Running communications surveillance at a financial organization today often means being under increasing pressure to bring AI into daily workflows. For many organizations, this raises the question of how to have AI screen alerts and shape decisions in a way that is in accordance with regulatory requirements.
Compliance leaders already deploying AI have answers to that question. At a private roundtable Luware hosted at the RegTech Summit London this month, leaders from banks, investment managers, and other financial services firms shared their learnings with us. Combined with insights from talks at the summit, this article provides six lessons for using AI in communications compliance. You'll learn what needs to be in place so AI can add value and what your communications record must prove.
Communications compliance (also known as communication compliance) is the practice of capturing, retaining, and supervising business communications so a regulated organization can show how its people conducted business. It covers regulated communications on every channel employees use, from calls to video meetings to chats, and the transcripts generated from them.
Which communications firms must capture, and for how long they must retain them, depends on the jurisdiction they are working under. The table below summarizes the core recording rules for financial services organizations in the EU, the UK, and the U.S.:
| Jurisdiction | Regulator | Key rule | Recording requirements | Retention period |
| EU | European Securities and Markets Authority (ESMA) | MiFID II, Article 16(7) | Investment firms must record calls and electronic messages about transactions, even when no trade follows | Five years, or up to seven if a regulator requests it |
| UK | Financial Conduct Authority (FCA) | SYSC 10A, FCA Handbook | Firms must record calls and keep electronic communications relating to financial instrument activities | Five years, or up to seven if the FCA requests it |
| U.S. | Securities and Exchange Commission (SEC); Financial Industry Regulatory Authority (FINRA) | SEC Rule 17a-4; FINRA Rule 3110 | Broker-dealers must preserve business records, including conversations, and supervise communications | Varies by record type; a minimum of 3 years |
| Financial Industry Regulatory Authority (FINRA) | FINRA Rule 4511 | Broker-dealers must preserve records as stated in the Securities Exchange Act and FINRA rules | 6 years unless specified |
AI makes these obligations more complex. Firms must now evidence not only what was said, but also what their AI did with a recording. The six lessons below show how leading financial businesses are managing that extra layer.
AI is already taking on repetitive work in Level 1 surveillance review, the first pass where compliance officers decide which alerts need attention. It is here where surveillance workloads pile up as channels and message volumes grow: Every alert needs a human analyst to look at it and process it.
Many financial services organizations are now moving AI into that bottleneck. In a RegTech Summit London audience poll, half of respondents said they are scaling AI into production compliance workflows, and another 35% are running pilots. Only 3% described AI as business as usual. This suggests that while most firms are past experimenting, few have embedded AI in their normal compliance work.
Luware's private roundtable at the summit showed what the efficiency gain of incorporating AI in review work can look like in practice. One financial institution uses AI at Level 1 and has already cut false alerts by 64%, with 90% targeted by early 2027. Participants also noted that models keep getting better at understanding context across large and complex datasets. In one roundtable firm's suspected data-exfiltration case, AI found hidden changes in a large spreadsheet that manual review would likely have missed.
This more accurate automated alert review is made possible by advances in analytical methods. Older lexicon-based rules flag every message that contains a listed term, so a harmless phrase may still trigger an alert, a so-called false positive. Contextual AI models, on the other hand, read the full exchange before deciding whether it signals a compliance risk.
| Lexicon-based monitoring | Contextual models | |
| How alerts are raised | Matches listed keywords and phrases | Interpret meaning across the full conversation |
| Main weakness | Misses intent expressed in unlisted words | Need auditable inputs and outputs |
| Impact on analysts | High alert volumes to clear manually; possibly missed breaches | Prioritized queues, so analysts spend time on real risk |
AI also supports the next stage of review. For instance, another roundtable participant uses AI to draft short disposition summaries for Level 2 triage and reported high accuracy.
Most financial services firms use AI in the first stages of surveillance: detection and triage. In a summit poll on trade and market abuse surveillance, 40% of respondents use AI to generate and detect alerts, and 27% use it to triage them. Together, that is two-thirds of reported use.
Richer analysis is still rare: 13% apply AI to news, social media, and other external data. Moreover, only 7% each use AI for behavioral or anomaly detection or to connect trade and communications data.
The takeaway: Start AI at Level 1 review, measure the analyst time it saves, and ensure the full conversation is one click away from every alert.
