FINRA AI Guidance (2026): What Broker-Dealers Must Control for Generative AI, Chatbots and AI Agents

Is there a FINRA AI rule? Regulatory Notice 24-09

No rule in the FINRA rulebook is written for artificial intelligence. The anchor document is Regulatory Notice 24-09, published on 27 June 2024 and titled “FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models”.

The notice makes three points:

• FINRA’s rules are intended to be technology neutral, so they apply to generative AI as they apply to any other technology or tool, whether the firm builds it or buys it, including AI features embedded in products the firm already uses.
• Which rules apply depends on how a firm deploys the technology, and nearly every area of a member’s obligations could be implicated.
• The notice creates no new legal or regulatory requirements and no new interpretations of existing ones.

It names two rules directly. Under Rule 3110, a firm that uses generative AI inside its supervisory system, for example to review electronic correspondence, should address technology governance, including model risk management, data privacy and integrity, and the reliability and accuracy of the model. Under Rule 2210, the content standards apply whether a human or a tool wrote the communication.

FINRA generative AI findings in the 2026 oversight report

FINRA published its 2026 Annual Regulatory Oversight Report in December 2025 and, for the first time, gave generative AI its own section. Its observations:

• Firms are adopting generative AI mainly for efficiency in internal processes and information retrieval. The most common use case FINRA saw was summarisation and information extraction.
• The leading risks are hallucination, meaning inaccurate output presented as fact, and bias from model design or limited or outdated data.
• Firms should weigh their compliance obligations before they test or deploy a tool, not after.

The effective practices FINRA lists read like an operating manual for an AI programme. They include formal review and approval of each use case by business and technology experts; a supervision, governance or model risk management framework; robust testing of privacy, integrity, reliability and accuracy before deployment; continuous monitoring of prompts, responses and outputs; storing prompt and output logs for accountability and troubleshooting, together with the model version and when it was used; human-in-the-loop review; and assessing generative AI risk at the firm and at its vendors within the cybersecurity programme, with a cross-reference to Regulatory Notice 21-29 on outsourcing to third parties.

FINRA frames these as considerations, not requirements. An examiner who asks how a firm supervises its AI tools will still expect to see most of them.

FINRA on AI agents: risks and the January 2026 observations

The same report separates AI agents from simpler generative AI. FINRA describes agents as systems that can complete tasks autonomously on a user’s behalf, and lists the risks that come with that autonomy:

For agents, the report suggests monitoring system access and data handling, defining where humans must check the work, tracking agent actions and decisions, and setting guardrails on behaviour.

On 27 January 2026 FINRA followed up with a blog post on AI agents by Greg Ruppert, its Chief Regulatory Operations Officer. Based on conversations with member firms, it lists six kinds of agents the industry is exploring: conversational agents, software development agents, fraud detection and prevention agents, trade and AML surveillance agents, process automation agents, and trade execution agents. It notes that agents lack tacit knowledge and may not have the predictability that traditional supervision assumes, and it states that it creates no new requirements.

In March 2026 FINRA added a resource on generative AI and prompt injection. Its central point for agent design: an attacker needs no intrusion when a model already has legitimate access to firm systems, because the model cannot reliably tell genuine instructions from malicious ones hidden in content it reads.

AI-generated communications: Rule 2210 and Regulatory Notice 26-14

Rule 2210 sorts written communications by audience. Correspondence goes to 25 or fewer retail investors within 30 calendar days; a retail communication goes to more than 25; an institutional communication goes only to institutional investors. Today a qualified registered principal must approve each retail communication before use, while correspondence falls under the review requirements of Rule 3110(b). Every category must be fair and balanced and must not omit material facts.

FINRA’s advertising FAQ applies this to AI in two answers. Chatbot output can be correspondence, retail or institutional, depending on the nature and number of people who receive it, and the firm must supervise it under Rules 2210 and 3110(b)(4). For AI-created communications, firms are responsible for their communications whether a person or an AI tool generated them, including the content standards and the FINRA and SEC recordkeeping requirements.

The rule may change. On 9 July 2026 FINRA published Regulatory Notice 26-14, which proposes replacing principal pre-use approval of retail communications with risk-based supervision. Firms would write procedures deciding which retail communications need pre-approval; where not every piece is reviewed before use, the procedures would need training, documented training, and surveillance with follow-up. FINRA says pre-approval is hard to apply to AI-generated content because of its speed and volume, and that AI communication tools can be part of a reasonably designed supervisory system if they are vetted, tested and monitored. The comment period closed on 11 September 2026. When we checked FINRA’s notice page on 22 October 2026, the change was still a proposal.

Supervision under Rule 3110 when AI writes or reviews

Rule 3110 requires a supervisory system and written procedures reasonably designed to achieve compliance with securities laws and FINRA rules. Rule 3110(b)(4) adds that a registered principal reviews correspondence and internal communications, with the review documented, scaled to the firm’s business, size, structure and customers.

