FINRA on generative AI: Regulatory Notice 24-09 and the 2026 oversight report

Who FINRA's guidance applies to

FINRA regulates its member firms, which are broker-dealers, and their registered representatives. Its rules don't apply to a standalone registered investment adviser as such. If you're dually registered, FINRA's rules cover your brokerage business and the SEC's adviser rules cover your advisory business, so the same AI tool can sit under both sets of obligations. RIA-only firms can still read FINRA's material as a useful view of where regulators' thinking is going, but it isn't binding on them.

What Regulatory Notice 24-09 says

FINRA published Regulatory Notice 24-09 on June 27, 2024. Its core message is that FINRA's rules, "which are intended to be technology neutral," and the securities laws generally keep applying when member firms use generative AI, "just as they apply when member firms use any other technology or tool."

The notice is explicit that it "does not create new legal or regulatory requirements or new interpretations of existing requirements." In other words, it's a reminder, not a new rule. Three points in it matter most for day-to-day AI use:

• Supervision. Under Rule 3110, a member firm must have a reasonably designed supervisory system tailored to its business. If a firm uses generative AI as part of that system (FINRA's example is reviewing electronic correspondence), its policies and procedures should address technology governance, including model risk management, data privacy and integrity, and the reliability and accuracy of the AI model.
• Third-party tools count. FINRA's rules apply whether a firm builds its own AI tools or uses a third party's, including features embedded in existing products.
• Evaluate before you deploy. A firm should evaluate generative AI tools before deploying them and make sure it can still comply with the rules that apply to how it uses them. FINRA notes that, depending on how a firm uses it, generative AI could touch "virtually every area" of its regulatory obligations.

AI-written communications and Rule 2210

Rule 2210 governs communications with the public. Notice 24-09 points to FINRA's existing guidance that the content standards of Rule 2210 apply whether a communication is generated by a person or a technology tool. FINRA's advertising regulation FAQs cover this in two questions the 2026 report cites: B.4 on supervising chatbot communications and D.8 on AI-created communications.

In practice that means an AI-drafted market commentary, social post or client email goes through the same approval and review process as one a person wrote. The tool doesn't change the category of the communication or who is responsible for it. Our Marketing Rule guide covers the adviser side of the same question.

What the 2026 oversight report's GenAI section says

FINRA's 2026 Annual Regulatory Oversight Report, published December 9, 2025, has a section marked "new for 2026" called GenAI: Continuing and Emerging Trends. It repeats the technology-neutral point and says generative AI "can implicate rules regarding supervision, communications, recordkeeping and fair dealing."

On what firms are doing, FINRA says firms have started implementing generative AI with a focus on efficiency, especially internal processes and information retrieval, and that the top use case among member firms is "Summarization and Information Extraction." That fits what we see in advisory practices, where notetakers and document summarizers lead adoption.

The report then lists things firms "may want to consider." These are FINRA's suggestions, not rule text, but they're a good outline for a supervisory program:

• Supervisory processes for developing and using generative AI at an enterprise level.
• Ways to identify and reduce risks such as accuracy (hallucinations) and bias.
• Whether the cybersecurity program covers risks from the firm's and its vendors' use of generative AI, and how threat actors may use AI against the firm or its customers.
• Formal review and approval processes that include both business and technology experts.
• A supervision, governance or model risk management framework with clear policies and documentation.
• Testing for areas such as privacy, integrity, reliability and accuracy.
• Ongoing monitoring of prompts, responses and outputs, which may include "storing prompt and output logs for accountability and troubleshooting," tracking which model version was used and when, and human review of outputs.

AI agents: FINRA's newest concern

The 2026 report also covers AI agents, which FINRA describes as systems that can autonomously perform and complete tasks on a user's behalf. It lists risks including agents acting without human validation, acting beyond the user's intended scope and authority, multi-step reasoning that's hard to audit, and agents that may "unintentionally store, explore, disclose or misuse" sensitive information.

FINRA suggests firms exploring agents consider how to monitor agent system access and data handling, where to keep a human in the loop, how to track agent actions and decisions, and how to set guardrails that limit what an agent can do. If a vendor pitches an AI that sends emails, updates the CRM or places tickets on its own, those are the questions to ask before you turn it on.

Recordkeeping and vendor management

Recordkeeping is one of the areas the 2026 report says generative AI can implicate. For broker-dealers that means FINRA Rule 4511 and SEA Rule 17a-4. Whether a given AI output is a required record depends on what it is and how it's used; our recordkeeping guide walks through notetaker transcripts, summaries and chatbot logs in detail, so we won't repeat it here.

On vendors, FINRA's Regulatory Notice 21-29 (August 13, 2021) reminds member firms that outsourcing an activity or function to a third party doesn't relieve them of their supervisory obligations. That applies to AI vendors as much as any other. If the vendor handles customer information, amended Regulation S-P adds specific service-provider oversight duties; see Regulation S-P and AI vendors.

What this means for broker-dealers and dually registered reps

For a firm, the takeaway is that AI goes through the processes you already have: supervisory procedures, communications review, books and records, vendor management and cybersecurity. What FINRA expects is that you've thought about how each one changes when a tool generates the content or does the work. A short written assessment per tool, kept with your supervisory procedures, is a practical way to show that.

For an individual rep, the takeaway is to use only firm-approved tools for firm business, treat AI-drafted client communications exactly like ones you wrote, and expect your firm to keep and review what goes in and out. If you're dually registered, check that your firm's AI policy covers both hats, since an RIA-side tool used for a brokerage client brings FINRA's rules along with it.

FINRA also invites engagement. Notice 24-09 says firms that find the rules ambiguous for a specific AI use can seek interpretive guidance, and encourages ongoing conversations with their Risk Monitoring Analyst.