# Control 2.13: Documentation and Record Keeping

**Control ID:** 2.13<br>
**Pillar:** Management<br>
**Regulatory Reference:** FINRA 4511, FINRA 3110, FINRA RN 24-09, SEC 17a-3, SEC 17a-4, SOX 302/404, GLBA 501(b), OCC Bulletin 2026-13 (formerly OCC 2011-12), Fed SR 26-2 (formerly SR 11-7), CFTC 1.31<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

!!! note "Agent 365 Architecture Update"
    Agent 365 Unified Registry provides comprehensive agent metadata (usage analytics, risk scores, compliance status) that supports documentation and record-keeping requirements. See [Unified Agent Governance](../../framework/agent-identity-architecture.md) for registry metadata capabilities.

## Objective

Establish comprehensive documentation and record-keeping requirements for AI agents aligned with FINRA 4511, FINRA 3110, FINRA RN 24-09, SEC 17a-3/4, OCC Bulletin 2026-13 (formerly OCC 2011-12), and Fed SR 26-2 (formerly SR 11-7) requirements. This control helps support preservation of agent configurations, decisions, interactions, and governance activities in a format that aids in regulatory examination readiness. Implementation requires organization-specific retention schedules, legal review, and integration with the firm's broader records management program.

---

## Why This Matters for FSI

- **FINRA 4511:** Books and records requirements mandate documentation of automated system operations; records must be retained for the period specified by SEA Rule 17a-4 (default 6 years) with the first 2 years in an easily accessible place
- **FINRA 3110:** Written supervisory procedures (WSPs) must document oversight of AI agent activities, including supervisory review sampling, escalation protocols, and agent approval records
- **FINRA RN 24-09 / Rule 3110:** AI-generated communications must be archived and retained under the same books-and-records rules as human-generated communications; record classification follows function, not medium
- **SEC 17a-3:** Record creation requirements — agent activity that generates or evidences a required book or record triggers the 17a-3 creation obligation
- **SEC 17a-4:** Records preservation requirements including WORM or audit-trail alternative per October 2022 amendments (compliance date May 2023); communications records (including agent conversation logs) require 3-year retention per 17a-4(b)(4), financial/accounting records require 6-year retention per 17a-4(a)
- **SOX 302/404:** Internal control documentation must demonstrate control design effectiveness and operating effectiveness; AI agent governance records support management certification
- **GLBA 501(b):** Administrative safeguards require a documented information security program covering AI systems that access or process customer NPI
- **OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7):** Model risk management requires documentation of model development, validation, outcomes analysis, and ongoing monitoring; agent configuration changes and validation evidence must be maintained per the model inventory
- **CFTC 1.31:** Regulatory records for FCMs, swap dealers, and CPOs must be retained for 5 years in tamper-evident format with the first 2 years readily accessible

---

!!! tip "Automation Available"
    See the following companion solutions in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions):

    - [Agent Registry Automation](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/agent-registry-automation) — Automated discovery, registration, and lifecycle governance of AI agents (v1.0.0)
    - [Model Risk Management Automation](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/model-risk-management-automation) — OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7) model risk documentation with inventory, risk scoring, and Agent Card generation (v1.0.0)
    - [RAG Source Validator](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/rag-source-validator) — Integrity validation for RAG knowledge sources with change detection (v1.0.0)


## Control Description

This control establishes record keeping through:

1. **Record Categories** - Define categories: configuration, interaction logs, approvals, incidents, governance decisions
2. **Retention Schedule** - Establish retention periods per regulatory requirements (6+ years typical)
3. **SEC 17a-4 Compliance** - Configure WORM storage or audit-trail alternative per October 2022 amendments
4. **Document Taxonomy** - Create consistent classification and metadata standards
5. **Access Controls** - Restrict record access to authorized personnel
6. **Retrieval Procedures** - Document processes for regulatory examination response

---

## Key Configuration Points

- Create SharePoint site hierarchy for AI governance documentation
- Configure Purview retention labels per record type:
    - Agent conversation logs: 3-year retention (communications per SEC 17a-4(b)(4))
    - Financial/transaction records: 6-year retention (per SEC 17a-4(a))
    - Governance/approval records: 6-year retention
- Configure SEC 17a-4 compliant storage (WORM or audit-trail alternative)
- Implement document metadata schema (Agent ID, Category, Date, Owner, Regulatory Reference)
- Configure auto-labeling for agent interaction logs
- Establish examination response procedures with designated custodians
- Schedule quarterly documentation completeness audits