AI touches this rule from two directions:

• AI as the supervised activity. An assistant that drafts client emails, or an agent that prepares account paperwork, is an activity of associated persons. The written supervisory procedures should name the tool, the permitted uses, who approves output, and how exceptions are escalated.
• AI as the supervisor. A model that ranks or filters correspondence for review becomes part of the supervisory system itself. Notice 24-09 expects governance of that model: tested recall on known violations, documented thresholds, change control when the model or prompt changes, and evidence that principals still review what the model flags.

Recordkeeping: prompts, outputs and SEA Rule 17a-4

Rule 4511 requires members to make and preserve the books and records required by FINRA rules and the Exchange Act, to keep FINRA-required records for at least six years where no other period is specified, and to store them in a format that complies with SEA Rule 17a-4.

For AI, the key provision is Rule 17a-4(b)(4): originals of communications received and copies of communications sent relating to the firm’s business as such, kept for three years, the first two in an easily accessible place. Rule 2210(b)(4) adds its own retention for retail and institutional communications, including who approved them and when they were first and last used.

Practical consequences:

• A chatbot’s replies to customers, and AI-drafted messages that are sent, are communications. Keep them with the rest of the firm’s correspondence.
• Prompts and intermediate drafts used only inside the firm are a judgement call under the rule. FINRA’s 2026 report lists prompt and output logs, with the model version, as an effective practice, which is a good reason to keep them on the same schedule.
• Electronic records must sit in a system that either keeps a complete, time-stamped audit trail of every change or stores records in a non-rewriteable, non-erasable format, verifies them automatically, and can export them with their audit trail.

Regulation S-P: compliance dates and AI vendors

The SEC adopted amendments to Regulation S-P on 15 May 2024. Larger entities had to comply by 3 December 2025 and smaller entities by 3 June 2026, so in October 2026 every broker-dealer is covered. The amendments require:

• a written incident response programme to detect, respond to and recover from unauthorised access to customer information;
• notice to affected individuals as soon as practicable and no later than 30 days after the firm becomes aware of unauthorised access to sensitive customer information, unless it determines the information is not reasonably likely to cause substantial harm or inconvenience;
• oversight of service providers through due diligence and monitoring, with providers required to notify the firm within 72 hours of a breach affecting customer information;
• written records documenting compliance with the safeguards and disposal rules.

An AI vendor that receives customer data in prompts or retrieval indexes is a service provider for this purpose. Its contract, notification terms and data retention need the same scrutiny as any other provider’s.

The SEC side: a withdrawn proposal and the 2026 exam priorities

In July 2023 the SEC proposed rules on conflicts of interest from predictive data analytics used by broker-dealers and investment advisers. On 12 June 2025 it withdrew that proposal along with other pending rulemakings, and said it would publish a new proposal if it revisited the subject. There is no SEC rule aimed at AI conflicts in October 2026; Regulation Best Interest and existing anti-fraud provisions still govern recommendations, whatever tool produces them.

The SEC Division of Examinations’ fiscal 2026 priorities, released in November 2025, are more specific. Examiners will check firms’ representations about their AI capabilities for accuracy, and assess whether firms have adequate policies and procedures to monitor or supervise their use of AI, including for fraud prevention and detection, back-office operations, AML and trading. They will also look at how firms address new cybersecurity risks associated with AI.

FINRA AI governance checklist for assistants and agents

Why on-premises logging and retention help

Most of the controls above come down to one question an examiner can ask: show me what the AI did. That means the prompt, the documents it retrieved, the model and version, the tools it called, the output, and the person who approved it, kept for the right period and retrievable on request.

When the model and its logs run on a vendor’s service, the firm depends on that vendor’s log granularity, retention period and export format, and every prompt that contains customer data is a disclosure to a service provider under Reg S-P. When the model, retrieval index and audit log run on the firm’s own infrastructure, the records sit in storage the firm already governs, under its existing 17a-4 arrangements and retention schedule. Customer information and MNPI stay inside the firm’s information barriers, and a model version only changes when the firm’s change process approves it, which keeps testing evidence valid.

This article summarises public FINRA and SEC material and is not legal advice.

How VDF AI fits a broker-dealer’s supervisory system

VDF AI is installed on a firm’s own servers, on-premises, in a private cloud or air-gapped, so the models, retrieval indexes, conversation history and audit logs stay in the firm’s environment. VDF AI has no FINRA or SEC approval of its own; it operates within the firm’s supervisory system, WSPs and recordkeeping arrangements.

Mapped to the checklist: retrieval is filtered by each user’s source permissions, which supports information barriers between research, banking and sales. Agents get per-role tool grants and can pause at a human approval step before a message goes to a client or a case is closed, which answers FINRA’s autonomy and scope concerns. Every turn writes an append-only record of the user, agent, model version, retrieved passages and tool calls that can be exported to a SIEM or archive. VDF AI Router restricts regulated workloads to approved models and can keep every request on local models.

For workflows already mapped for financial firms, see the finance and banking solution, the banking agents catalogue, the AML, KYC and trade surveillance use case, the governed KYC and AML investigation architecture and the financial services executive brief.