Not every AI conversation is a record. Sort them into three classes before your retention policy does it badly

This week Google Vault began exporting Gemini conversations from Gmail, Docs and Meet for eDiscovery. Microsoft’s Purview already applies retention policies to Copilot interactions and to some third-party AI apps. In both suites, the conversation an employee has with an AI assistant is now content that a compliance team can search, hold and hand over.

Most companies have not decided what those conversations are. Two instincts compete, and both are wrong. Legal wants to keep everything, because deleting a relevant record is worse than storing an irrelevant one. Privacy wants to keep as little as possible, because a prompt can contain anything an employee happened to paste. Keep everything and the company accumulates years of sensitive, unreviewed text. Delete everything and it loses the one conversation that explains a decision.

Our view, and it is a view rather than a settled practice, is that AI conversations should be sorted the way companies already sort other communication: by what they are used for, not by the tool that produced them.

Three classes

Three classes of AI conversation, three retention rules

Personal productivity

• Drafting, summarizing, rephrasing
• No external commitment

Short retention, minimize, user may delete

Business communication

• Replies to customers or suppliers
• Internal advice others act on

Same rules as email and chat

Decision support in regulated work

• Input to a credit, safety, legal or quality decision
• Model, version and sources recorded

Retained as part of the decision record

Personal productivity. Rewriting a paragraph, summarizing a long thread for oneself, brainstorming. Nothing leaves the employee as a commitment. These conversations deserve the shortest retention the law allows, minimization by default, and the user’s ability to delete. Keeping them for years creates risk without value.

Business communication. When the assistant drafts the reply that goes to a customer, or produces advice a colleague acts on, the output is a business communication and should follow the same rules as email or chat. In financial services this is not a new idea: FINRA’s Regulatory Notice 24-09 reminded member firms in 2024 that its rules, including those on communications and supervision, are technology neutral and continue to apply when firms use generative AI. The tool changed; the obligation did not.

Decision support in regulated work. When an AI output feeds a decision a regulator may examine, such as a credit assessment, a quality investigation, a pharmacovigilance case or a legal review, the conversation is part of the decision record. It needs more than the text: which model and version answered, which sources it used, and who decided what. Microsoft’s legal team required exactly that for its discovery agent, demanding reasoning that is “reproducible and explainable” and tied to the documents. In life sciences, systems that hold GxP electronic records already require secure, time-stamped audit trails under rules such as the FDA’s 21 CFR Part 11. An AI conversation that shapes such a record should be held to the same standard.

Why the class has to follow the use

The same Gemini in Gmail can do all three in one morning. That is why retention cannot be configured per tool, the way most companies configured email and chat. It has to be inferred from context: the user’s role, the application, the destination of the output, or an explicit action such as attaching the conversation to a case.

In practice that means two mechanisms:

• A default by role. Conversations by people in legal, finance, clinical, quality or regulated client-facing roles start in a longer retention class. Everyone else starts in the short one.
• A promotion step. When an output is used in a regulated decision, the system that records the decision captures the conversation, with model, version and sources. The workflow, not the chat tool, is responsible for keeping it.

The second mechanism matters more. A regulated decision should not depend on whether a chat log survived; it should carry its own evidence. This is the same principle we apply to proof in regulated AI: the record lives with the decision, outside the model.

What to settle this quarter

1. Add AI interactions to the retention schedule with the three classes, and name an owner for each.
2. Check the platform defaults: is conversation history on, how long is it kept, can users delete it, and are holds possible? Google’s holds for Gemini in Workspace are still to come.
3. Define the promotion step for each regulated workflow that uses AI, and test that the record includes the model version and sources.
4. Tell employees what is kept and why. People write differently when they know a conversation may be read later. That is a feature in regulated work.
5. Revisit the classes when agents act on their own. An agent that sends, approves or files is producing business records continuously; its logs belong in the second or third class by default.

Every new communication channel has gone through this: email, instant messaging, mobile messaging. AI conversations are the next one, and the companies that classify them early will spend less time arguing about them in front of a regulator.