Suitability Documentation: From Meeting to Audit Record
The suitability problem is almost never that the advice was unsuitable. It is that the reasoning was sound, was spoken aloud, and was never written down in a form anyone can retrieve two years later.
What a defensible record contains
The client's circumstances as known at the time, the recommendation, the reasoning linking them, the alternatives considered, and the date it was written.
The element most often missing is the reasoning. Files tend to record decisions — the allocation, the product, the change — while the analysis that justified the decision stays in the advisor's head or in a conversation nobody transcribed.
Where the gap opens
Between the conversation and the file, and it opens for practical reasons rather than negligent ones.
The reasoning is richest during the meeting and decays immediately afterwards. Documentation happens later, usually at the end of a day containing several other meetings. What gets written is the conclusion, because the conclusion is what survives the gap.
That is a workflow problem presenting as a compliance problem, which is why compliance training rarely fixes it. Advisors who know exactly what a good file contains still produce thin ones, because the moment when the reasoning was available has passed.
Why 2026 raises the stakes
Because AI is now in the documentation path, and that makes the resulting record examinable on two fronts rather than one.
If AI drafts the suitability note, the note is subject to the supervision expectations described in the FINRA 2026 Annual Regulatory Oversight Report, and the draft itself may be a record under the analysis in Cooley's treatment of Rule 204-2. A firm gains documentation quality and acquires a model governance obligation in the same step.
The control that makes this work is the same one the survey data shows is missing. In the 2026 compliance testing survey reported by InvestmentNews, 37% of firms had procedures to test or validate AI outputs before client delivery. An AI-drafted suitability note that no one verified is a worse record than a thin human one, because it reads as thorough while being unverified.
What good looks like
- Contemporaneous. Written close enough to the conversation to reflect it accurately.
- Reasoned. States why, not only what.
- Specific to the client. Names the circumstances that drove the recommendation. Template language documents a template, not a client.
- Honest about alternatives. Records what else was considered and why it was not chosen.
- Attributed. Shows who made the recommendation and who reviewed the record.
- Retrievable. Producible by client and date range without manual reconstruction.
The AI-drafted variant
Where AI produces the first draft, three additional things belong in the record: what the model produced, who reviewed it, and what they changed.
The edit history is the evidence of supervision. A record showing that a human received a draft, corrected two facts and approved it demonstrates the human-in-the-loop control operating. A record showing only a finished note demonstrates nothing about how it was made.
Where the firm can also capture model version, the record supports the attribution expectation described in the FINRA report — the subject of our note on model version tracking and prompt logging.
Common questions
What makes a suitability record defensible?
It captures the client circumstances known at the time, the recommendation made, the reasoning connecting the two, the alternatives considered, and the date — written close enough to the conversation that it reflects what was actually discussed rather than what was reconstructed later.
Why do suitability files fail at review?
Usually because they record the outcome without the reasoning. A file showing what was recommended, with no contemporaneous record of why, cannot demonstrate that the recommendation was suitable at the time it was made.
Sources
This page is published for information. It is not legal advice, and it does not establish an adviser-client or attorney-client relationship. Regulatory obligations turn on a firm's own facts — take any question that matters to your compliance counsel. Where a claim here comes from a secondary analysis rather than a regulator's own words, we have said so in the text.