But the absence of an AI rulebook does not mean firms can wait for regulators to provide one. Enforcement has also begun without regulators adopting new AI rules. Some firms therefore apply full regulatory retention periods to AI records connected with communications, recommendations and supervisory reviews while using shorter periods for lower-risk operational information. Employees using unapproved AI platforms for client-related work could similarly create records beyond their firm’s ability to capture or supervise. Derek Stern, head of global distribution compliance at Manulife Wealth & Asset Management, said firms should involve compliance teams while AI systems are being designed rather than after deployment.