White paper for CCOs, Heads of Private Banking and COOs. Published 7 October 2026.

Recorded,Not Rated

Every wealth manager in Europe owns a dataset it has never read: years of recorded Client dialogue, kept because MiFID II says so. It can tell you which relationships are at risk and prove your advice matched what the Client said. The EU AI Act decides whether that reading is an asset or a high-risk system. This paper shows where the line runs.

Get the paper Read the one-page version

81%of next-generation inheritors plan to switch firms within one to two years of inheriting

41%of Relationship Manager time goes to operational tasks, not Clients

2 Dec 2027the day Annex III high-risk obligations apply

Sources: Capgemini World Wealth Report 2025 and 2026 press releases; Regulation (EU) 2026/1744.

Klein Family Office

42.000.000 EUR AUM, synthetic case

recorded communications, last 6 months

2026-03-04	Call, 14 min	Quarterly review
2026-03-04	Attendance	Lena Klein absent from quarterly call, third time running
2026-04-11	Email	Reporting pack sent
2026-05-02	Call, 22 min	Asks, for the second time: "what happens to the mandate after me"
2026-06-18	Meeting	Allocation discussion, minutes filed
2026-07-09	Email	Requests a liquidity plan for a property purchase. No follow-up on file.
2026-08-21	Email	Fee statement

78 to 54Health Score

Suitability prompt
Future financial commitment mentioned in dialogue, not on the profile.

Everyone records. Nobody understands. The archive you already keep can answer two questions, if you follow one rule: score the relationship, never the Relationship Manager.

Forty minutes of reading for the people who will have to defend the decision. Here is the one-page version.

The archive nobody readsMiFID II makes you record calls and messages that lead to transactions and keep them for five to seven years. In most firms the archive is a fire extinguisher: opened after a complaint, a dispute or a supervisory request. Nobody looks at it while the building is standing.

Two answers in one recordThe same dialogue shows whether a relationship is cooling (an heir who stops attending, a fee question asked twice) and whether the advice matched what the Client said. The first becomes a Health Score with every point traceable to its message. The second becomes a suitability prompt with the evidence attached.

The line, in the Commission's wordsAI that monitors and evaluates workers is high-risk under Annex III point 4(b). The Commission's draft examples put a tool that scores "responsiveness to emails" inside, and a tool that reports deviations only to the employee in charge outside. Build on the right side and the archive is an asset.

[01] One record, two answers

One record, two answers

The model in the paper, drawn once. Press a marker to read why each part is built the way it is. Nothing in the right-hand column is keyed to an employee.

Recorded Client dialogue

Already kept under MiFID II Article 16(7). Read with a documented legal basis.

Email and calendar (M365)
Calls with transcripts
Meeting notes and CRM (Salesforce)

One substrate

Statements dated and linked to their source message. Indicators keyed to the Client relationship.

What it must not become

A per-RM score, ranking or productivity figure. Hatched because it is drawn only to be ruled out.

Relationship health

A Health Score, 0 to 100, for the relationship. A meaningful drop becomes a Signal that goes first to the RM who owns it.

Suitability evidence

A gap between what the Client said and the profile on file becomes a prompt to update, with the evidence trail attached.

Start with any marker

Five short notes, one idea each: the legal basis for reading the archive, the unit of analysis, why no per-RM score exists, why the RM sees a Signal first, and what actually enters the suitability file.

Reading the archive needs its own legal basis

MiFID II recordings are processed under a legal obligation, for an evidential purpose. Reading them for suitability evidence sits close to that purpose and can pass a compatibility assessment. Reading them for relationship health is further away and needs legitimate interest, a balancing test and a DPIA. The GDPR question arrives before the AI Act one.

Paper, Section 5.6

The unit of analysis is the Client relationship

Every indicator, every score and every prompt is attached to a Client or household. No output is keyed to an employee identifier, so there is nothing to rank. That is rule A.1 of the standard, and it is the single design choice that most of the rest follows from.

Appendix A, rule A.1

Why the hatched box exists

The Commission's draft example of a law firm that aggregates "responsiveness to emails" into a score is inside Annex III point 4(b). The paper draws that outcome in order to rule it out: no per-RM ranking, league table, productivity score or trend, computed, stored or displayed. A human reviewing such a score does not change the classification.

Paper, Sections 5.2 and 5.4

Why the RM sees the Signal first

The Commission's courier example is outside 4(b) because the system informs only the employee in charge and supports the work rather than evaluating the worker. A Client Signal routed first to the RM who owns the relationship has the same shape. Management views aggregate at firm level; grouping by book is navigation, never comparison.

Paper, Section 5.2; Appendix A, rules A.4 and A.5

What enters the suitability file

The evidence trail, not the model's opinion: the dated statement, its source message, and the discrepancy with the profile, presented to the RM and, where the firm's procedure requires, to the control function, as a prompt to update under ESMA's suitability guidelines (¶54).

Paper, Sections 3 and 4

ONE RECORD → TWO ANSWERSDialogue ↓ Indicators ↓ Health Score → Signal to the RM
Dialogue ↓ Statement ↓ Profile gap → Prompt with evidence

[02] Where the line runs

Where the line runs

The European Commission's draft guidelines of 19 May 2026 contain two worked examples that could have been written for wealth management. Same kind of data, opposite outcome, and the difference is intended purpose.

Inside Annex III 4(b)

A law firm allocates work by behaviour

"The system ingests data on billing hours, turnaround times on prior assignments, responsiveness to emails, and voluntary participation in firm activities ... These behavioural inputs are aggregated into a score, which serves as a basis for the allocation of client matters."

Replace "associates" with "Relationship Managers" and "client matters" with "Clients", and you have the tool most RM dashboards quietly become.

