AI Meeting Assistant Usage Policy: A Framework for IT, Operations, and Compliance Leaders in Regulated Industries

AI notetakers have moved from novelty to default infrastructure. In under two years they went from a productivity curiosity to a tool running quietly in the background of client reviews, deal discussions, and internal working sessions. That shift has a consequence many firms are only now confronting: regulators and auditors have started asking how these tools are governed.

In the SEC Division of Examinations' 2026 Examination Priorities, released November 17, 2025, the staff signaled it will assess whether firms have implemented adequate policies and procedures to monitor and supervise their use of AI technologies and whether registrant representations about AI capabilities are accurate. As the Harvard Law School Forum on Corporate Governance summarized it, advisers and funds "need written policies, procedures, or guidance that address the acceptable uses of AI and provide for appropriate human oversight," and must periodically train employees on appropriate AI use.

This article lays out a practical framework for writing (or evaluating) an internal AI meeting assistant policy based on real policies from Fellow customers. It is grounded in how compliance and legal teams across regulated verticals (private equity, hedge funds, RIAs, wealth managers, insurance brokers, legal, and healthcare) are actually structuring these documents today.

The patterns below are presented as common industry approaches rather than settled rules, and none of this is legal advice: every regulatory point should be confirmed with your own counsel. The goal is enablement. A good policy is what lets a firm say yes to AI adoption confidently, rather than banning it out of uncertainty.

Why you need a written AI meeting policy

A written policy matters because the outputs of an AI notetaker are not casual convenience files. They are potential records.

• Books-and-records exposure. For SEC-registered investment advisers, Rule 204-2 under the Investment Advisers Act defines a "record" broadly enough to sweep in transcribed information "of any type," a formulation that may capture AI-generated notes, summaries, and transcripts. It also carries a concrete retention consequence: under 17 CFR 275.204-2(e), most required records must be kept for at least five years from the end of the fiscal year in which the record was created, with the first two years immediately accessible at the firm's principal office (per the Cornell Legal Information Institute e-CFR). Whether a given transcript is a required record is fact-specific and turns on how it is treated and distributed, which is exactly why firms should make deliberate, category-level decisions in advance rather than assessing transcripts one by one. Broker-dealers face parallel questions under Exchange Act Rule 17a-4, and firms should consult counsel on how these rules apply to their facts.

• Retaining everything is not the safe default. Securities-law commentators caution that over-retention can increase examination and discovery exposure: a transcript the firm was not required to keep is still something an examiner or adverse party can scrutinize. At the same time, deletion practices draw their own scrutiny. Practitioners advise adopting a regular, consistent, and systematic destruction schedule (rather than deleting on a purely discretionary basis) to minimize any appearance of selective deletion. Under-retention carries the opposite risk, because deleting a required record can itself be a violation. The policy is where you resolve that tension deliberately.

• GDPR and consent exposure. For firms with EU participants, meeting recordings and transcripts are personal data, and processing them requires a lawful basis plus transparency to participants. Firms should consult counsel on consent, legitimate-interest assessments, and data-subject rights.

• Privilege and MNPI. Introducing a third-party AI vendor into a privileged conversation may support a waiver argument, and inadvertently captured material nonpublic information (MNPI) creates a separate control problem. These are the risk drivers that make a "verbal understanding" insufficient once a regulator or auditor asks for documentation.

The through-line: the SEC's "off-channel communications" enforcement sweep conditioned firms to think hard about what gets captured and retained. Per the SEC's own tally cited by Holland & Knight, since December 2021 that sweep has resulted in charges against more than 100 firms and over $3 billion in combined civil penalties, with the January 13, 2025 wave alone fining twelve firms a combined $63 million. AI notetakers reopen exactly that "what do we capture and keep" question in a new form.

The 7 core components of an AI meeting assistant policy

Most policies in this space converge on the same seven building blocks. Each is presented below with a short explanation and a "what to decide" checklist you can adapt.

1. Access and rollout approach

Decide who gets the tool, and how fast. Many firms in regulated verticals start with a defined pilot group (often a single team or business unit) before expanding firm-wide, so governance and configuration can be tested against real meetings before scale.

What to decide:

• Pilot group vs. firm-wide from day one.

• Who approves expansion, and on what criteria (clean audit logs, a signed vendor DPA, completed training).

• Whether access is provisioned centrally to prevent "shadow AI," where employees adopt personal-account tools outside IT's review.

2. Restricted meeting types

This is the most consistent element across the policies Fellow customers have created. A near-universal set of meetings to consider excluding from AI capture:

• Board and committee meetings.

• Investment committee and deal committee meetings.

• LP, investor, and fundraising calls.

• Legal and privileged conversations (anything with counsel).

• HR and personnel matters.

• Live negotiations that could bind the firm.

