Banks blocked ChatGPT over leaks; recordkeeping set the longer limit

The week

In late February 2023, one of the most talked-about pieces of software in the world ran into one of the most cautious industries in the world. Around February 22, news reports said JPMorgan Chase had restricted employees from using ChatGPT. The reports described the move as part of normal controls on third-party software rather than a response to any incident.

ChatGPT is a chatbot built on what is called a large language model. That is software trained on enormous amounts of text so that it can predict, word by word, a plausible response to whatever you type. Ask it to draft an email, summarize a report or explain a contract clause, and it produces fluent, often useful text in seconds. Unlike a search engine, which finds existing pages, it writes new text, and it sometimes makes things up with total confidence.

OpenAI had released ChatGPT less than three months earlier, on November 30, 2022, and its consumer user base had grown faster than almost any application before it. An analysis by UBS, based on web traffic data, estimated that it had reached about 100 million monthly users by January. Employees across industries were already pasting text into it to draft emails, summarize documents and write code. Many did so on their own initiative, without asking anyone, because it was free, easy and genuinely helpful.

The weeks before had raised the temperature further. On February 1, OpenAI launched a paid consumer tier, ChatGPT Plus. In the first week of February, Microsoft unveiled a version of its Bing search engine built on OpenAI’s technology, and Google announced its own chatbot, Bard. Generative AI had moved from a research curiosity to a race among the largest technology companies, and staff in every industry were reading about it daily.

The banks restricting it were not new to AI. Large banks had used machine learning for years in fraud detection, anti-money-laundering monitoring and credit scoring, under formal model governance. What was new was a general-purpose tool that any employee could open in a browser, entirely outside those processes.

Some large employers outside finance had already acted. In January, reports said Amazon had warned staff not to share confidential information with the chatbot. The concern there, as at the banks, was that text typed into a consumer service left the company’s control.

Within days of the JPMorgan reports, further reports said several other large banks had also limited staff access. Bloomberg named Bank of America, Citigroup, Deutsche Bank, Goldman Sachs and Wells Fargo among the lenders that had restricted it. Banks were among the first large employers to restrict it publicly. Most said they were evaluating how the technology could be used safely.

The terms of use mattered to that evaluation. At the time, conversations in the consumer product could be used to train OpenAI’s models unless a user opted out, and the bank had no contract with the provider at all. A separate route already existed. Microsoft had made its Azure OpenAI Service generally available in January 2023, offering the same family of models under enterprise cloud terms. That option shaped how quickly the first problem could be solved.

The restrictions also landed in a particular regulatory moment. Five months earlier, in September 2022, the SEC and the CFTC had fined a group of large broker-dealers heavily for letting staff conduct business over personal messaging apps. Compliance officers had just spent a costly autumn on records that slipped outside the firm’s archive.

To an outsider, it looked like a familiar story: conservative institutions recoiling from something new. The reality was more interesting. Banks operate under rules about information, records and decisions that most industries do not face, and a free consumer chatbot collided with all of them at once. The restriction was less a rejection of the technology than a pause while firms worked out which of those rules applied, and who inside the bank was responsible for each.

Take a junior banker on a Thursday evening in early 2023. A client has sent a long, rambling email with six questions buried in it. The banker copies the whole thing, pastes it into ChatGPT, and asks for a polite, organized reply. Thirty seconds later, a clean draft appears. The banker tweaks two lines and sends it. It is fast, it is helpful, and it has just raised three separate problems for the bank, none of which the banker has thought about.

The restrictions that followed were widely read as banks being cautious about a new technology. They were cautious, but for reasons specific to regulated financial firms. Those reasons fall into three categories, each with a different owner and a different path to resolution. They are data leaving the firm, records the firm must keep, and decisions the firm must be able to explain. A blanket block was a reasonable holding position for all three. Only the first could be solved quickly.

