October 10, 2026 · 11 min read · Trust & Compliance

AI Meeting Notes for Compliance Officers in Financial Services: Keeping Recordings Off the Cloud

Published October 10, 2026

Key takeaways

• FINRA's 2026 Oversight Report applies existing Rule 4511 and SEC Rule 17a-4 recordkeeping obligations to AI meeting notes — summarization is now the most-cited use case for generative AI at member firms.
• Amended Regulation S-P takes effect for smaller advisers on June 3, 2026, adding a written incident response program, 30-day customer breach notice, and a 72-hour service-provider notification requirement.
• Cloud notetakers like Otter, Fireflies, and Zoom AI Companion add a vendor to your Reg S-P perimeter; on-device transcription removes the vendor server from the data path entirely.
• The SEC's $400,000 Delphia and Global Predictions AI-washing settlements show that how a firm describes its AI tools is itself a Marketing Rule exposure.
• A defensible AI-notetaker program needs three things: a written policy under Rule 206(4)-7, a vendor file, and an archiving pathway from the notetaker to a WORM-compliant books-and-records system.

Quick answer: Compliance officers at SEC- and FINRA-regulated firms should evaluate AI meeting assistants against three questions: where is the audio processed, who else can access it, and can the resulting notes be produced for a 17a-4 exam? On-device transcription keeps the raw recording off any vendor server, shrinking the Reg S-P vendor surface and the subpoena/exam exposure that cloud notetakers create.

If an AI assistant sits in on client meetings at your firm, FINRA's 2026 Annual Regulatory Oversight Report is about you — and the most useful thing about its new section on generative AI is how little it actually changes.

For the first time, FINRA's 2026 Annual Regulatory Oversight Report addresses generative AI directly. It does not create a new AI rule. It applies the existing supervision and recordkeeping rules to AI tools and identifies summarization — the exact job an AI notetaker does on a client call — as the most common use case at member firms. For compliance officers, that means the capture and retention of AI-generated meeting notes is now a top examiner priority, measured against rules that were written long before generative AI existed.

Layered on top of that: amended Regulation S-P reached every SEC-registered adviser on June 3, 2026, bringing a written incident response program, a 30-day customer breach-notification clock, and a vendor-oversight regime with a 72-hour service-provider notification expectation. Every cloud AI notetaker your advisors use is now a service provider inside that perimeter.

This piece is a compliance-officer's framework for evaluating AI meeting assistants: what the rules actually say, where cloud notetakers create examination surface, and how an on-device architecture changes the vendor-oversight question. We do not claim any product is "compliant" — that determination belongs to your CCO and GC. We do describe where the audio physically lives, because that fact drives nearly every answer that follows.

What the rules actually say about AI-generated meeting records

The starting point is unglamorous and old. FINRA Rule 4511 requires firms to make and preserve books and records in a format and media that complies with Exchange Act Rule 17a-4. SEC Rule 17a-4(b)(4) requires preservation of "originals of all communications received and copies of all communications sent (and any approvals thereof) ... including inter-office memoranda" relating to the firm's business. For investment advisers, Rule 204-2 does the equivalent work.

The threshold question for an AI notetaker output is whether the summary of a client meeting counts as a "communication" or "internal memorandum" relating to firm business. In its analysis of how recordkeeping rules apply to AI, Skadden treats the question as fact-specific: an AI-generated record is more likely to be a required communication if it was "subsequently transmitted via email, chat, etc." The American Bar Association's Business Law Today frames the same tension for broker-dealers, noting that generative AI prompts and responses may function as internal memoranda even when they look like software commands, and that the SEC and FINRA have not squarely resolved the issue.

The safer operating assumption at most firms: if an AI notetaker summarizes a conversation about firm business, treat the output as a record. That is also how a recent compliance-architecture read of FINRA 4511 and SEC 17a-4 describes the operational posture — electronic records require either "a complete time-stamped audit trail" or "non-rewriteable, non-erasable" storage, for not less than three years with the first two years in an easily accessible place.

Where this lands your CCO

Three practical rules follow:

• An AI meeting note about firm business is presumptively a record.
• The record has to survive in WORM-equivalent form, retrievable on demand.
• The firm has to be able to explain, during an exam, how the record was created, reviewed, and preserved.

FINRA's 2026 Oversight Report: no new rule, no safe harbor either

The 2026 report does not add an AI-specific rule. According to ArchiveIntel's read of the FINRA report, the regulator treats generative AI the way it has treated every prior technology: the rules do not move, the examiner's vocabulary does. The report names the tools, describes how firms use them, and sets out the governance it expects to find in writing.

The quiet pressure point is capture. Email, text, chat, and social media are archived as a matter of routine at a regulated firm. The note an AI meeting assistant writes about the same client conversation arrives by a different route — it may live only in a vendor dashboard, in Google Drive, or in a Slack message pasted by the advisor. If that record is called for at exam time, the firm has to produce it, in a readable format, with a chain of custody.

