Why Generative AI Is Forcing Firms to Rethink Communications SurveillanceThe email looks ordinary. It is polished, professional and safely captured in the firm's archive. What the archive does not show is that an AI assistant helped create it.
Before the employee pressed send, she uploaded a research report, tested several prompts, asked the tool to compare market scenarios and used its response to shape a recommendation. If that recommendation is questioned six months later, the final email may show
what she said. It may not show
why she said it.
That missing context is creating a significant surveillance challenge for firms using generative AI. The tools are entering capital markets workflows through copilots, meeting assistants, research platforms and customer-facing applications. Each interaction can produce prompts, uploaded material, retrieved sources, generated content and human edits. Together, they provide context that the final message cannot reveal on its own.
Compliance must now look beyond whether a communication was captured and determine whether the firm can reconstruct how it was produced if questions arise.
The Archive May Have the Message but Not the Reason
Generative AI does not erase established recordkeeping and supervision obligations. A message sent to a client is still a communication, regardless of the technology used to compose it. The harder issue is deciding how much of the activity behind that message belongs in the record.
Rich Miller, Global Head of eComm and Voice Surveillance at BNY, sees existing governance as the starting point: “I would say that the firms, banks, frameworks already that exist for new channels, new projects, new initiatives all stay the same, so we're just flowing those AI agents and AI bots through those existing frameworks.”
The framework may be familiar, but the evidence inside it is changing. A prompt is not a traditional conversation between two people. It is an instruction to a tool. Yet that prompt may reveal how a price was developed, why a recommendation was made or which information influenced a decision.
Lawrence Deju-Wiseman, Global Head of Surveillance, Monitoring & RegTech at GTN, believes firms should prepare for regulators to expect that evidence: “It's more, in my mind, that these are going to be expected to form part of your books and records in the same way that anything else might be. The regulators will expect to have access to them and if that is the case, if we are right about that, then we must monitor them in some way in order to be ready for those inquiries and to sort of get ahead of those inquiries.”
Firms do not need every keystroke, but they do need enough context to explain a consequential decision. That means determining which AI interactions are material, how long to retain them and how to retrieve them alongside the communication or transaction they helped shape. None of that is possible, however, if the firm does not know which AI tools are in use.
Shadow AI Will Not Wait for the Approval Process
Approved tools are only part of the picture. The greater blind spot may be the employee using an unapproved application because it completes a task faster, or an AI feature that arrives quietly inside a third-party platform. By the time compliance discovers the tool, it may already be part of the workflow.
Policies and technical restrictions matter, but prohibition alone is unlikely to keep pace. If the governed route is too difficult or too slow, employees may create their own.
Deju-Wiseman frames the solution in practical terms: “The best way to beat shadow AI is to let people use AI in a governed way and support it across your business. Because if you're too slow, they're just going to route around you. And that's kind of the nightmare scenario.”
Firms can reduce this risk by giving employees a safe way to propose useful AI applications. That requires clear policies, an accurate inventory of approved use cases, technology that can detect unauthorized applications and an approval process that can keep pace with the business. Once firms know where AI is being used, they still have to connect its output with the rest of the surveillance record.
AI Cannot Fix Data That Does Not Connect
Even the most advanced surveillance model cannot reconstruct a story when the underlying records do not line up. A trade may be timestamped in UTC while the related communication is stored in the local time of the office where the employee was originally onboarded. A security, customer or counterparty may carry different identifiers across different systems.
Those inconsistencies sound technical until an investigator tries to connect a transaction to the conversation that explains it. Then a small mismatch becomes a missing piece of evidence.
Paul Cottee, Director, Regulatory & Markets, NICE Actimize, describes the challenge: “You've almost got to build a circumstantial case, looking at things like timestamps and who's talking to whom and so on. And then what was actually put in the structured data in terms of what trades were done.”
This is why communications surveillance can no longer sit apart from data architecture and technology strategy. As
Deju-Wiseman advises: “Your tech teams are your best friends. You need to be buying them coffee, buying them donuts, and spending a lot of time building those relationships with them.”
Katsuko Ishizeki-Chaudhari, an independent regulatory consultant and former regulator and practitioner, makes the organizational challenge even plainer: “I just want to add the point regarding AI. I think it brings people together. You have to bust silos.”
Communications surveillance, trade surveillance, information security, data governance, model risk and the business may each hold part of the record. The firm only sees the whole story when those parts can be brought together. That connected record establishes what happened. It must also show who was responsible for the outcome.
What Meaningful Human Oversight Requires
As AI takes on more work in alert generation, risk scoring and recommended case outcomes, firms often point to a human in the loop as the safeguard. But placing a person at the end of an automated process does not prove that meaningful oversight occurred.
Ishizeki-Chaudhari is direct: “You can't just have a human just for the sake of it.” The reviewer needs the expertise to recognize a questionable output, the authority to challenge it and the ability to pause or stop the process.
Miller describes the principle guiding AI deployment at BNY: “But I think the bottom line and one of the central tenets from the top is that even when we develop these tools that are great and very efficient, we are not delegating responsibility to the AI agents, and that the human owners still have that responsibility for the output. So that has not changed.”
Responsibility also has to be visible. If a reviewer routinely accepts the AI's recommendation, the human may be in the workflow without functioning as a real control. A defensible process needs evidence that reviewers understood the issue, tested the recommendation and exercised independent judgment.
A Defensible Process Matters More Than Perfect Capture
No surveillance program will capture every person, tool and interaction perfectly at every moment. A more realistic test is whether the firm's controls are reasonably designed and whether the firm can show how it identifies new channels, closes data gaps, reviews exceptions and adapts as technology changes.
Cottee explains why that standard matters: “If you can show that your processes and your systems and controls and your WSPs and so on are reasonably designed to have the outcome that you desire, then you're probably going to be in good shape.”
Generative AI is exposing gaps in the foundations of communications compliance, but the practical question is consistent throughout: can the firm reconstruct how a consequential decision was made? Answering it requires the firm to know which AI tools were used, preserve the relevant context, connect the records across systems and show where a qualified person exercised judgment.
The email in the archive may be the end of the story. The firms best prepared for what comes next will be able to show everything important that came before it.
Want to learn more about this topic? Watch the webinar on demand.
