FINRA’s 2026 Annual Regulatory Oversight Report includes a dedicated generative AI section for the first time. It doesn’t introduce new rules, but it clarifies what existing rules \u2014 particularly Rule 3110 (Supervision) \u2014 mean for firms using AI tools. Small broker-dealers need written policies, audit trails, vendor oversight, and procedures to catch AI-generated inaccuracies. Here’s what to prioritise.<\/p>\n
FINRA’s 2026 Annual Regulatory Oversight Report added generative AI as a standalone topic for the first time. The report doesn’t create new rules. Instead, it tells firms how existing supervisory obligations apply to AI tools \u2014 and signals what examiners will be asking about.<\/p>\n
The core message: if your firm uses generative AI, your supervisory system under Rule 3110 must cover that use. This includes AI tools the firm deploys officially and tools employees may be using independently.<\/p>\n
FINRA specifically states that firms should establish “clear policies and procedures to develop, implement, use and monitor GenAI, while maintaining comprehensive documentation throughout.”<\/p>\n
For small broker-dealers without dedicated compliance teams, this creates a clear to-do list.<\/p>\n
FINRA Rule 3110 requires every broker-dealer to have a supervisory system that is “reasonably designed” and “tailored to its business.” This isn’t new. What’s new is that FINRA is explicitly saying AI use falls within the scope of what that supervisory system must cover.<\/p>\n
In practice, this means three things for small firms:<\/p>\n
Your written supervisory procedures (WSPs) need to address how AI tools are selected, approved, used, and monitored. If your WSPs don’t mention AI, there’s a gap.<\/p>\n
Someone at the firm needs to be responsible for overseeing AI use. At a small broker-dealer, this is likely the same principal who handles other compliance oversight.<\/p>\n
You need records showing what AI tools are in use, how they’re being used, and what review processes are in place. “We trust our advisors to be careful” isn’t documentation.<\/p>\n
The 2026 report calls out several risks that examiners may focus on:<\/p>\n
FINRA explicitly defines AI hallucinations as instances where the model “generates information that is inaccurate or misleading, yet is presented as factual information.” The report notes that this can lead to “misrepresentation or incorrect interpretation of rules, regulations or policies or inaccurate client or market data” that “can impact decision making.”<\/p>\n
What this means for your firm:<\/strong>\u00a0If an advisor uses AI to summarise a regulatory requirement or analyse client data, and the AI produces inaccurate output that influences a client interaction, the firm is responsible. You need procedures to catch these inaccuracies before they reach clients.<\/p>\n FINRA references Regulatory Notice 21-29, which addresses supervisory obligations for outsourced services. AI tools that handle client data or produce client-facing content are third-party vendors subject to this guidance.<\/p>\n What this means for your firm:<\/strong>\u00a0You should be conducting due diligence on your AI vendors \u2014 understanding how they handle data, what security controls they have, and whether they’re designed for regulated environments.<\/p>\n The report flags risks around client data being processed by AI tools. This includes data being used for model training, stored insecurely, or accessed by unauthorised parties.<\/p>\n What this means for your firm:<\/strong>\u00a0Your AI tools need data isolation guarantees. Client data entered into AI should not be used to train models or shared with other users.<\/p>\n Here’s a prioritised action plan, designed for firms with limited compliance resources.<\/p>\n Add an AI section to your WSPs covering:<\/p>\n This doesn’t need to be a 50-page document. A clear, specific two-page addition to your existing WSPs demonstrates supervisory intent.<\/p>\n Ask every employee what AI tools they’re using for firm business. Include consumer tools like ChatGPT, Gemini, and Copilot. You need an accurate picture before you can supervise effectively.<\/p>\n Replace ad-hoc consumer AI use with a platform designed for regulated businesses. Look for:<\/p>\n Governed AI platforms like LaunchLemonade are built for exactly this use case \u2014 giving firms AI tools that work within regulatory requirements, with full logging and review controls.<\/p>\n Hold a training session covering:<\/p>\n Document the training \u2014 date, attendees, topics covered. Examiners look for this.