What follows starts with the features of the technology that matter to a bank. It then takes the three categories in turn, each with its owner, its mechanics and its differences across types of firm. The last sections cover what the categories put at stake, how they set the order of adoption, and what a well-run program looked like.

Fluent, variable and sometimes wrong

Generative AI is the broad term for software that creates new content, such as text, images or code, rather than sorting or retrieving existing material. The version that matters here is the large language model. These models are trained by showing them vast quantities of written text and having them learn, statistically, which words tend to follow which. The result is a system that can produce remarkably human-sounding writing on almost any topic.

Three features of these systems matter for a bank. First, they work on whatever you give them. To summarize a document, you must hand over the document. Second, their answers vary. Ask the same question twice and you may get two different responses. Third, they do not know when they are wrong. They can produce a confident, well-written paragraph that contains an invented fact, a problem often called hallucination.

Such a system behaves like a gifted new intern with a photographic memory of everything they have ever read. The intern has no access to your files unless you hand them over. The intern also tends to fill gaps with plausible guesses rather than saying “I don’t know.” You would give such an intern plenty of work. You would also check that work before it went to a client, and you would think carefully about which documents you handed over and where they ended up.

One model, three ways to reach it

In early 2023, the version most employees used was the free consumer product, accessed through a web browser on the open internet. It came under the same terms that applied to any member of the public. That is the starting point for the three categories.

The same underlying technology could be reached in two other ways. Developers could call the models through a programming interface, an API, under business terms that differed from the consumer product. Enterprises could also use the models through a major cloud provider, inside their existing cloud agreements and security controls. The model was broadly the same in each case. The contract, the data handling and the logging were entirely different.

That distinction explains much of what followed. A ban on the consumer website said nothing about whether the technology itself was acceptable. It said that this particular channel, under these particular terms, did not meet the bank’s obligations. Most of the work of 2023 consisted of building channels that did.

The three problems in the banker’s evening

The junior banker’s thirty seconds map neatly onto the three categories. Pasting the client’s email sent confidential information to an outside company with no contract. Using the draft created a business communication whose working papers sat outside the archive. And if the reply had included a recommendation, the firm would need to show a reasonable basis for advice partly written by software. Each problem has a different owner inside the bank.

Category one: data leaving the firm

The most discussed concern was confidentiality. An employee who pastes a client email, a draft deal memo or proprietary code into a public chatbot hands that information to a third party under consumer terms. At the time, consumer ChatGPT conversations could be used to improve OpenAI’s models unless a user opted out. The bank had no contract covering retention, access or deletion.

For a bank, that is a serious matter. Client information is protected by confidentiality duties and privacy law. Deal information may be material nonpublic information, the kind whose misuse leads to insider trading cases. Proprietary code is the firm’s own intellectual property. Handing any of it to an outside company without a contract leaves the bank relying on hope.

Which duties apply to whom

The specific duties vary by charter and business. Banks protect customer information under the interagency security guidelines issued under the Gramm-Leach-Bliley Act. Federally insured credit unions follow the parallel NCUA rule. Broker-dealers and investment advisers are covered by the SEC’s Regulation S-P. Investment banks and trading firms also maintain information barriers, which keep deal information away from staff who trade or advise on the affected securities.

Those differences shape what “sensitive” means in a filter. A credit union mostly worries about member account and identity data. A broker-dealer with an investment banking arm also worries about deal code names and the names of companies on its restricted list. A wealth manager worries about client portfolios and estate details. One block rule fits none of them perfectly.

Three routes to a fix

This category had the clearest fix, and it belonged to the chief information security officer and procurement. There were three routes:

• Enterprise agreements. These could commit the provider to no training on customer data, defined retention and security controls: a proper business contract rather than consumer terms of service.
• Data loss prevention. Data loss prevention tools and secure web gateways could detect sensitive content headed to unapproved sites and block it. These are filters that inspect what leaves the firm’s network.
• Private deployments. Private deployments through a cloud provider could keep prompts inside the firm’s own tenancy, meaning a walled-off section of the cloud reserved for that firm alone.

