Regulation S-P AI Incident Records: What Broker-Dealers and RIAs Must Create and Retain

What the amended rule requires

The SEC adopted the Regulation S-P amendments on May 16, 2024 (Release No. 34-100155). They apply to broker-dealers, investment companies, SEC-registered investment advisers, funding portals and transfer agents. Covered institutions must develop, implement and maintain written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.

The program must include procedures to assess the nature and scope of any incident and to contain and control it to prevent further unauthorized access or use. The assessment must identify the customer information systems and the types of customer information that may have been accessed or used without authorization. It must also include procedures to notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, subject to limited exceptions. Notice is due as soon as practicable, and no later than 30 days after the institution becomes aware that an incident has occurred or is reasonably likely to have occurred.

The amendments also require covered institutions, other than funding portals, to make and maintain written records documenting compliance with the safeguards rule and the disposal rule. Those records include the safeguards policies and procedures, and records of incident assessments, containment steps and notifications to affected individuals. The final rule also requires retention of any written documentation from the Attorney General related to a delay in notice.

On service providers, the rule text requires a provider to notify the covered institution as soon as possible, and no later than 72 hours, after it becomes aware of a breach resulting in unauthorized access to a customer information system it maintains. Receiving that notice requires the institution to initiate its incident response program.

Mapping AI-related events to record categories

The table below is the author's interpretation, not rule text. The rule speaks in terms of unauthorized access to or use of customer information. Whether a given AI event meets that description is a judgment each firm should assign to a named owner and record. Examples include an assistant exposing customer data in a response, an agent making an unauthorized tool call, and a third-party AI provider breach.

• Incident response policies and procedures: Name the AI systems, agents, coding assistants and AI vendors in scope, and state which events start the program. Runtime evidence does not substitute for the written program.
• Assessment of nature and scope: Identify the customer information systems and data types an AI interaction touched. Interaction-level records of requests, data categories and policy decisions can feed this assessment.
• Containment and control steps: Record what the firm did, such as revoking tool access, disabling an integration or blocking a request pattern. An enforcement action shows a block occurred but not the firm's decision to take it.
• Notification determinations and notices: Document whether sensitive customer information was or is reasonably likely to have been accessed or used without authorization, and the 30-day timing. This record largely sits outside the AI execution path.
• Attorney General delay documentation: Retain any written documentation from the Attorney General related to a delay in notice. No AI-side system produces this record.
• Service provider events: Align AI vendor contracts and escalation paths with the 72-hour provider notification requirement for vendors that maintain customer information systems.

Evidence gaps that commonly arise with AI systems

The first gap is scope. Firms often cannot say which AI tools, agents or vendors can reach customer information, or which customer information systems they connect to. Because the assessment must identify affected systems and data types, an incomplete inventory becomes an incomplete record.

The second gap is the permission record. After an event, an examiner will reasonably ask what the AI system was allowed to do and what it actually did. Application logs, vendor dashboards and chat transcripts rarely answer both halves in one place, and they may not be retained for as long as the firm's incident records need to be.

The third gap is the trigger decision. If the incident response program does not say which AI-related events are treated as potential unauthorized access or use, each event is decided ad hoc, and the reasoning is hard to reconstruct later.

The fourth gap is provider-side visibility. A breach at an AI service provider arrives as a notice from outside the firm. Nothing in the firm's own systems will show what happened inside the provider's environment, so the contract, the notice path and the firm's follow-up assessment carry the record.

Retention is set by the recordkeeping rules that apply to each type of firm, Exchange Act Rule 17a-4 for broker-dealers and Advisers Act Rule 204-2 for advisers. Each record category above, including any AI evidence attached to it, should be placed in the retention schedule against the applicable rule.

Where runtime enforcement evidence fits, and where it stops

Trussed enforces policy in the execution path for models, agents, tools, MCP servers, AI sites and coding assistants. Each interaction or tool call is allowed, redacted, blocked, rate limited or escalated for human approval, and that enforcement produces audit-ready evidence. The evidence is enforced at runtime, not reviewed after the fact. For an incident assessment, it can show what a specific AI interaction or tool call was permitted to do, what the policy decision was, and whether a redaction, block or human approval occurred. That is the kind of material that helps establish which systems and data types an AI interaction touched.

The limits matter as much. The evidence covers individual interactions and tool calls. It does not provide end-to-end tracing of agentic workflows or model provenance. It does not capture events inside an AI provider's environment. It is also not the assessment, the containment record, the notification determination or the Attorney General documentation, and it does not by itself demonstrate compliance with Regulation S-P. It is supporting evidence that feeds records the firm must still make.

The evidence is retained in the customer's own cloud under a self-managed deployment, with configurable retention and data residency. That lets a firm align retention with its own schedule.