The archiving vendor a firm already runs survived the off-channel-comms enforcement wave and has since added connectors for the hosted assistants; the gap that remains is agent execution records: tool calls, retrieved context and multi-step traces, which live in systems with no retention grade at all.

What this category solves (and what you did before it)

Capture, retention and supervisory review of business communications. Two obligations, and the single most common mistake on this page is treating them as one product.

Preservation is the archive: records kept for the statutory period in a compliant format, searchable, holdable. Supervision is surveillance: policy matching, alerting, review workflow, escalation. Different rules, different systems. Microsoft’s Communication Compliance is the second, not the first; its own documentation describes detect, capture, alert, review, remediate and escalate to eDiscovery. Retention for Copilot and AI apps is a separate Purview solution, with dedicated retention locations, prompts and responses copied to a hidden mailbox folder, eDiscovery-searchable and hold-capable. Do not let a vendor’s phrasing (“ensures interactions adhere to policy”) imply enforcement: these products are detective and post-hoc, and nothing here blocks an agent’s output.

Know which rule binds you

Rule 3110 is a FINRA member rule; it binds broker-dealers. Microsoft’s own documentation names SEC and FINRA, cites FINRA Rule 3110, and ships a “detect financial regulatory compliance” policy template, which reads differently for this audience. Most hedge funds and asset managers are registered advisers, where the hooks are Advisers Act Rule 206(4)-7 for the compliance program and Rule 204-2 for books and records. Dual-registered firms fall under both. Buying a product whose marketing cites the rule that binds someone else is a poor start to an examination conversation.

What actually differentiates products

Connector coverage for AI channels, checked per product rather than per vendor. This is where the category moved in the last year, and it moved further than the practitioner advice reflects. Global Relay’s connector list includes a Microsoft Copilot connector and a ChatGPT Enterprise connector; Smarsh announces Claude Enterprise capture. Coverage is asymmetric across vendors, so confirm the specific connector for the specific assistant in use before telling anyone the channel is covered.

Retention format and the 17a-4(f) path. Ask which path the archive satisfies: audit-trail recreation, or non-rewriteable and non-erasable storage. Ask whether the vendor files the designated-third-party undertaking on the firm’s behalf. Ask for the third-party assessment. We could not verify a 17a-4 posture for any named vendor from public materials in this pass. Do not write “17a-4 compliant” next to a vendor name on the strength of marketing that says “regulatory-grade.”

Whether supervisory review survives agent volume. The legacy email-and-chat feature set is commodity. Review capacity is not; see oversight decay.

The gap, stated precisely

Practitioner material of 2024–25 vintage lumps operational log platforms, regulated archivers and LLM tracing tools into one row against “recordkeeping gaps.” That was a fair description then and is now only half true. The capture gap for vendor-hosted assistant chat is closing.

What no archiver covers is agent execution records: the tool calls, the retrieved context, the intermediate reasoning, the multi-step trace. Those live in tracing platforms that position explicitly as operational monitoring and make no retention or archiving claim. So the record of what the agent actually did, as opposed to what someone typed at it, sits in a system with no statutory retention grade, and often with a default retention measured in days against floors measured in years. One concrete instance worth checking on any given platform: Copilot Studio’s Dataverse conversation transcripts carry a 30-day default purge, against three-, five- and six-year statutory floors depending on the record.

That is the finding. Frame the problem as agent execution records rather than as “AI recordkeeping” generally; the alternative is buying a connector and believing the job done. See recordkeeping and compliance gaps.

Tier

Day 1 for a registered adviser, because the obligation already binds and most firms almost certainly already own an archive. The open question is scope, not whether.

Named examples

Global Relay and Smarsh are the regulated archivers: capture, archive, surveillance and discovery in one line, with the AI connectors described above. Purview Communication Compliance is the surveillance layer for a firm already on a Microsoft estate, sitting on top of Purview retention rather than replacing it. Log and SIEM platforms are neither, and archive capability should never be attributed to them; tracing platforms are neither, and say so themselves.

Comms surveillance has its own vendor set distinct from the archivers, and several of those vendors are independent specialists rather than parts of the archiving duopoly. Scope the two purchases separately.

The enterprise bar

The usual list, with one inversion worth stating: zero retention means something different here. Everywhere else on this wiki it means the vendor keeps nothing. Here the product’s entire job is retention of the firm’s records, so the question becomes retention scope and control: what is kept, for how long, under whose hold, and exportable in what format on exit. Ask for the export format before signing, because an archive that cannot be migrated is a renewal that cannot be declined.

M&A state and category maturity

A mature core with a steady roll-up of niche archivers, and an immature edge. The archiving and surveillance market has consolidated over a decade; AI-channel capture is the part still moving, and it is moving by connector releases rather than by acquisitions. Vendor viability carries less risk here than in the newer categories on this wiki; connector coverage is the live risk, and it changes monthly.

Where the category is immature

Agent execution records, as above. Also: no archiver we found publishes how it handles an agent identity as the author of a record. That schema question will matter when an examiner asks who sent something.

See also

• Recordkeeping and compliance gaps — the concern this category answers, and where the agent-channel gap is defined.
• Logging and audit — operational logs and regulatory archives overlap but satisfy different masters.
• Frameworks — the SEC/FINRA hooks that make this a purchase rather than a preference.
• Oversight decay — supervisory review at agent volume is where human attention breaks.
• Enterprise AI assistant platforms — the channel an archiver most urgently needs a connector for.
• Observability and eval platforms — where agent execution records actually live, and why that is a problem.