The mechanics of a block were familiar to any security team. Web gateways assign websites to categories, and a new “generative AI” category could be denied or limited to approved users. Data loss prevention rules could match account number formats, client names or deal code names in text pasted into a browser. The hard part was precision. Rules tight enough to stop leaks also stopped harmless uses, and staff noticed.

Large banks pursued all three routes within months. The restriction also had a cost: blocking a useful tool on managed devices pushes some activity to personal phones, which is worse on every dimension. The bank loses visibility, the data still leaves, and there is no record at all. Pairing the block with an approved alternative was what made it hold. People who need to get work done will find a way; the question is whether that way is one the firm can see.

The vendor became a critical vendor

Vendor risk teams had their own share of this category. A generative AI provider was a new kind of critical vendor. It processed whatever employees typed, it relied on cloud subprocessors, and its terms changed often. Standard due diligence questionnaires did not ask about training use of customer data, model versioning or how long abuse-monitoring logs were kept. Adding the questions was quick. Getting contractual answers from providers still writing their enterprise terms was not.

The questions went further than data use. Banks wanted to know where prompts were processed geographically, who at the provider could read them, and how the provider would notify the bank of an incident. They also wanted to know whether a model could be changed underneath them without notice. Each answer affected the other two categories, because a model that changes silently is hard to validate and hard to supervise.

Smaller institutions faced a different version of the problem. A community bank or credit union rarely negotiates directly with a model provider. It buys AI features embedded in its core banking platform, its customer service software or its office suite. Its due diligence runs through those vendors, and its bargaining power over terms is limited. For these firms, the practical control is to ask the vendor in writing how AI features handle data, and to switch features off until the answers arrive.

Category two: records the firm must keep

The second category was less discussed and harder. Financial firms must keep records of their business in ways most companies never think about. Broker-dealers must preserve business communications under SEC Rule 17a-4 and supervise them under FINRA rules. Registered investment advisers have their own recordkeeping duties under the Advisers Act. Banks retain many record types for regulatory and legal reasons.

The idea behind these rules is simple. If a client later claims they were misled, or a regulator investigates a trade, the firm must be able to produce what was said, by whom and when. Supervision means someone at the firm is actually reviewing those communications for problems, as well as storing them.

Different rules for different charters

The rules are not uniform, and the differences matter for AI. Broker-dealers face the most specific regime: Rule 17a-4 sets how communications must be preserved, and FINRA Rule 3110 requires a supervisory system to review them. FINRA Rule 2210 adds content standards for communications with the public. Retail communications, broadly those sent to more than 25 retail investors within 30 days, generally need a principal’s approval before use.

Investment advisers keep written communications relating to their advice under the Advisers Act books-and-records rule. Swap dealers and futures firms keep records under CFTC rules. Banks without a broker-dealer arm have no single rule like 17a-4 for all communications. Their retention duties come from many sources, including anti-money-laundering recordkeeping, lending rules, litigation holds and their own records schedules. Credit unions have an NCUA rule requiring a records preservation program.

The storage rules themselves were in motion. In October 2022 the SEC amended Rule 17a-4 so that broker-dealers could keep electronic records either in the traditional write-once format or in a system with a complete, time-stamped audit trail of changes. Compliance with the amendments was due in May 2023. Archive vendors and compliance teams were already reworking their storage that spring, which made it a natural moment to decide where AI interactions would land.

The practical result is that the same AI drafting tool can be a heavily regulated communications channel in a firm’s brokerage unit and a matter of internal records policy in its retail bank. Large diversified firms had to design for the strictest regime that applied anywhere in the group, or segment the tool by business line.

The messaging cases set the tone

Regulators had just shown how seriously they took this. In September 2022 the SEC charged 16 broker-dealers and advisers over employees’ use of personal messaging apps for business, with combined SEC penalties of more than $1.1 billion. The CFTC brought parallel cases. Those cases were about channels outside the firm’s archive. An unapproved chatbot was another such channel. Any compliance officer who had lived through the messaging cases would have looked at ChatGPT and seen a familiar risk.