<\/p>\n Set a quarterly review cadence:<\/p>\n Document each review cycle. This demonstrates ongoing supervision, not just a one-time compliance exercise.<\/p>\n Scoring:<\/strong>\u00a08\u201310 items ready = well-positioned. 5\u20137 = gaps to address this quarter. Under 5 = prioritise immediately.\u00a0Scoring:<\/strong>\u00a08\u2013<\/p>\n FINRA examiners are asking about AI. When they visit your firm, expect questions like:<\/p>\n If you can’t answer these clearly and point to documentation, you have a finding. Findings lead to deficiency letters, potential fines, and reputational damage \u2014 outcomes no small firm can afford.<\/p>\n The firms that prepare now will spend 10\u201320 hours getting their house in order. The firms that don’t will spend significantly more when an examiner flags the gap.<\/p>\n They’re guidance, not new rules. The 2026 Annual Regulatory Oversight Report explains how existing rules \u2014 particularly Rule 3110 (Supervision) \u2014 apply to generative AI use. It also references Regulatory Notices 21-29, 24-09, and 24-10. While it doesn’t create new legal requirements, it signals what examiners will focus on, which has practical force.<\/p>\n FINRA’s oversight applies to broker-dealers. However, SEC-registered investment advisers face parallel requirements under SEC Rule 206(4)-7, which requires written compliance policies and procedures. Many firms are dually registered and subject to both. The practical steps \u2014 written policies, vendor due diligence, review workflows \u2014 apply regardless of registration type.<\/p>\n Detailed enough that an examiner can understand how your firm supervises AI use. FINRA looks for procedures that are “tailored to [the firm’s] business” \u2014 not generic boilerplate. For a small firm, this be 2\u20133 pages covering approved tools, prohibited uses, review workflows, and training requirements. Specificity matters more than length.<\/p>\n If no employee uses any AI tool for any firm business, you may not need AI-specific procedures today. However, FINRA’s report acknowledges that AI adoption is growing rapidly. Having a simple policy stating that AI tools are not approved for firm use \u2014 and that any future adoption requires compliance review \u2014 is a low-effort safeguard.<\/p>\n The principles are the same \u2014 written policies, vendor oversight, review workflows, documentation. But the implementation should be proportional to your firm’s size and complexity. A 10-person RIA doesn’t need the same infrastructure as a major wirehoused. Focus on clear policies, approved tools, and documented review processes rather than enterprise-grade compliance platforms.<\/p>\nThird-Party Vendor Risks<\/h3>\n
Data Privacy and Security<\/h3>\n
What Should Small Broker-Dealers Do Right Now?<\/h2>\n
Priority 1: Update Your Written Supervisory Procedures (This Month)<\/h3>\n
\n
Priority 2: Audit Current AI Use (This Month)<\/h3>\n
Priority 3: Choose a Governed AI Platform (This Quarter)<\/h3>\n
\n
Priority 4: Train Your Team (This Quarter)<\/h3>\n
\n
Priority 5: Establish Ongoing Monitoring (Ongoing)<\/h3>\n
\n
FINRA AI Readiness: Self-Assessment for Small Firms<\/h2>\n
\n\n
\n \nRequirement<\/th>\n Ready<\/th>\n In Progress<\/th>\n Not Started<\/th>\n<\/tr>\n<\/thead>\n \n Written supervisory procedures cover AI use<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Approved AI tools list documented<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Prohibited AI uses clearly defined<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n AI vendor due diligence completed<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Human review workflow for AI-generated client content<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Audit trail for AI interactions available<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Employee AI training completed and documented<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Quarterly review process established<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Data handling requirements for AI documented<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Designated AI supervisor identified<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n What Happens If You Don’t Prepare?<\/h2>\n
\n
Frequently Asked Questions<\/h2>\n
Are FINRA’s 2026 AI provisions new rules or guidance?<\/h3>\n
Does this apply to RIA firms or only broker-dealers?<\/h3>\n
How detailed do our written supervisory procedures need to be?<\/h3>\n
What if our firm doesn’t use AI at all?<\/h3>\n
Can we use the same AI governance framework as larger firms?<\/h3>\n