AI meeting notes at an RIA: Regulation S-P and recordkeeping

Short answer: An RIA should decide how AI meeting notes are captured, reviewed, retained and retrieved before a notetaker joins a client meeting. For SEC-registered advisers, the SEC's Regulation S-P amendments add customer-information safeguards and compliance records to that review. The SEC lists December 3, 2025 for larger entities and June 3, 2026 for smaller entities as the compliance dates; both are past as of this article's November 3, 2026 review. Ask your compliance officer to classify the firm's obligations and each proposed record, rather than assuming every recording has the same retention rule.

Obsidian Ridge offers the assessment below. The meeting workflow and checklist are our recommendations; the regulatory statements come from the SEC sources identified here.

Key facts

• Can an RIA use AI meeting notes? Our recommendation is to approve a specific workflow only after the compliance officer has decided the data, review and recordkeeping rules. Start with the weekly checklist.
• Covered advisers: The SEC's guide includes “investment advisers registered with the Commission”. A state-registered firm needs its own applicability review. SEC small-entity guide, checked November 3, 2026.
• Compliance dates: The guide gives December 3, 2025 for larger entities and June 3, 2026 for smaller entities. The SEC's small-firm outreach page also names the “June 3, 2026, compliance date.” SEC guide and SEC outreach page, checked November 3, 2026.
• Safeguards and evidence: The amendments include an incident-response program, service-provider oversight and “written records documenting compliance with the amended rules”. SEC guide, checked November 3, 2026.
• A separate recordkeeping question: SEC staff's explanation of Rule 204-2(a)(7) refers to “all written communications related to any recommendation made or proposed to be made”. Have the compliance officer classify the proposed note and its uses. SEC staff bulletin, footnote 25, checked November 3, 2026.

What is the firm actually approving?

Approve a meeting process, not just a subscription. Our recommendation is to start with a description that an adviser and the chief compliance officer can both understand: the service captures a permitted meeting, produces a draft, a named person reviews it, and an approved record goes into a specified location. Add every other proposed action, including a client recap, task assignment or CRM update.

Use an invented planning discussion to make the description concrete. The example can contain a fictional change of circumstances and an unresolved question, but no actual client information. Decide whether the draft should preserve uncertainty or whether staff are expecting it to infer a recommendation. Put a human review point before anything is sent or recorded as a completed instruction.

Record the exact account, plan and workspace owner. Ask which calendar connection can invite the notetaker and which account stores the output. Include assistants and support staff in the review if they can schedule meetings or share notes. A policy addressed only to the adviser can leave the actual host without clear instructions.

The AI-tool evidence index is a starting point for vendor questions. Its entries for Otter.ai, Fireflies.ai, Read AI and Zoom AI Companion do not establish that a product meets the firm's recordkeeping needs. Ask for evidence for the account and features the firm intends to use.

Two entries in that index were built for adviser workflows specifically. Jump joins the client meeting, writes the notes and the follow-ups and files them against the client record. Zocks produces notes and structured client data without recording the meeting, which changes which artifacts exist to classify in the record map below. Each page records what the vendor publishes for each plan, with the date the page was read, and neither page decides the firm's recordkeeping question for it.

What do the Regulation S-P dates mean for this review?

Treat the published dates as existing milestones, not a future reason to postpone the decision. The SEC's guide gives the tiered dates quoted above and describes the affected institutions. Ask your compliance officer to determine the firm's category under the rule rather than using employee count as a substitute. SEC small-entity guide, checked November 3, 2026.

For a state-registered adviser, ask the compliance officer which state and other requirements apply. Do not copy a Commission-registered firm's conclusion solely because both businesses call themselves RIAs. The broader small-RIA cybersecurity guide provides context for that conversation; the decision belongs in the firm's own compliance process.

Our practical application is to include the notetaker in the existing customer-information review. Identify the information it receives, the account owner, the access granted and the places it exports material. Give the compliance officer the actual vendor terms and data-flow record. A product demonstration showing an accurate summary does not answer those questions.

Keep a dated decision even when the outcome is a hold. State the missing evidence, who will obtain it and which uses remain prohibited. This gives staff an answer they can follow while the review continues, without implying the vendor has a defect that nobody has established.