Generative AI posed questions the rules were not written for. If a banker uses a chatbot to draft a client email, is the prompt a business record? Is the discarded draft? If an analyst relies on a model’s summary of research, what must be retained to reconstruct the basis for a recommendation? In early 2023 no firm could answer these with confidence. An unapproved tool, used outside the archiving stack, could create records the firm had no way to capture.

Return to the junior banker. The final email went through the bank’s email system and was archived. But the client’s original text, pasted into the chatbot, and the chatbot’s draft both sat outside the firm’s systems. If a dispute arose about what the banker meant or why a point was phrased a certain way, part of the trail would be missing.

What capturing an AI interaction involves

Resolving this category belonged to compliance and records management rather than security. It required decisions about which AI uses produce communications, integration of prompt and output logs into retained, searchable and supervised systems, and lexicon or sampling reviews adapted to AI-drafted text. Lexicon reviews scan messages for flagged words and phrases; sampling reviews have a person read a random selection. Both had been designed for human writing. It also required training front-office staff on where AI-drafted client communication sits in the supervisory process. Each of those took longer than signing an enterprise contract.

A usable capture record holds more than the text. It names the user, the time, the tool and the model version. It holds the prompt, any documents the tool retrieved to answer it, and the output. It shows whether the output was sent, edited or discarded. Without the model version and retrieved documents, the firm can store an interaction but cannot reconstruct why the output said what it did.

Capture brings its own trade-off. A complete log of every prompt is itself a large store of confidential information, which returns the firm to category one. It is also discoverable in litigation. Firms therefore had to decide case by case, keeping everything for client-facing uses and short-lived logs for internal drafting where no regulatory duty applied. Those decisions needed counsel’s input and a written rationale.

A workable test for each proposed use is whether the output could reach a customer, a counterparty or a regulator. If it could, the prompt and the output belong in the archive, on the same retention schedule as the final communication.

Category three: decisions the firm must explain

The third category concerned outputs used in decisions. Banks operate under supervisory model risk guidance, SR 11-7 at the Federal Reserve and its OCC counterpart. In banking, a model is any quantitative method that turns data into an estimate used for a decision, such as a credit score or a pricing formula. The guidance expects models used in decisions to be inventoried, validated and monitored: listed, tested and watched.

Other rules point the same way. Lenders must give specific reasons for adverse credit actions under the Equal Credit Opportunity Act and Regulation B. If a bank turns down a loan, it must be able to tell the applicant why. Advisers owe clients a fiduciary duty that includes a reasonable basis for advice. Broker-dealers recommending securities to retail customers owe a duty of care under Regulation Best Interest.

The consumer finance regulator had already spoken to the credit point. In May 2022 the CFPB issued a circular stating that creditors using complex algorithms must still provide specific and accurate reasons for adverse actions. The complexity of a model, it said, is no defense. A lender considering a language model anywhere near a credit decision started from that position.

A general-purpose chatbot fits awkwardly into that framework. Its outputs vary from one run to the next. Its training data is unknown to the user. Its errors can be fluent and confident. That does not bar use in decision support. It does mean the model risk function has to decide which uses count as models, what testing is proportionate, and where a human must review before an output affects a customer.

Validating a model nobody at the bank built

SR 11-7 already covered vendor models. It expects banks to obtain what developmental evidence they can from the vendor, and to compensate with their own testing where the vendor’s methods are proprietary. Language models stretched that approach. The vendor would not disclose training data in detail, and conceptual soundness, the first pillar of validation, was hard to assess from outside.

Validation teams therefore leaned on the other pillars. They built test sets drawn from the bank’s own documents and cases, with known correct answers, and measured how often the tool got them right. They checked behavior on edge cases and on attempts to make the tool ignore its instructions. They set monitoring thresholds and required that the model version be fixed, so that a vendor update triggered a review instead of slipping through.