The common rationale: these are the settings where a verbatim record can chill candid deliberation, create discovery exposure, or risk privilege waiver. A common approach is to classify meetings into "always captured," "never captured," and "captured at user discretion," and to make the restricted list enforceable at the tool level rather than relying on memory.

→ Learn how to set up workspace-wide auto-record restrictions in Fellow

3. Consent and disclosure requirements

Decide how participants are told, and what happens when someone objects. A recurring theme in legal commentary is that the mere visible presence of a recording bot is generally not treated as sufficient informed consent; disclosure should be explicit.

What to decide:

• Verbal notice at the top of the meeting vs. reliance on an automatic in-meeting disclosure (and note that all-party-consent jurisdictions and GDPR raise the bar).

• How objections and opt-outs are handled in real time (the common answer: stop capture, or switch to manual notes).

• External-participant considerations for portfolio companies, advisors, and prospects, where a signed data-protection posture matters most.

• Where consent is documented so it can be produced later.

→ Learn how consent capture works in Fellow

4. Data retention rules

Retention is a firm-specific decision, not an industry constant. Your retention window should map to your own document-retention policy and regulatory posture, and it should be set in consultation with counsel rather than copied from a benchmark.

What to decide:

• Distinguish retention of the raw recording/transcript from the AI-generated summary/notes. These are often governed differently, and many firms delete raw source material on a short schedule while retaining the analytical layer (summaries, decisions, action items) as institutional memory.

• How the window aligns with any applicable books-and-records retention obligations.

• How you will handle the tension between document-request and discovery exposure on one hand and the operational value of retained records on the other.

• How deletion is evidenced (a defensible, logged deletion beats an informal cleanup).

→ Learn about Fellow's data retention settings

5. Sensitive information handling (MNPI, privilege, PII)

Decide what happens when a sensitive topic surfaces mid-meeting. Even in a permitted meeting, a conversation can turn toward privileged matters, personnel issues, proprietary trading discussion, or MNPI.

What to decide:

• A pause/redact workflow: the ability to stop capture instantly when the discussion moves to a sensitive topic, and to redact sensitive content afterward.

• What to do if MNPI is inadvertently captured (who is notified, how it is removed, how the removal is logged).

• Whether redaction is user-controlled or restricted at the admin level, since compliance posture on redaction varies and some teams prefer to limit it.

→ Learn about Fellow's redaction feature

6. Distribution and sharing controls

Decide where notes are allowed to go. The record you keep is only as controlled as your sharing rules.

What to decide:

• Internal-only by default vs. explicit share decisions.

• Rules on exporting to other platforms (CRM, email, personal accounts), since a summary emailed externally can change its regulatory character.

• External-sharing restrictions for LPs, portfolio companies, and advisors.

• Whether shares are access-logged for later review.

7. Enforcement, audit, and ownership

Decide who owns the policy and how it is enforced. A policy no one owns is a policy no one follows.

What to decide:

• Ownership: compliance, IT, or a joint governance committee. For PE and finance audiences, legal and compliance typically drive this jointly with IT.

• Audit-logging expectations (what was recorded, what was deleted, when, and by whom).

• Consequences for violations.

• Training cadence, so personnel actually understand the restricted list and the consent script.

A note on vendor requirements

Whatever policy shape you choose, the tool has to be able to enforce it. Compliance teams should require the following from any AI notetaker vendor, regardless of brand:

• No training on customer data, stated contractually and flowing to sub-processors.

• Export and access rights for supervisory review.

• Audit logs showing lineage from recording to transcript to summary to distribution.

• A documented security and privacy posture, such as SOC 2 Type II, HIPAA eligibility with a signed BAA, and GDPR alignment.

Fellow is the secure AI meeting notetaker for regulated industries that supports configurable zero-day retention for both recordings and transcripts on independent, admin-enforced schedules, with AI summaries, action items, and decisions persisting after the raw recording and transcript are deleted. It offers privacy controls including redaction across transcripts and recordings (with AI-summary regeneration user-controlled at the time of redaction), access permissioning, role-based access control, and pause and resume so off-the-record discussion never hits the transcript. Fellow is SOC 2 Type II certified, HIPAA compliant, and GDPR aligned, and it does not train AI models on customer data. Its botless recording captures across platforms and in-person meetings.

For firms that archive to a compliance system, an archiving path exists via the Global Relay Open Connector for Fellow, built on Global Relay's API. Any FINRA, SEC, or MiFID II implications should be confirmed with counsel and Fellow's team. For compliance-specific configuration questions, request a demo to walk us through your firm's requirements.

Closing

A policy is not a paperwork exercise. It is the mechanism that lets a firm adopt AI notetakers deliberately instead of banning them out of uncertainty (or, worse, letting them spread ungoverned). The firms getting this right are not the ones with the longest documents; they are the ones that made clear, defensible decisions in advance about what gets captured, what gets kept, and who is accountable. Write those decisions down before the exam, not during it.