← Back to Blog
Technology & Cybersecurity by Loffa Interactive Group

Using Generative AI at a Broker-Dealer: What FINRA and the SEC Expect

AI drives the market

Updated October 2026. First published March 2024. The original was a pep talk for operations staff about automation; this version covers the rules that apply when a broker-dealer puts generative AI to work.

As of October 2026, no rule written specifically for AI applies to broker-dealers. The SEC proposed a rule on predictive data analytics in 2023 and withdrew it in 2025. The rules that apply are the existing ones on supervision, communications, recordkeeping, and vendor oversight, all written before generative AI arrived. FINRA has said in writing how it reads those rules for generative AI, and its December 2025 oversight report adds detail.

FINRA: The Rules Are Technology-Neutral

FINRA set out its position in Regulatory Notice 24-09 on June 27, 2024. Its rules are "intended to be technology neutral," and they apply to generative AI the way they apply to any other tool. That holds whether the firm builds the tool or a vendor adds it to a product the firm already uses. The Notice creates no new requirements. It names two rules:

  • Rule 3110. A firm must have "a reasonably designed supervisory system tailored to its business." If the firm uses generative AI inside that system, for example to review electronic correspondence, its procedures should address model risk management, data privacy and integrity, and the reliability and accuracy of the model.
  • Rule 2210. The content standards for communications apply whether a person or a tool wrote the communication.

The Notice also says generative AI "could implicate virtually every area of a member firm's regulatory obligations." Firms with unclear cases can ask FINRA for interpretive guidance or raise them with their Risk Monitoring Analyst.

What FINRA Has Seen at Firms

FINRA's 2026 Annual Regulatory Oversight Report, published December 9, 2025, gave generative AI its own section, marked new for 2026. Firms are using it mostly for internal efficiency and information retrieval, and the top use case is summarization and information extraction. The report lists what firms may want to consider before and after deployment:

  • a formal review and approval process for each use, with both business and technology experts involved;
  • a supervision, governance, or model risk management framework, with documentation kept throughout;
  • testing for privacy, integrity, reliability, and accuracy;
  • ongoing monitoring of prompts, responses, and outputs, which may include storing prompt and output logs, tracking which model version was used and when, and human review of outputs;
  • a cybersecurity program that covers both the firm's and its vendors' use of generative AI.

The same section covers AI agents, which carry out tasks on their own. FINRA's list of agent risks starts with agents acting "without human validation and approval," agents acting beyond the user's intended scope and authority, and multi-step reasoning that's hard to trace afterward. For any agent that can touch customer accounts or settlement data, those are the first three questions to answer.

The SEC: One Proposal Withdrawn, Cases Under Existing Law

On July 26, 2023, the SEC proposed rules on conflicts of interest from predictive data analytics. Broker-dealers and advisers would have had to eliminate or neutralize the effect of conflicts when their use of "covered technologies" in investor interactions put the firm's interest ahead of the investor's. On June 12, 2025, the Commission withdrew the proposal along with 13 others. It said it doesn't intend to adopt final rules on them, and any future action would start with a new proposal.

The SEC hasn't needed an AI rule to bring AI cases. On March 18, 2024, it settled with two investment advisers, Delphia (USA) and Global Predictions, over claims about AI capabilities they didn't have. Delphia paid $225,000 and Global Predictions $175,000, mainly under the Advisers Act Marketing Rule. For a broker-dealer, the matching rule is FINRA Rule 2210: what your firm says publicly about its AI is a communication, and it has to be accurate.

Records

The question most firms are still working through is what to keep. FINRA's report suggests storing prompt and output logs for accountability and troubleshooting. SEC Rule 17a-4(b)(4) already requires a broker-dealer to keep the business communications it sends and receives for three years, the first two in an easily accessible place. A message that a tool drafts and your firm sends to a customer is a communication like any other. Whether internal prompts are records depends on what they contain and how they're used. Decide that with counsel and write it into your procedures. The tool's default retention setting shouldn't make the decision for you.

What to Put in Place

  1. An inventory of every generative AI use, including AI features that vendors have switched on inside products you already license.
  2. A written approval for each use that names who supervises it under Rule 3110.
  3. Test results kept with the approval, plus a record of model versions and when each one ran.
  4. A written decision on which prompts and outputs you keep and for how long, and the system that holds them.
  5. A Rule 2210 review of every public statement about your firm's use of AI.

Security is a separate question from these rules. For the attacks that target document-reading AI tools, such as prompt injection, see our post on AI security for operations teams.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.

← All Posts