FINRA has not written a separate rulebook for generative AI. Its guidance says the opposite: the rules a broker-dealer already follows apply when a chatbot answers a customer, a model drafts a marketing email or a tool summarizes flagged messages for compliance staff. For a team building those features, the useful question is which existing rule each output falls under, and what supervision has to exist before it ships.

This explainer walks through FINRA’s generative AI guidance as of October 2026: the 2024 regulatory notice, the advertising FAQs on chatbots and AI-created content, the 2026 oversight report and a pending proposal to change how retail communications are approved.

Regulatory Notice 24-09: technology-neutral rules

FINRA published Regulatory Notice 24-09 on June 27, 2024. It reminds member firms that FINRA’s rules are intended to be technology neutral and continue to apply when firms use generative AI or large language models, just as they apply to any other tool. The notice states that it does not create new legal or regulatory requirements or new interpretations.

Its main example is supervision. Under Rule 3110, a firm needs a reasonably designed supervisory system tailored to its business. If generative AI becomes part of that system, for instance in reviewing electronic correspondence, the notice says the firm’s policies and procedures should address technology governance, including model risk management, data privacy and integrity, and the reliability and accuracy of the model.

Two further points matter for product teams. The rules apply whether a firm builds a tool itself or uses a third party’s technology, including AI features embedded in products it already licenses. And a firm should evaluate a generative AI tool before deploying it, to confirm it can still comply with the rules that govern that business use. FINRA invites firms that find the rules ambiguous for a specific use to request interpretive guidance.

Chatbots and AI-written content: the communications rules

FINRA’s advertising regulation FAQ added two answers on May 10, 2024. Question D.8 says firms are responsible for their communications whether a person or AI technology generated them. That covers supervision, FINRA and SEC recordkeeping, and the content standards of Rules 2210 and 2220, which require communications to be fair and balanced and prohibit false, misleading, promissory or exaggerated claims.

Question B.4 covers chatbots used with investors. Depending on the nature and number of recipients, chatbot output may be correspondence, a retail communication or an institutional communication, and the firm must supervise it under the matching rules. A footnote adds that if a broker-dealer uses AI to recommend a securities transaction or strategy to a retail customer, Regulation Best Interest applies.

The category decides the review process. Rule 2210 defines correspondence as a written or electronic communication distributed to 25 or fewer retail investors within any 30-calendar-day period, and a retail communication as one that reaches more than 25. An appropriately qualified registered principal must approve each retail communication before the earlier of its use or filing with FINRA. Correspondence instead falls under the Rule 3110 review procedures, which do not require review of every item before it goes out. The rule also excepts retail communications that make no financial or investment recommendation and do not promote the firm’s products or services from pre-use approval, provided they are supervised like correspondence.

Take a hypothetical. A firm’s model drafts one-to-one replies to customer questions about account features, and the same model drafts a newsletter for 4,000 retail customers that mentions the firm’s managed portfolios. Under the current rule the replies are correspondence, while the newsletter is a retail communication that needs principal approval before it goes out. The model is the same; the supervision is not.

The 2026 oversight report: testing, logs and agents

FINRA’s 2026 Annual Regulatory Oversight Report, published December 9, 2025, added a section on generative AI. FINRA reports that firms have mostly implemented generative AI for efficiency in internal processes and information retrieval, and that the top use case is summarization and information extraction from unstructured documents.

The report lists practices firms may consider. They include formal review and approval of generative AI uses, a supervision, governance or model risk framework with documentation, and testing for privacy, integrity, reliability and accuracy. For monitoring, it mentions storing prompt and output logs, tracking which model version was used and when, and human review of outputs. It names hallucinations and bias as accuracy risks, the same failure our explainer on LLM structured outputs covers for financial data extraction.

The report also addresses AI agents, systems that can plan and act on a user’s behalf. FINRA flags risks around autonomy without human validation, agents acting beyond their intended scope and authority, multi-step reasoning that is hard to audit, handling of sensitive data, missing domain knowledge and poorly designed reward functions. A January 2026 FINRA blog post on AI agents expands on those observations. For bank-side model governance, see our explainer on SR 26-2.

Regulatory Notice 26-14: a proposal, not yet a rule

On July 9, 2026, FINRA requested comment in Regulatory Notice 26-14 on a proposal to modernize Rule 2210. It would replace the principal pre-use approval requirement with risk-based standards for supervising retail communications. FINRA says applying pre-use approval to AI-generated retail communications can be challenging, compounded by their potential speed and volume.

Under the proposal, firms would still need written procedures for review of retail communications by a qualified principal, but could decide which communications need pre-use approval based on risk. The content standards would not change. The notice also says generative AI communication tools can be part of a reasonably designed supervisory system if they are vetted, tested and monitored.

The comment period ended September 11, 2026. As of October 22, 2026, FINRA’s rule filings page did not show a filing with the SEC for this proposal; the only 2026 Rule 2210 filing listed there concerns performance projections. Until a change is filed and approved, the current approval requirement stands.

A short build checklist

These are editorial suggestions drawn from the documents above, not a FINRA form:

  • Classify each AI output by audience before launch: correspondence, retail, institutional or internal.
  • Route retail communications that recommend or promote through principal approval under today’s rule.
  • Keep prompts, outputs and model versions retrievable for supervision and recordkeeping.
  • Test vendor-embedded AI features as you would your own, and record the results.
  • Treat customer-supplied text as untrusted input; our analysis of prompt injection defenses explains why.