Global Relay's compliance team frames the issue bluntly: a 30-minute client meeting can now create six or more separate information artifacts — audio, transcript, summary, action items, chat side-channel, calendar entry — and policies written for "call recordings" often say nothing about the AI-generated derivatives. That silence is the gap examiners look for.

Regulation S-P's June 2026 deadline moved the vendor question front and center

The second shift that makes AI notetakers a 2026 compliance issue is Regulation S-P. The Carlton Fields analysis explains the structure: the SEC's 2024 amendments to Reg S-P expand safeguarding and privacy requirements for broker-dealers, investment advisers, and transfer agents, with the smaller-firm compliance date landing on June 3, 2026. The written incident response program, the 30-day customer notification, and the service-provider oversight obligations now apply to every SEC-registered adviser.

The vendor-oversight piece is where AI notetakers get interesting. SWK Technologies summarizes the operational requirement: covered institutions must implement written policies reasonably designed to require oversight of service providers through initial due diligence and ongoing monitoring, with a 72-hour notification clock when a vendor becomes aware of unauthorized access. AdvisorLaw describes the 72-hour trigger as one of the most significant hurdles in the amended rule.

Every cloud AI notetaker in your firm sits inside that perimeter. If raw audio or a transcript leaves an advisor's device and lands on a vendor's server, that vendor "receives, maintains, or can access" nonpublic customer information for Reg S-P purposes. That triggers vendor due diligence, contract language, a sub-processor review, and a 72-hour notification clause.

The on-device shortcut (described, not claimed)

If the audio is transcribed on the advisor's own iPhone or Mac and never transmits to a vendor server, that vendor is not holding the customer's audio. The vendor is still a vendor — the app is on your advisors' devices — but the data-access surface is materially different. Your CCO still has to determine whether that difference satisfies Reg S-P in your program. We are describing architecture, not making a compliance determination.

Cloud notetakers vs. on-device: the data-path comparison

The honest way to compare AI meeting assistants for a regulated firm is to ask where the audio and transcript physically live between the moment the meeting ends and the moment the record is archived. The vendor sales deck is not the answer; the privacy policy is.

Dimension	Cloud AI notetakers (Otter, Fireflies, Zoom AI Companion)	On-device AI (Basil AI)
Where audio is processed	Vendor's cloud servers; third-party ASR sub-processors may be involved	On the advisor's iPhone or Mac (Apple Speech Recognition, Neural Engine)
Where transcript is stored	Vendor-controlled cloud account	Device local storage; optional sync to the firm's own iCloud / Notes
Reg S-P service-provider status	Vendor receives and stores customer information — full vendor oversight workflow	Vendor does not receive the customer audio or transcript — scope is materially narrower
Model-training use of content	Review each vendor's current Otter.ai policy, Fireflies policy, and Zoom policy	No vendor server receives the content, so there is nothing for a vendor to train on
Subpoena / exam surface	Vendor can be served; firm may learn second-hand	Only the firm holds the record; third-party production avenue removed
Offline operation	Requires network connectivity	Works with no network connection
Archive path to 17a-4 WORM store	Vendor-to-archive integration (where offered)	Advisor exports to firm-controlled archive via existing M365/Exchange pipeline

None of this makes cloud notetakers "non-compliant" or on-device tools "compliant." Those determinations belong to your firm. It does, however, change the shape of the vendor file your CCO has to maintain under Reg S-P and the exam story about where client information lives.

AI-washing: a compliance-officer risk, not just a product-marketing one

Firms often assume AI-washing is a product-marketing problem. It is also a compliance-officer problem, because how your firm describes an AI tool in a Form ADV, a client email, or a vendor-vetting memo is itself a Marketing Rule exposure. On March 18, 2024, the SEC settled charges against two investment advisers — Delphia (USA) Inc. and Global Predictions Inc. — for making false and misleading statements about their use of AI. WilmerHale's write-up notes that Delphia and Global Predictions paid civil penalties of $225,000 and $175,000 respectively.

As Crowell & Moring summarizes the SEC's position, the enforcement director's message was that representations about AI use cannot be "materially false or misleading." The through-line to meeting-notes vendors is simple: if the firm tells clients or regulators that its AI notetaker is "private" or "stays on-device," that statement needs to match the vendor's actual data flow. If the vendor's privacy policy contemplates cloud storage, sub-processor access, or training use, the compliance officer who signed off on the "private" claim has an exposure.

The compliance officer's AI-notetaker vendor questionnaire

Here is a copy-pasteable short-form questionnaire your procurement team can send to any AI notetaker vendor. The point is to get written answers, dated, from the vendor — not to score the tool on a sales call.

