your own meetings before any agent writes to your CRM.

Common questions