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Basic documentation; standard retention; annual review | Low regulatory exposure, standard recordkeeping |
| **Zone 2** (Team) | Comprehensive documentation; Purview retention; documented approval chain | Shared agents warrant formal records management |
| **Zone 3** (Enterprise) | SEC 17a-4 compliance (WORM or audit-trail); automated retention; examination-ready documentation; quarterly audit | Customer-facing requires maximum recordkeeping rigor |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| Compliance Officer | Define retention schedule, approve record categories, validate regulatory alignment |
| SharePoint Admin | Configure site structure, implement retention labels |
| Purview Records Manager | Manage retention policies, handle record disposition |
| AI Governance Lead | Ensure agent documentation completeness, coordinate audits |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [1.7 - Audit Logging](../pillar-1-security/1.7-comprehensive-audit-logging-and-compliance.md) | Audit logs are key governance records; capture-tier telemetry feeds record-keeping evidence |
| [1.9 - Data Retention](../pillar-1-security/1.9-data-retention-and-deletion-policies.md) | Retention policies apply to agent records; label and policy configuration is prerequisite |
| [1.19 - eDiscovery](../pillar-1-security/1.19-ediscovery-for-agent-interactions.md) | eDiscovery cases enable examination response and litigation hold for agent interaction records |
| [2.3 - Change Management](2.3-change-management-and-release-planning.md) | Change records and release documentation feed the governance record set |
| [2.12 - Supervision](2.12-supervision-and-oversight-finra-rule-3110.md) | Supervision records (WSPs, review logs, sampling evidence) maintained per this control |
| [3.1 - Agent Inventory](../pillar-3-reporting/3.1-agent-inventory-and-metadata-management.md) | Inventory is foundational documentation; provides the authoritative agent register |
| [3.3 - Compliance Reporting](../pillar-3-reporting/3.3-compliance-and-regulatory-reporting.md) | Compliance reports are key governance records requiring retention per this control |

!!! tip "Advanced Implementation: Platform Change Governance"
    For implementing SEC 17a-4 compliant decision logging for platform changes, see [Platform Change Governance - Evidence and Audit](../../playbooks/advanced-implementations/platform-change-governance/evidence-and-audit.md).

!!! tip "Advanced Implementation: Environment Lifecycle Management"
    For immutable provisioning audit trails using organization-owned Dataverse tables, see [Environment Lifecycle Management - Evidence and Audit](../../playbooks/advanced-implementations/environment-lifecycle-management/evidence-and-audit.md).

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/2.13/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/2.13/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/2.13/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/2.13/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. SharePoint site structure exists for AI governance documentation with required libraries
2. Purview retention labels applied with retention periods aligned to SEC 17a-4 record-type matrix (3 years for communications, 6 years for books and records)
3. SEC 17a-4 compliant storage configured (WORM or audit-trail alternative) for Zone 3 deployments
4. Document metadata schema implemented with Agent ID, Category, Regulatory Reference, and Classification Date fields consistently populated
5. Auto-labeling policies configured and operational for agent interaction logs (Zone 2 and Zone 3)
6. Examination response procedure documented with designated custodians and response SLAs
7. Microsoft Copilot Studio agent version history and publish logs preserved per the retention schedule
8. Quarterly documentation completeness audit conducted with findings remediated (Zone 3)
9. OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7) model documentation maintained for agents classified as models

---

## Additional Resources

- [Microsoft Learn: Purview Records Management](https://learn.microsoft.com/en-us/purview/records-management)
- [Microsoft Learn: Retention Labels and Policies](https://learn.microsoft.com/en-us/purview/retention)
- [Microsoft Learn: Auto-Apply Retention Labels](https://learn.microsoft.com/en-us/purview/apply-retention-labels-automatically)
- [Microsoft Learn: Azure Blob Immutable Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview)
- [Microsoft Learn: Microsoft Purview Audit (Standard and Premium)](https://learn.microsoft.com/en-us/purview/audit-solutions-overview)
- [Microsoft Learn: Power Platform Admin Center — Environments](https://learn.microsoft.com/en-us/power-platform/admin/environments-overview)
- [Microsoft Learn: Copilot Studio Agent Management](https://learn.microsoft.com/en-us/microsoft-copilot-studio/fundamentals-what-is-copilot-studio)
- [Microsoft Learn: Compliance Manager Assessments](https://learn.microsoft.com/en-us/purview/compliance-manager-assessments)
- [Microsoft Copilot Studio Kit — Agent Inventory accelerator (aka.ms/copilotstudiokit)](https://aka.ms/copilotstudiokit) — community accelerator that supplements Power Platform Admin Center inventory with a queryable Dataverse-backed Agent Inventory + Compliance Hub view. Useful as a supporting evidence aid for record-keeping; verify supportability before treating Kit reports as primary recordkeeping evidence under SEC 17a-4.
- [Microsoft Copilot Studio Kit — GitHub source](https://github.com/microsoft/Power-CAT-Copilot-Studio-Kit)
- [SEC Rule 17a-4 (eCFR)](https://www.ecfr.gov/current/title-17/section-240.17a-4)
- [NIST AI RMF 1.0](https://airc.nist.gov/Home)
- [NIST SP 800-53 Rev. 5 — AU Family (Audit and Accountability)](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
