Ask an AI tool whether you can use it to summarise a client call, and it will sound entirely sure of itself. It will talk about consent. It will talk about data protection, in general terms. Ask it a shade more casually, and it may hand you a ready-made prompt too.
What it will not do is name the FCA. Or the ICO. Or a single rule. Asked on two different framings of the same question, neither answer named a regulator. One named UK GDPR, hedged as "if you're in the UK or EU". The other named no law at all.
That is not a knowledge gap. Ask the same tool a follow-up, naming your country and your industry, and it finds its way to "FCA expectations" within a sentence. It can name the regulator. It will not do so until you already know enough to ask for it by name. The broker who does not know what to disclose never reaches that follow-up question.
So here is the rule each missing sentence should have named.
The summary is not a note. It is a file record. A firm must keep "orderly records... sufficient to enable the FCA to monitor the firm's compliance" (SYSC 9.1.1R). This applies to a firm that is not a common platform firm, which covers an ordinary mortgage, commercial finance or protection intermediary. Once an AI summary lands in the CRM, it inherits that obligation. It does not matter that a machine wrote the first draft.
Recording the call engages a real disclosure duty. Where personal data is collected from the data subject, the controller must provide certain information: who the controller is, the purpose of the processing, and how long the data will be kept, or the criteria used to decide (UK GDPR Article 13(1)). This does not apply where the client already has the information (Article 13(4)), so an existing privacy notice can do real work here. It does mean the duty is engaged by default, not a courtesy the AI tool's own "can help build trust" language suggests.
A protection call carries health data before the broker has done anything wrong. Health data is special category data (UK GDPR Article 9(1)). A protection conversation is about health from the first sentence, which puts Article 9 in play at the start of the call, not at some point the broker has to notice and flag.
The tool processing the call is a processor, and the contract is what matters. A controller "shall use only processors providing sufficient guarantees", governed by a contract (UK GDPR Article 28). It is the question neither answer actually settled: is the AI tool a processor acting for the firm, or something else? Neither engine got there.
None of this makes AI call summaries a problem to avoid. It makes them a file record with a named set of obligations attached, the same as any other note that ends up in a client's file. The one first step that follows directly from all four points above: before a summary is stored, a person reads it. Not as a courtesy, as where the accountability for what is written down actually lands.
The rest, what a full workflow for recording, disclosing and reviewing an AI call summary actually looks like inside a firm, is a longer conversation than one article, and it is the one we are building toward.