AI often enters a firm’s communications before compliance teams are aware of it. Employees bring public AI tools into their work, and AI assistants now routinely appear in meetings. These tools are riskier than most because they capture and process conversations, which means data can leave the organization.
Roundtable participants described four channels that have tested firms’ boundaries, from deliberate business choices to tools employees adopt on their own:
Video meetings became a client channel during the recent pandemic and raised questions about recording, confidentiality, and transcription.
Social media is in demand as teams seek access for client acquisition.
Messaging app policies at firms range from outright bans to approved use with appropriate controls.
AI meeting assistants now join client and internal meetings, and firms must decide how to govern the content they capture.
Public AI tools are the hardest to govern, because they can even be present without anyone choosing them. A summit presentation on third-party risk described this as drift: the gap between what a firm approved and what is actually running. For example, an approved collaboration tool can introduce AI features in a routine software update. The firm’s original assessment thus no longer fully covers what the tool does.
The takeaway: Inventory every channel employees use, why they use them, what each one is permitted to do, and who owns it. Review this list after every software update and mark each one as approved, captured, or blocked once again.
AI in communications compliance has to be both auditable and explainable. Auditability records the inputs, outputs, and human sign-off behind every AI-assisted decision. Explainability shows why an AI model reached a specific conclusion, which regulators increasingly expect.
| Auditability | Explainability | |
| Question answered | What happened, and who decided? | Why did the model conclude this? |
| Achievable today | Yes, with audit logging and complete records | Yes, but harder as models grow more complex |
| Evidence produced | Inputs, outputs, model versions, and sign-offs | Model reasoning, often still interpreted by people |
Regulatory expectations for AI differ by jurisdiction. According to roundtable participants, UK regulators have been fairly receptive to firms developing AI, provided the right controls are in place. Elsewhere, regulators may take a more prescriptive or enforcement-driven approach.
Two internal foundations make AI auditable. First, each AI system should be owned by a named individual, a point raised at the RegTech Summit London. A firm that deploys AI remains responsible for its use and cannot pass that responsibility to the model provider. Second, communications compliance policies must be consistent. Roundtable participants found that contradictory or poorly structured policies produce equally inconsistent AI output. Preparing for AI can therefore mean rewriting and standardizing policies, classifying information, and mapping regulatory obligations against internal controls before any model goes live.
Participants at Luware's private roundtable showed what auditable AI can look like in practice. At one financial organization, the AI system passed the firm’s Model Risk Management process before going live. Internal audit is adapting as well: Auditors at roundtable firms have started using AI to test compliance AI.
In the EU, explainability is becoming a legal requirement. The EU AI Act demands that high-risk AI systems be transparent enough for deployers to interpret their output (Article 13). It also gives affected individuals a right to an explanation of decisions based on that output (Article 86).
Roundtable participants found that explaining an AI's conclusion often still requires human interpretation. One firm tackled explainability and auditability directly at system level: Before going live, it explained its AI architecture to regulators.
The takeaway: Log every AI input, output, model version, and sign-off. Require every AI system to explain its outputs in terms a reviewer and a regulator can follow. Name one accountable owner for each system.
What is essential in AI-assisted communications compliance is that the underlying communications record is complete, immutable, and provable. That's because regulators judge an AI decision by the evidence behind it. If the AI flagged or closed an alert based on an incomplete or altered recording, the firm cannot defend that outcome, however capable the model was.
Two trends raise the stakes. Deepfakes make it necessary to prove that a recording is authentic and where it came from. Convenience recording, which reuses transcripts for client service and training, means more people rely on the same record.
Since most financial services organizations lack a single source of truth, however, confirming whether a record is complete and unaltered poses a challenge. In a RegTech Summit London 2026 audience poll, 38% of respondents called their data architecture fragmented, 46% partially consolidated, and only 13% centralized.
Few expect centralization to fix this. To improve data consistency, 42% favored AI-driven data quality tools and 42% stronger governance and data ownership, versus 8% for a centralized data architecture.
Summit speakers made the same case: AI can act as an intelligence layer across silos instead of forcing all data into one repository. Calls, meetings, messages, and transcripts may therefore stay distributed across platforms. This is especially helpful as regulations and data change continuously. But it only works when each layer fulfills its role. Every record must be complete, unaltered, and traceable to its source. Every conclusion needs traceable inputs and outputs.