Human review is part of the control, but only if it is designed in. A rule that says “a person reviews the output” means little if the person has neither time nor the source documents. Good designs specify what the reviewer checks, record that the check happened, and sample reviewed outputs later to see whether reviewers caught the errors that were there.

When the chatbot talks to customers

A customer-facing chatbot adds a further set of duties. Its answers about fees, rates or account terms must be accurate, because a misleading answer can be an unfair or deceptive practice whatever produced it. It must also recognize when a customer is raising a legal right. A message saying a charge is wrong may be a billing error notice or an electronic fund transfer dispute, and those trigger investigation deadlines under Regulations Z and E.

The CFPB made the same points in a June 2023 report on chatbots in consumer finance. It warned that poorly designed bots could fail to recognize disputes, give inaccurate information and trap customers in loops without a route to a person. For a bank, the controls are concrete: tested intent recognition for dispute language, a clear handoff to staff, logging of every conversation, and periodic review of transcripts by compliance.

Credit unions and community banks often meet this issue through vendors, since chat features arrive inside digital banking platforms. The duty stays with the institution. Contracts should give it access to transcripts and a say over how the bot handles disputes and complaints.

Tiering by impact

Drafting an internal memo and screening a credit application sit at opposite ends of that range. Treating them the same, in either direction, is the usual error. Apply credit-model rigor to a memo-drafting tool and nothing gets approved. Apply memo-drafting casualness to a credit tool and the firm cannot explain its own decisions.

Fair lending adds a testing duty of its own. The law reaches outcomes as well as intent, and a tool that treats protected groups differently, even through proxies such as geography, can create disparate-impact risk. Language models trained on general internet text can carry associations the bank never chose. Any use near credit, collections or account decisions therefore needs testing for differences in outcomes across groups, documented in the same file as the validation.

Size changes the shape of this work. A large bank has a model risk management function with validators, an inventory system and committee governance. A community bank or credit union usually has a much smaller program, often relying on vendors and outside validators. Supervisors have long said that model risk practices should be proportionate to a bank’s size and the complexity of its model use. For a small institution, a short list of approved uses, with no AI in credit or account decisions until a validation is done, is a reasonable starting point.

There is a second-order effect as well. Staff who rely on AI summaries may stop reading source documents, which weakens the human review the framework assumes. Review procedures should check that reviewers engaged with the underlying material as well as the summary.

Enforcement bills, client trust and staff goodwill

These are more than a compliance team’s headache: each category connects directly to things a chief executive or board already cares about.

Money. The messaging cases showed that recordkeeping failures can be very expensive. The real cost of an AI tool that creates unrecorded business communications is the potential enforcement bill rather than the license fee.

The cost is also operational. Enforcement settlements in the messaging cases required firms to retain compliance consultants and review their policies, training and surveillance. Those undertakings consume management time for years. A firm that adopts AI drafting without capture risks inviting the same kind of remediation program.

Clients. Clients share sensitive information with a bank because they trust it to keep that information close. Learning that their details were pasted into a public chatbot would damage that trust far more than any productivity gain could repair.

Institutional clients make this concrete. Corporate and asset-management clients send their banks and brokers detailed security questionnaires, and how a firm uses generative AI with client data is a natural question for them to add. A firm without a clear answer risks slower onboarding or lost mandates, independent of any regulator.

Staff. Employees reached for ChatGPT because it helped them. A firm that simply says no, with no alternative and no explanation, signals that it does not understand their work. A firm that offers a safe, approved tool keeps both the productivity and the goodwill.

Talent is part of this. Engineers, analysts and young bankers can see what peers at less regulated firms are using. A long, unexplained ban reads as a sign that the firm will be slow on technology generally. A published timeline for approved tools, even a cautious one, tells staff the restriction is a plan rather than a verdict.