1. Where is the audio processed (country, data center, on-device)?
2. Where is the transcript and summary stored, and under whose control?
3. What is the default retention period, and can we set it to zero on the vendor side?
4. Is customer content used, in any form, to train your models or any sub-processor's models?
5. List every sub-processor that can access the audio, transcript, or metadata.
6. Do you commit, in writing, to notify us within 72 hours of becoming aware of unauthorized access, consistent with amended Regulation S-P?
7. Will you execute a vendor DPA with breach-notification, confidentiality, and audit-rights clauses?
8. Can we export records in a format compatible with our 17a-4 WORM archive, with a time-stamped audit trail?
9. What SOC 2 Type II report can you share, and when was the last audit?
10. Can your tool operate without transmitting any customer content off the user's device?

Question 10 is the one most vendors cannot answer with a yes. It is the question an on-device architecture is designed to answer with a yes.

Where this intersects with asset-management and legal-practice obligations

Compliance officers at multi-service firms rarely own only one rulebook. The same AI notetaker that creates a Rule 17a-4 question for the broker-dealer side creates an MNPI question on the asset-management side and a privilege question on the legal side. We have covered those adjacent angles in depth:

• Data privacy and AI meeting notes for asset managers (MNPI and Reg S-P) — same vendor-surface analysis, applied to material non-public information.
• What "compliant AI meeting notes" actually means — a deeper definitional read of the term the vendor marketing has stretched to breaking point.
• The Heppner v. Warner privilege split — what the court said about privilege when a third-party notetaker is in the room.

How Basil AI solves this: architecture, not a compliance claim

Basil AI is a privacy-first meeting notetaker for iPhone and Mac. The product's defining architectural choice is that audio capture and transcription run on the device, using Apple's Speech framework and the on-device Neural Engine. Apple's own description of the privacy posture of its on-device AI is on the Apple privacy page.

What that means for a compliance officer at a regulated firm:

• No vendor server holds the raw audio. The data path from microphone to transcript to summary does not traverse a Basil-controlled cloud. The notetaker vendor is not a Reg S-P service provider for the customer audio because it does not receive the customer audio.
• The firm retains sole custody of the record. The transcript and summary live on the advisor's device and can be routed into the firm's existing M365 / Exchange / archive pipeline — the same pipeline that already satisfies the firm's 17a-4 / 4511 obligations for email and Teams.
• No model-training on client content. There is no server-side pipeline into which customer audio could flow for training purposes, by any party.
• Works offline. On a plane, in a client's SCIF, or on a bad hotel Wi-Fi, capture does not depend on a vendor's cloud being up.
• No AI-washing surface. "Processed on the device" is an architectural fact a technical reviewer can verify, not a marketing claim.

None of this is Basil claiming to be "SEC-compliant" or "FINRA-compliant." Compliance is a firm-level determination made by your CCO against your written policies under Rule 206(4)-7. What Basil offers is a cleaner starting point for that determination: a vendor relationship in which the vendor does not hold the customer's words.

A practical rollout plan for a CCO evaluating AI notetakers

1. Inventory current use. Ask every advisor which AI notetaker (if any) they have used in the last 90 days. Shadow IT is the most common Reg S-P gap.
2. Map data flows. For each tool, document: where audio goes, where transcript goes, who the sub-processors are, what the retention default is.
3. Score against the vendor questionnaire above. Reject anything without a 72-hour notification commitment or a sub-processor list.
4. Pick an architecture. If the firm's risk appetite tolerates cloud notetakers, pick one, DPA it, and route its output into the archive. If not, deploy an on-device tool and route exports into the same archive.
5. Write it down. Update the Rule 206(4)-7 policy to describe which AI meeting tools are approved, how notes are reviewed, and where the records live. Train advisors. Document the training.
6. Test the exam story. Before an SEC or FINRA examiner asks, run an internal mock request: produce every AI-generated meeting note for a named client over the last 12 months, with chain of custody. If you can't, the gap is operational, not legal.

Bottom line

FINRA's 2026 report did not create a new AI rule. It applied the old ones — Rule 4511, SEC Rule 17a-4, Advisers Act Rule 204-2 — to a technology that quietly made its way into every client meeting. Reg S-P then dropped the vendor-oversight shoe on June 3, 2026. The two together mean a compliance officer at an SEC- or FINRA-regulated firm cannot treat the AI notetaker as a nice-to-have productivity app. It is a service provider inside the perimeter, generating business records on every call.

The architectural question — where does the audio physically live? — is the question that most changes the shape of your Reg S-P vendor file and your 17a-4 exam story. On-device processing is not a compliance guarantee. It is a different starting point, and for many firms it is a materially simpler one.

Try Basil AI — on-device meeting notes for regulated workflows

Capture meetings on your iPhone or Mac. The audio and transcript stay on your device. No vendor cloud, no model training on your clients' words.