Reg BI Care Obligation and AI-Generated Recommendations: What Evidence to Keep Per Request

What the Care Obligation asks a firm to demonstrate

Under Regulation Best Interest (17 CFR 240.15l-1), a broker-dealer or associated person that recommends a securities transaction or investment strategy, including an account recommendation, to a retail customer must act in the customer's best interest at the time of the recommendation, without placing its own financial or other interest ahead of the customer's. That duty is satisfied only by complying with four component obligations: Disclosure, Care, Conflict of Interest, and Compliance.

The Care Obligation requires the firm to exercise reasonable diligence, care, and skill in making the recommendation. The 2019 adopting release refers to three components. One requires a reasonable basis to believe that a series of recommended transactions, even if in the customer's best interest in isolation, is not excessive and is in the customer's best interest when taken together in light of the retail customer's investment profile. For AI, this means a single request is rarely the whole picture, and records need to be linkable across requests for the same customer.

The adopting release is also clear about what is not required. The Commission stated that the substantive requirements apply on a recommendation-by-recommendation basis, but that it is not requiring broker-dealers to create and maintain records evidencing best interest determinations on that basis. The Care Obligation does not require documenting the basis for a recommendation, although a risk-based approach to documentation is available, for example for complex products or recommendations that appear inconsistent with the customer's investment objectives on their face. Where a firm decides not to obtain or analyze a factor in the definition of Retail Customer Investment Profile, the release says it should document why that factor was not relevant. The Commission also adopted amendments to Exchange Act Rules 17a-3 and 17a-4 creating record-making and recordkeeping requirements for certain information collected from or provided to retail customers. As of November 2026, Regulation Best Interest is in effect with no amendment reported.

The practical conclusion is that a per-request AI evidence record is not a rule-mandated artifact. It is a way to demonstrate diligence and supervision when an examiner or internal reviewer asks what happened on a specific request.

Mapping Care Obligation questions to evidence artifacts

Treating the Care Obligation as a set of demonstrable questions makes the evidence requirement concrete. Each row below pairs a question with the artifact in the record that helps answer it. These artifacts show what was presented and checked. They do not show that the underlying judgment was right.

• Was reasonable diligence, care, and skill exercised?: Policy and version applied, enforcement decision, and reviewer decision where the output was escalated.
• Was the customer's investment profile considered?: Reference to profile data used, plus a recorded reason for any factor not obtained or analyzed.
• Were potential risks, rewards, and costs part of what was delivered?: Output delivered, and the result of any policy check on required content.
• Were reasonable alternatives addressed?: Output delivered and policy check results showing whether alternatives were presented or the output was blocked.
• Is a series of recommendations reasonable together?: A customer-level key that links individual request records so a reviewer can assemble the sequence.

What runtime policy enforcement can produce

The record is easiest to defend when it is created at the moment the decision is made. A review performed after the fact has to infer what the AI was permitted to do from application logs that were not structured as evidence. Enforcement in the execution path avoids that inference: the policy check, the decision, and the output are captured as the interaction happens.

Trussed enforces policy in the execution path, at runtime and not reviewed after the fact, across models, agents, tools, and MCP servers. Its actions are allow, redact, block, rate limit, and escalate for human approval, applied to individual interactions and tool calls. That enforcement generates audit-ready evidence, so the request, policy applied, decision, output, and approver on an escalation can come from the same event. Retention and data residency are configurable, and deployment is self-managed in the customer's cloud. Trussed has run continuously in a regulated enterprise for more than 18 months, at 99.95% uptime on live production traffic.

The limits matter as much. Enforcement does not determine whether a recommendation is in the customer's best interest. It does not decide which AI interactions count as recommendations under Reg BI, and it does not replace the source customer profile records or the firm's supervisory conclusions. Those remain with the firm.

Decisions and tradeoffs

Start with classification. The obligation attaches to recommendations to retail customers, so the firm needs a defensible way to separate AI interactions that are recommendations from those that are not. Over-capturing creates storage and privacy burden. Under-capturing leaves gaps where an examiner may look.

Next, adopt tiers. The adopting release supports a risk-based approach to documentation, so fuller evidence for complex products and for outputs that appear inconsistent with a customer's stated objectives is consistent with it, while routine interactions carry a lighter record. Storing a reference to customer profile data instead of a copy limits duplication of sensitive data, at the cost of requiring the referenced data to be retrievable as it stood at the time of the request.

Finally, set retention deliberately. The 2019 release described a six-year period for account information under Rule 17a-3(a)(17), counted from the earlier of account closure or the date the information was replaced or updated. Retention for AI evidence records should follow the firm's own books-and-records analysis, and the retention setting should be recorded on each record so it can be shown later.

One caution applies to every choice above. The record evidences process and controls. Present it that way in supervisory procedures and in examinations, and do not describe it as proof of best interest.