New York Partner Scott Diamond recently authored an article for Business Law Today (an American Bar Association (ABA) publication) that addresses the questions of whether broker-dealers should have policies on employee AI usage and whether generative AI prompts, chatbot outputs, and related artifacts should be treated as broker-dealer records that must be preserved pursuant to Rule 17a-4 of the Securities Exchange Act (Exchange Act).
Mr. Diamond opens the article, titled, "AI Prompts and Responses: Records or Not, Here We Come," with a hypothetical in which a compliance officer at a broker-dealer fails to retain the prompts he sent to a chatbot or the chatbot's responses while using the chatbot to draft a supervisory procedure for his firm. The Financial Industry Regulatory Authority (FINRA) subsequently alleges that the firm failed to keep records and failed to supervise the compliance officer in violation of the Exchange Act.
Following the hypothetical, Mr. Diamond provides a brief history of the Securities and Exchange Commission's (SEC) Rules 17a-3 and 17a-4, explaining that broker dealers must preserve all "communications" relating to their "business as such." He notes that because the SEC "has yet to cleanly advise as to the meaning" of these two terms, "compliance officers and lawyers will need to make informed decisions about whether generative AI prompts and responses are communications and whether they relate to the broker-dealer's business as such."
Mr. Diamond then outlines arguments against treating AI prompts and responses as 17a-4 records, including that generative AI conversations are not communications because information is not flowing between two people. Instead, he explains, a person is issuing commands to a computer. In addition, he describes that many prompts and responses arguably do not relate to "business as such" because a broker-dealer's compliance policies do not concern the trading of securities. Mr. Diamond also sets forth arguments that support treating AI conversations as records, including that they "constitute communication because they are transmitted to and processed by infrastructure controlled by humans," that they have "been deemed communication" in FINRA's Advertising Regulation FAQs, and that "retention Is consistent with the purpose of Rule 17a-3 and 17a-4," namely, to ensure transparency in decision-making processes.
Observing that "under the current administration, it is unlikely that the SEC would bring high-dollar enforcement actions" against broker-dealers that fail to preserve generative AI conversations, Mr. Diamond nevertheless notes that "broker-dealers should carefully consider their tolerance for compliance risk in the event that an administration chooses an enforcement approach or if the firm is already in a precarious position." He further advises, "Firms with a low compliance risk tolerance should consider a policy restricting generative AI use to approved providers, where records of prompts and responses are retained and the activity is supervised." According to Mr. Diamond, if firms fail to provide access to useful generative AI or adopt policies prohibiting the use of AI altogether, their employees may use "off-channel AI," which exposes the firms to liability.
Mr. Diamond is an experienced securities, derivatives, and financial services attorney with more than 35 years of legal, regulatory, and transactional experience. He advises broker dealers, investment advisers, private funds, banks, family offices, fintech companies, issuers, and other financial institutions on complex transactional, regulatory, trading, compliance, and documentation matters.
Read the full Business Law Today article here.