How to Supervise AI Retail Communications at a Broker-Dealer

Current as of October 29, 2026. This guide describes FINRA rules and guidance, the SEC's broker-dealer recordkeeping rule and an unadopted FINRA proposal, as published on that date, for FINRA member broker-dealers. It is not legal advice.

Broker-dealers now use generative AI to draft marketing pieces, social posts and emails, and some put chatbots in front of investors. FINRA's advertising guidance settles whether those words are covered: "Firms are responsible for their communications, regardless of whether they are generated by a human or AI technology." What remains is which review standard applies, who approves, and what evidence is kept.

FINRA's FAQs, Regulatory Notice 24-09 and its 2026 Annual Regulatory Oversight Report (published December 2025) are guidance; the notice and the report say they create no new requirements. Unless a step quotes a rule or guidance, it is our recommendation, and it is labeled "(interpretation)" where it applies a rule to AI.

Step 1: Inventory every place AI writes words that reach investors

List every tool that drafts or generates content the public can see: marketing and social media drafting tools, email copilots, website and app copy, investor-facing chatbots and personalization engines. Regulatory Notice 24-09 adds that FINRA rules apply "whether member firms are directly developing Gen AI tools for their proprietary use or when leveraging the technology of a third party, including through embedded features in existing third-party products."

Step 2: Classify each AI output as correspondence, retail or institutional

Rule 2210 sorts written communications by audience, not by author. Correspondence goes to 25 or fewer. An institutional communication goes only to institutional investors, and cannot be treated as one if the firm has reason to believe it will be forwarded to a retail investor. Institutional communications are reviewed under written procedures by an appropriately qualified registered principal (Rule 2210(b)(3)), and need not be reviewed before use if the procedures provide for training and surveillance.

For chatbots, FAQ B.4 says: "Depending on the nature and number of persons receiving the chatbot communications, they may be subject to FINRA communications rules as correspondence, retail communications, or institutional communications." In practice (interpretation), a scripted or pre-written chatbot answer that many retail investors can receive looks like a retail communication, while a reply generated for one investor's question looks more like correspondence, unless the same or substantially similar content goes to more than 25 retail investors within 30 days. Record each classification and the reasoning in the written supervisory procedures (interpretation).

Step 3: Have a principal approve AI-drafted retail communications before use

Under the current rule, an AI-drafted brochure, web page or static social post that is a retail communication needs principal approval before use or filing. The rule's exceptions still apply. For the three listed in Rule 2210(b)(1)(D), the firm must instead supervise and review the piece the way it reviews correspondence. One covers "any retail communication that does not make any financial or investment recommendation or otherwise promote a product or service of the member"; another covers posts in online interactive electronic forums. Filing requirements turn on content and on how long the firm has been a member, not on who drafted the piece (interpretation).

Regulatory Notice 26-14 acknowledges the practical difficulty: "applying the principal pre-use approval requirement to AI-generated retail communications can be challenging". A workable approach (interpretation): the tool drafts, a principal approves the final version, and anything generated live for many retail investors is limited to pre-approved content.

Step 4: Review AI-generated correspondence and chatbot replies under Rule 3110

AI-drafted emails and chatbot replies that are correspondence fall under Rule 3110(b)(4), whose review procedures must be "appropriate for the member's business, size, structure, and customers." Those reviews "must be conducted by a registered principal and must be evidenced in writing, either electronically or on paper." Supplementary Material.06 lets a firm use risk-based principles to decide how far to review correspondence that falls outside the subject matters Rule 3110(b)(4) requires it to review, such as customer complaints and instructions. Where its procedures do not require review of all correspondence before use, they must provide for training, documentation of that training, and surveillance and follow-up.

Supplementary Material.07 says: "Merely opening a communication is not sufficient review." FINRA's 2026 oversight report lists among its communications findings "Reviewing electronic communications without selecting adequate samples or using targeted key word searches". For chatbots, the report lists, among practices firms may consider, "ensuring the appropriate supervision and retention of those communications, and retention of those chat sessions". Sample chatbot sessions with search terms aimed at typical AI errors (interpretation).