Regulators and reputation. Examiners ask how firms supervise new channels and validate the tools behind their decisions. Having clear answers, written down in advance, is far better than improvising them during an examination.

How the categories shaped adoption

The three categories also explain the sequencing banks followed. Internal knowledge search, coding assistance and document summarization came first, because they raised the confidentiality question but little of the other two. Client-facing and decision-facing uses came later and more slowly, because they touched all three.

Suppose a regional bank has five proposed uses on the table. They are an internal policy search tool, a coding assistant for developers, a summarizer for long research reports, a drafting aid for client emails, and a tool to help underwriters review loan files. Under an enterprise contract, the first three need mainly security sign-off. The client email aid needs compliance to settle archiving and supervision. The underwriting tool needs model risk validation and a clear answer on adverse action reasons. Lined up this way, the bank can see why its rollout moves at three different speeds, and which team is the bottleneck for each.

A firm that tracks its AI use cases against these categories can see which control owner is the bottleneck for each one. That turns a vague debate about whether the bank is “for” or “against” AI into a practical work plan with names attached.

Wealth managers sat in the middle

Wealth management showed how one use can sit on the boundary. A tool that answers an adviser’s questions from the firm’s own research library looks internal. Once the adviser uses the answer in a client conversation, it becomes part of advice. Firms that deployed such tools to advisers had to decide how the tool’s answers were recorded and how supervisors could see what the adviser had been told.

Meeting-note tools raised the same issue from the other side. A tool that summarizes a client meeting creates a document that may become the firm’s record of what was discussed. If the summary is wrong, the record is wrong. Firms needed rules on who reviews such summaries and how corrections are made before the summary enters the client file.

The case for moving faster

The strongest objection to this framework is that it made banks slow. Staff were already using the tools, and every month of restriction meant lost productivity and learning. Some argued that firms should have approved broad use quickly and fixed governance afterward.

That argument has force for category one, where enterprise terms and filtering were available within months and firms that dragged their feet gained little. It is weaker for the other two. Recordkeeping failures had just produced penalties totaling more than a billion dollars, and an unexplainable credit decision is a fair-lending problem from the day it is made. The framework does not require slowness. It requires that each use move at the speed of its slowest owner, and that owners work in parallel rather than in sequence.

A second objection holds that recordkeeping rules do not reach prompts at all, because a prompt is a note to oneself rather than a communication. Some uses fit that description. But firms cannot rely on the argument without deciding it, use by use, and writing the decision down. Regulators assess communications by their content and purpose, not by the tool that produced them.

The firms that sorted it well

A firm handling this well has a short, clear policy that names approved tools and explains why others are blocked. It pairs every block with an alternative so use does not move to personal phones, where the firm can see and record nothing. It has an enterprise agreement or private deployment that keeps data out of model training, without declaring victory once confidentiality is solved. Its compliance team has decided which AI uses create business records and has connected those tools to the archive. It captures prompts and drafts as well as the final product, because a regulator asking how a client communication was produced may care about both.

Its model risk team has a simple tiering scheme, so a memo tool and a credit tool get proportionate scrutiny. Its review procedures check that people read more than the AI summary, since a reviewer who reads only the summary is not providing the oversight the rules assume. And it keeps a register of AI use cases, each mapped to the three categories and their owners.

What the register holds

The register is the working document of the whole program. For each use case it records the business owner, the tool and model version, and the data it touches. It notes whether the output can reach a client, counterparty or regulator. It names the security, compliance and model risk decisions, with dates and any conditions. It also lists the evidence an examiner would ask for: the contract, the capture configuration, the validation report and the monitoring results.

Kept current, the register answers most examination questions directly. It also shows management where the backlog is, which is the most useful single view for deciding where to add staff.

Sorting the backlog by tool, archive, explanation and owner

1. Which generative AI tools are approved for use here, under what contract terms, and is our data excluded from model training?
2. When we block a tool, what approved alternative do we offer?
3. Which AI uses could produce something that reaches a client, counterparty or regulator, and are those prompts and outputs being archived?
4. For any AI that supports a decision about a customer, can we explain that decision in the terms the law requires?
5. Do we have a single register of AI use cases, showing for each one which owner, security, compliance or model risk, is holding it up?