Which notes and recordings need to be kept?

Ask the compliance officer to classify the artifacts individually: audio, transcript, generated draft, corrected note, client recap and any resulting instructions. Do not assume deleting audio is always required for privacy, or that keeping every recording forever is the correct compliance response.

The SEC staff bulletin explains recordkeeping for written communications about recommendations and advice under Rule 204-2(a)(7). That statement does not resolve the status of every internal draft or audio recording in your workflow. Bring the actual examples to the compliance officer and ask which rule, policy or preservation obligation governs each. SEC staff bulletin, footnotes 25 and 27, checked November 3, 2026.

Our suggested record map separates the legal decision from the technical test:

Record the compliance officer's retention decision before configuring automatic deletion. Test retrieval from the approved record location after a staff account is disabled. A vendor dashboard that works only while one employee remains subscribed is not a completed demonstration of the firm's chosen retrieval process.

What should a reviewer check before the note becomes a record?

Our recommendation is to compare the draft with the meeting, then resolve uncertainty with the adviser who attended. Check who said what, which options were only discussed, what the client actually authorized and what remains outstanding. A statement about possible future action should not become a completed instruction merely because the summary uses confident language.

Keep the review usable for a small firm. Assign one reviewer and a backup, identify where drafts wait, and state which items cannot proceed without the adviser. Record the correction and review status in the approved workflow. Ask the compliance officer how to handle versions and supporting material rather than inventing a universal rule in the software settings.

Test a deliberately ambiguous invented conversation. Include two people discussing different account types, a tentative date and an unresolved decision. The useful result is a documented process for checking and correcting the draft. A perfect result on one sample does not establish that the next meeting can skip review.

Do not permit an unreviewed note to trigger client instructions, account changes or follow-up messages during the pilot. Approve those actions separately if the firm later wants them. This is our recommended boundary for the test, not a claim about the capabilities of every notetaker.

What belongs in service-provider and incident planning?

Ask how the vendor will contact the firm about an incident, which contact receives the message, and what evidence the firm can obtain about affected information. Include the notetaker's exports and connected systems in the scenario. The compliance officer should review the vendor arrangement against the firm's applicable obligations.

The SEC's adoption announcement describes a written program designed to “detect, respond to, and recover from” unauthorized access to or use of customer information. Use that source as context for the compliance review, not as an assurance that a notetaker's incident email completes it. SEC announcement, May 16, 2024, checked November 3, 2026.

Our recommended exercise is simple: an invented transcript is shared with the wrong recipient. Have staff identify who is told, how further sharing is stopped, what facts are preserved and who decides the next response. Leave legal notification decisions with the compliance officer and counsel. The test should reveal a working contact route, not require staff to improvise a legal judgment.

What can the adviser decide this week?

1. Confirm applicability. Have the compliance officer record the firm's registration and applicable requirements, including the relevant Regulation S-P compliance milestone.
2. Choose one use. Name the tool, account, plan, permitted meeting type, capture settings and intended outputs. Keep other uses on hold.
3. Classify the records. Decide the treatment of audio, transcript, draft, approved note and client recap separately. Record retention and preservation instructions.
4. Test the full route. Use invented content to inspect access, sharing, review, export and retrieval. Include a user who should not have access and a disabled staff account.
5. Check incident handling. Confirm the vendor contact route and rehearse the firm's response to an incorrectly shared test note.
6. Issue a written decision. Approve a bounded use or list what evidence is still missing. Give staff an exception contact and a trigger for review when the product or workflow changes.

Put the resulting instruction in the AI policy builder and use the AI tool risk checker to organize unresolved questions. The financial-adviser industry page covers the wider security context. Discovery can identify tools and access in an agreed scope; it does not make the firm's recordkeeping or regulatory decisions.

Sources

Opened November 3, 2026:

• SEC small-entity compliance guide to Regulation S-P: scope, safeguards, compliance records and tiered dates.
• SEC small-firm outreach event: January 22, 2026 event and the smaller-entity milestone.
• SEC May 16, 2024 adoption announcement: incident-response program.
• SEC staff bulletin on account recommendations: footnotes 25 and 27 on adviser recordkeeping. Staff guidance is not the rule text or a decision about your particular records.