Broker-Dealers, Supervision, and the Rule That AI Does Not Change
The one-paragraph answer
FINRA AI compliance is not a separate rule set. FINRA has not issued an AI rule, and its Regulatory Notices, its Report on AI in the Securities Industry (June 2024), and its August 2025 update all say the same thing: existing rules already apply. What that means in practice is that a broker-dealer using AI for recommendations, communications, surveillance, or research must supervise it under Rule 3110, must keep the records to reconstruct it under Rule 4511, must satisfy Reg BI's Care Obligation when the output reaches a retail customer, and must ensure any AI-generated content that touches customers meets Rules 2210 and 2220. The uncomfortable implication, and the one this page is written around, is that a firm that cannot explain why its AI reached a specific output cannot lawfully use that AI to serve retail customers. There is no AI carve-out from the suitability, fair-dealing, or supervision framework.
A broker-dealer deploys an AI research summarizer. A licensed representative uses its output to shape a recommendation to a retail customer. Six months later, an examiner asks how that recommendation was formed. The firm cannot answer: it can produce the prompt, but not the model version, not the training corpus, not the retrieval documents, and not the reasoning path. The exam findings write themselves. Rule 3110 requires that a firm supervise its associated persons' securities business, and "we do not know how our AI produced that" is not a supervision posture.
The same firm has an AI marketing assistant generating LinkedIn posts about a private placement. Rule 2210 requires those communications to be fair, balanced, and approved by a registered principal before use. The AI drafted six variants, the principal approved three, the assistant sent four. The one that went out unreviewed contained a promissory statement the principal would have redlined. That is a Rule 2210 violation and a Rule 3110 supervisory failure in the same incident.
FINRA has published guidance repeatedly, always saying the same thing. AI is not a category exempt from existing rules; it is a new medium through which existing rules attach.
The most cited piece is Regulatory Notice 24-09 (June 2024), a report on AI in the securities industry that describes deployment patterns across surveillance, research, communications, and customer-facing tools, and then walks through the FINRA rules those deployments touch. The 2025 update reiterated the position. Regulatory Notice 21-29 addressed communications with the public and made clear that Rule 2210 applies whether a communication was written by a person or by a model.
What FINRA has not done is issue a Rule 3110-style AI rule. It has been asked to. It has declined. The reason is captured in the same notices: the existing framework already reaches AI, and adding a parallel rule would create dueling standards without closing any gap.
Rule 3110 requires each broker-dealer to establish and maintain a supervisory system reasonably designed to achieve compliance with applicable rules. For an AI system, that means written supervisory procedures covering: (a) which AI tools are permitted for which business functions, (b) who reviews their outputs before those outputs reach a customer, (c) how the firm identifies when an AI has produced a policy-violating result, and (d) how the firm evidences that supervision to an examiner. A firm cannot supervise what it cannot inspect. If the vendor will not disclose model version, training-data lineage, or reasoning traces, the firm has to either not use that tool for supervised activities or find a vendor that will.
Rule 4511 and SEC Rule 17a-4 require broker-dealers to preserve records that document their business. An AI-generated recommendation is a business record. So are the inputs that produced it. "The prompt and the output" is the minimum; the model version and the retrieval context are what a reconstruction actually needs. Records must be preserved for the applicable retention period in a non-erasable, non-rewritable form. That is not a metaphor. Ephemeral chat logs do not satisfy it.
When an AI output shapes a recommendation to a retail customer, Reg BI's Care Obligation attaches. The firm must have a reasonable basis to believe the recommendation is in the customer's best interest based on their investment profile. If the AI's reasoning cannot be explained, the firm cannot show it exercised care. "The model said so" is not diligence. This is where the SEC and FINRA are aligning their enforcement posture.
Any AI-generated content that reaches a retail investor is a communication with the public and must be fair, balanced, and pre-reviewed by a qualified principal. The volume that AI enables makes this harder, not easier: 100 personalized emails a week times 52 weeks is 5,200 pieces of communication that a principal must be able to demonstrate approval over. Firms that deploy AI-generated communications without scaling their principal review capacity are building a Rule 2210 violation into their workflow.
The enforcement pattern is legible. FINRA does not need a new rule to bring an AI case. It needs a supervisory failure, a books-and-records gap, a Reg BI care-obligation defect, or an unreviewed communication, all of which already exist in the rulebook. Every AI deployment that runs without written supervisory procedures, without reconstructable records, without care-obligation documentation, and without principal review is a set of pre-formed enforcement cases waiting for a triggering event.
The 2024 report was polite about this. The 2025 update was less polite. The examinations that ran in 2026 have not been polite at all: they are asking firms to produce their AI inventory, their governance policies, and their supervisory review evidence, and firms that cannot produce these documents are receiving deficiency letters that read like standard 3110 findings with the word "AI" inserted.
Effective and manageable AI/ML in production requires a risk-based governance and testing framework, because model risk in financial institutions extends beyond simple rules-based approaches to increasingly sophisticated AI/ML models across credit, insurance, and other financial risk types.
That is the operating condition FINRA supervision has to meet: not oversight of a static tool, but ongoing governance of a system that changes when the vendor updates it, changes when the retrieval corpus is refreshed, and can change for a single customer when a personalisation layer routes them to a different prompt.
The SEC and FINRA have significantly increased their Regulation Best Interest enforcement efforts, and broker-dealers must build compliance programmes that address AI use directly rather than treating it as a technology question separate from the care obligation.
No. Its stated position is that existing rules already apply. Regulatory Notices 24-09 and 21-29, plus the June 2024 AI report and its 2025 update, are guidance on how existing rules attach to AI use. There is no separate AI Rule.
Not without accepting the Rule 3110 exposure. If the vendor will not disclose model version, reasoning, or training-data lineage sufficient for the firm to supervise the output, the firm cannot supervise the tool. That is not a technical constraint; it is a rule constraint. Either the vendor supports supervision or the tool is inappropriate for supervised use.
Yes. The rule attaches to the communication sent to the public, regardless of how it was drafted. A principal must approve before use, and the approval must be evidenced. AI does not shift the approval requirement, and "the AI drafted it" is not a defence to an unreviewed communication.
The AI Vendor Tier Map, AI Data Flow Map, and Model Card evidence from Volume V produce exactly the documentation Rule 3110 supervision and Rule 4511 records require: which vendor produces which output, on which model version, with which retention posture, under which review chain.
The AI Business Enablement Audit™ measures your organization against every framework in this library, including FINRA and AI, and delivers a defensible governance dossier. Start or finish your audit below.
Start or finish your AI Audit →