Commission draft guidelines, AI Act Service Desk, employment examples

Outside Annex III 4(b)

A courier app notices a detour

"If the AI system detects deviations, it will inform only the employee in charge ... supporting workers in their tasks rather than evaluating workers' performance, the monitoring activity is incidental and falls outside the use case of point 4(b) of Annex III."

A Client Signal that goes first to the RM who owns the relationship has exactly this shape: it supports the work and leaves the decision with the person in charge.

Commission draft guidelines, AI Act Service Desk, employment examples

The guidelines are a draft and not binding; the final text is expected by the end of 2026. A human in the loop does not change the classification, and the paper explains why relying on the Article 6(3) filter is the weaker position.

[03] The RM-neutral standard

The RM-neutral standard

Seven design rules, published as an open proposal. Not a legal guarantee: a set of choices documented so that a supervisor, a staff delegation or a sceptical CCO can test them. Hand them to any vendor and ask for evidence.

The unit of analysis is the Client relationship, never the RM.

Every output is attached to a Client or household. No output is keyed to an employee.

No per-RM rankings, league tables or productivity scores.

None displayed, in any view.

Outputs never feed pay, promotion, task allocation or termination.

Written into the intended purpose and the marketing. The contract clause is being drafted.

Signals go first to the RM who owns the relationship.

The same "employee in charge" shape as the Commission's courier example.

Management views aggregate at firm level.

Grouping by book or team is navigation, never comparison.

No emotion recognition of employees.

No inference of RM stress, mood or engagement. Prohibited in the workplace anyway.

The intended purpose lives in a self-assessment file.

Under Article 6(3) and Annex III, versioned on every material change, open to supervisors.

[04] Five lines worth repeating

Five lines worth repeating

Click to copy. Use them in your next steering committee, with or without attribution.

2 Aug 2026

Article 50 transparency obligations apply.

2 Dec 2026

Marking of generated content for systems already on the market.

End 2026

Final Commission high-risk classification guidelines, announced.

2 Dec 2027

Annex III high-risk obligations, including 4(b), apply.

Mid 2029

Retail Investment Strategy expected to apply, 30 months after entry into force.

[05] The Luxembourg layer

The Luxembourg layer

The first regulator a Client-communications tool meets is not the CSSF. It is the firm's own staff delegation, with the CNPD one letter away. Three numbers from the Labour Code.

15 days

After the employer's prior information, the staff delegation may ask the CNPD for an opinion on the planned processing (Article L.261-1).

1 month

The CNPD's time to answer. The request has suspensive effect: nothing goes live while it is pending.

150 staff

From this size, installations that control employees' behaviour and performance need the delegation's agreement (Article L.414-9).

The paper includes a briefing template for the staff delegation, with the formal no-reuse commitment the law requires, and explains who will supervise AI in the financial sector once Bill 8476 is adopted.

Get the paper

Eleven sections and three appendices, about 40 minutes to read. Written for CCOs, Heads of Private Banking, COOs and Heads of Digital at private banks, family offices, EAMs and IFAs.

1The one-page version
2Clients follow people, and the people are stretched
3Recorded, never read: the evidence gap
4One record, two answers
5Where the AI Act draws the line, with the GDPR twin
6The RM-neutral standard
7The Luxembourg layer, and a note for Swiss readers
8What changes by 2029
9Ten questions to ask any vendor
10What to do this quarter, by role
ADesign standard, vendor checklist, staff delegation template

Ask for the PDF by email. A person replies with the paper.

Email me the paper

Opens your email app with a short request. We reply once, with the paper. No newsletter, no sequence. If you would also like a note when the final Commission guidelines land, say so in your email.

Or write to armin@luscent.io.

[06] Who wrote it

Who wrote it

Two founders with a commercial interest in the thesis, which the paper says in its own limits section.

Armin Prior

CEO and co-founder of Luscent. EFPA European Financial Advisor, former Head of HNW/Affluent at Swissquote Bank Europe, former family office adviser at Strategy&/PwC Luxembourg, co-author of an ANBIMA 2024 study on foreign investment into Brazil.

Dr. Frano Milos

Co-founder and Chief Science Officer of Luscent. Co-author of the RM-neutral design standard in Appendix A.

Frequently asked questions

The questions we hear first.

Is this paper legal advice?

No. It is general analysis by two founders with a commercial interest in the thesis. It separates the Commission's and regulators' own wording from law-firm commentary throughout, and says where the final guidelines, expected by the end of 2026, could move the line.

Does reading recorded communications make a firm a high-risk AI deployer?

Not by itself. Annex III point 4(b) turns on intended purpose: a system intended to monitor and evaluate workers is high-risk, a system intended to serve Clients whose view of the worker is incidental is not. The paper sets out seven design rules intended to keep a tool on the right side, and why a human in the loop does not change the answer.

What about GDPR? The recordings were made for MiFID II.

That is the question that arrives first. Recordings kept under a legal obligation cannot simply be reused. Suitability evidence sits close to the original purpose; relationship health needs its own basis, normally legitimate interest with a balancing test and a DPIA. Section 5.6 walks through both.

Why is there a Luxembourg chapter?

Because in Luxembourg the staff delegation can refer a monitoring project to the CNPD within 15 days, and that referral suspends deployment for up to a month. Firms with at least 150 employees also need the delegation's agreement for installations that control behaviour and performance. The paper includes a briefing template.

Is the Retail Investment Strategy already an obligation?

No. As of 7 October 2026 it awaits Parliament's plenary vote and publication in the Official Journal; the rules apply 30 months after entry into force, so around mid-2029. The paper treats it as a dated driver for roadmaps, nothing more.