The answers work best as a standing report to the risk committee, refreshed each quarter. The useful measures are simple: how many use cases are approved, how many are waiting, and which owner each waiting case sits with. A backlog that piles up with one owner is a staffing decision for management, not a reason to bypass that owner.

The bank restrictions of February 2023 were not a verdict on generative AI. They were a sensible pause while firms sorted three different problems into three different inboxes. One inbox emptied quickly. The other two took far longer, and the firms that understood the difference planned accordingly.

With hindsight

The block did not last long. Within about a year many large banks had rolled out internal assistants on enterprise agreements or private deployments, starting with knowledge search, summarization and coding help. Confidentiality was largely solved by contract and architecture. The fastest category to solve was, as expected, the one that belonged to security and procurement.

The confidentiality worry was soon borne out elsewhere. In spring 2023, reports said Samsung engineers had pasted internal source code into ChatGPT, and the company restricted the tool. In March 2023 a bug in ChatGPT briefly exposed some users’ conversation titles and some subscribers’ payment details, and Italy’s data protection authority temporarily blocked the service. OpenAI added a setting to turn off chat history in April 2023 and launched ChatGPT Enterprise that August, with a commitment not to train on business data.

Adoption in finance then followed the order the three categories predicted. Morgan Stanley’s wealth business gave financial advisers a GPT-4-based assistant over its own research library in September 2023, an internal knowledge use. JPMorgan reported in 2024 that it had rolled out an internal assistant, LLM Suite, to large parts of its workforce. Uses that touched clients directly or fed credit decisions moved more slowly.

Third-party oversight was formalized around the same time. In June 2023 the Federal Reserve, FDIC and OCC issued joint guidance on managing risks from third-party relationships, which replaced their separate earlier documents. It did not mention generative AI by name, but it set the expectations that AI providers would be held to.

Recordkeeping and model governance took longer. FINRA’s Regulatory Notice 24-09, in June 2024, reminded member firms that existing rules, including supervision and recordkeeping, apply to generative AI. The message was not that new rules were coming, but that the old ones already covered the new tools.

Off-channel enforcement continued: in August 2024 the SEC charged 26 more firms, with combined penalties of about $393 million. Those cases concerned messaging apps rather than AI, but they kept the cost of unrecorded business communication firmly in view for every compliance officer weighing a new tool.

No dedicated AI recordkeeping rule appeared. Firms built their own answers, logging prompts and outputs into retained systems and extending model risk frameworks to language models. That meant each firm had to make its own judgments about what counted as a record and what counted as a model, and to be ready to defend those judgments to examiners.

The one broad SEC proposal aimed at the technology did not survive. In July 2023 the SEC proposed rules on conflicts of interest from predictive data analytics used by broker-dealers and advisers. Industry objected that the definition reached almost any software, and the SEC withdrew the proposal in June 2025. On credit, the CFPB added a second circular in September 2023 saying lenders using complex models cannot rely on generic checklist reasons when the true reasons differ.

Outside the United States the rules became more explicit. The EU AI Act entered into force in August 2024 and classed AI used to assess the creditworthiness of individuals as high-risk, with documentation and oversight duties to match. Firms operating in both markets had to reconcile a principles-based US approach with a more prescriptive European one.

By 2026 the same three categories apply to AI agents that take actions, where the explainability burden is heavier. An agent is AI software that carries out steps as well as drafting text, such as filling in a form, sending a message or moving data between systems. When software acts rather than advises, the questions of what must be recorded and who must be able to explain the outcome become sharper.

The lasting value of the 2023 episode is the sorting itself. Any new technology that touches client data, communications or decisions can be run through the same three questions, with three different owners, and the answers will predict how fast it can responsibly be adopted.