I'd like to argue, however, that the review layer, where compliance officers work, is different. It can be fragmented as well, but this costs officers a clear overview and forces them to switch between systems. One place to search, review, and produce evidence makes review more efficient.
Luware Recording, Luware's multi-platform compliance recording solution, is designed to provide that authoritative record. It captures and archives regulated communications, allowing compliance officers to retrieve evidence from a single platform when regulators ask.
Defensible communications compliance records must at least meet the seven requirements below:
Immutable originals, so a record presented as evidence matches what was said.
Complete capture, so you can show coverage across every required channel and prove that any specific call, meeting, or message was recorded.
Capture-failure detection, so gaps are found and fixed before an examination finds them.
Audit trails, so every access, change, and export is attributable to a person.
Retention controls, so records are kept for the required period and disposed of on schedule.
Rapid retrieval and export, so you meet regulator deadlines without hassle.
Clear data lineage, so you can show what an AI tool read and where that data came from.
For more details, read this guide on how to choose call recording compliance software for financial services.
The takeaway: Make sure every source holds complete, unaltered, and traceable records. Test your current communications record against the seven criteria above before you let AI make decisions from it.
Many compliance controls run overnight in the gap between trade and settlement, when buyer and seller exchange securities or money. A keynote at the RegTech Summit London traced what happens as that gap shrinks: Each shorter cycle removes an overnight window. With 24/7 trading and atomic settlement, where cash and securities change hands instantly, no window is left at all. Processes affected by shrinking overnight windows include reconciliations, alert reviews, sanctions rescreening, and exception management.
The shift to always-on markets is already on surveillance teams’ radar. Asked what will most disrupt surveillance effectiveness over the next year, 22% of respondents in a summit audience poll chose 24-hour markets, second only to prediction markets at 56%, which also trade around the clock. Tokenization and other answers took 11% each. AI received no votes, which suggests respondents now treat AI as an applied tool past disruption.
Long retention periods create a second timing problem. Under “harvest now, decrypt later,” attackers can collect encrypted data today and decrypt it once quantum computing matures. Some communications recorded today will still be inside their retention period when post-quantum migration becomes necessary. The same keynote called this a convergence nobody has budgeted for.
The takeaway: Map every control that relies on an overnight batch and plan how it will run continuously. Ask your recording and archive vendors when they will support post-quantum encryption standards for long-retention records.
The most important safeguard in AI-assisted surveillance is a human in the loop who can still recognize when the AI is wrong. That skill is at risk, because AI is absorbing the junior work through which analysts used to build it.
A RegTech Summit London audience poll underlines this: 57% of respondents named compliance surveillance and monitoring as the role AI will redefine most. Regulatory compliance followed at 21% and information technology at 14%.
A second risk to the preservation of human judgment is rubber-stamping, where reviewers accept AI recommendations without real challenge. One summit speaker suggested treating AI like a new employee whose autonomy grows only as it proves reliable. Similarly, firms need reviewers and governors who keep learning, not a one-time training program. AI is changing faster than most governance cycles. What counts as expertise today can be outdated within a year.
Alexander Grafetsberger, who attended the private roundtable on Luware side, commented on this:
Discussions at Luware's private roundtable and the summit pointed to three ways to keep human judgment sharp:
Mandatory AI training: One roundtable firm requires every employee to complete two hours of AI training each quarter. The business further tracks how approved tools are used.
Success criteria before pilots: Measures such as hours of manual work removed, false positives reduced, and investigation quality are agreed before results arrive.
Analog days: an idea raised at the summit, whereby firms temporarily turn off their AI systems to confirm that critical operations can still run without them.
The takeaway: Keep a human in the loop for every consequential decision and train that person on AI every quarter. Test regularly that critical operations can still run without AI.
The best place to start with AI in communications compliance is the communications record itself: Check that every recorded call, meeting, and message is complete, unaltered, retrievable, and traceable to its source. AI efficiency, auditability, and human review all depend on that record.
That said, the record is only the starting point. The six lessons above make clear that in order to use AI in communications compliance, safeguards must be placed at every step. Choose your models carefully, keep confidential data out of public AI tools, and govern every model you deploy.