Step 5: Test AI output against the Rule 2210 content standards

The content standards do not change with the author. Rule 2210(d) says: "No member may make any false, exaggerated, unwarranted, promissory or misleading statement or claim in any communication." It also says communications "may not predict or project performance, imply that past performance will recur or make any exaggerated or unwarranted claim, opinion or forecast", subject to exceptions. One of them, added by SR-FINRA-2026-004, permits a projection or targeted return only if the firm adopts written policies and procedures reasonably designed to ensure the communication is "relevant to the likely financial situation and investment objectives of the intended audience of the communication", and gives enough information to understand the criteria, assumptions, risks and limitations. The SEC approved that change on October 15, 2026. AI-generated projections need to meet those conditions or come out. FINRA's 2026 report describes the failure to watch for: "Hallucinations refer to instances where the model generates information that is inaccurate or misleading, yet is presented as factual information."

Two more checks. FINRA's FAQs note that Regulation Best Interest applies if a broker-dealer uses AI to recommend a securities transaction or investment strategy to a retail customer. And when a communication describes the firm's own AI, the 2026 report lists, among practices firms may consider, making sure such communications "accurately describe how these offerings incorporate AI technology and balance the discussion of benefits with appropriate discussion of risks."

Step 6: Govern AI review tools as part of the supervisory system

For AI that screens communications, Regulatory Notice 24-09 says a firm using Gen AI in its supervisory system should address technology governance, including model risk management, data privacy and integrity, and the model's reliability and accuracy. Regulatory Notice 26-14 puts the condition plainly: "Gen AI communication tools can be part of such a reasonably designed system, provided they are vetted, tested and monitored."

Rule 3110 says "Final responsibility for proper supervision shall rest with the member", and Supplementary Material.08 says that when correspondence review functions are delegated, "the supervisor/principal remains ultimately responsible for the performance of all necessary supervisory reviews". That text addresses delegating correspondence review to people who need not be registered. The same logic applies to delegating review steps to software, and to retail communications (interpretation). Under the current rule, an AI screen can flag and route a retail communication, but the approval belongs to a registered principal (interpretation).

Step 7: Keep the records, including who approved what

Rule 2210(b)(4) requires: "Members must maintain all retail communications and institutional communications for the retention period required by SEA Rule 17a-4(b) and in a format and media that comply with SEA Rule 17a-4." Those records must include the dates of first and (if applicable) last use, the name of the approving principal and the date of approval, sources for any table, chart, projection or targeted return, and, for a piece not approved by a principal before first use, "the name of the person who prepared or distributed the communication". For AI-drafted pieces, name the person who caused it to be generated and released (interpretation). For correspondence, Rule 3110.09 requires that "The names of the persons who prepared outgoing correspondence and who reviewed the correspondence shall be ascertainable from the retained records".

Record which tool, and which model version, drafted each piece (interpretation). FINRA's 2026 report lists "storing prompt and output logs for accountability and troubleshooting" and "tracking which model version was used and when" among monitoring practices firms may consider. Whether prompts and drafts are records that must be kept under Rule 17a-4 is for the firm and its counsel to decide, in writing (interpretation).

Step 8: Prepare for risk-based review without relying on it

Under the Regulatory Notice 26-14 proposal, "members would be required to establish written procedures appropriate to their business, size and structure to determine what categories of retail communications require principal pre-use approval." Review would not disappear: "Members would be required to establish written procedures for the review of retail communications by an appropriately qualified principal but would have flexibility in determining which communications require pre-use approval based on risk factors." The listed factors include "whether the communication appears to be tailored to a specific audience or individual" and the "medium and distribution method for the communication". On AI specifically, it says firms "may consider the qualifications and experience of the individuals responsible for supervising, validating or reviewing the AI tool or technology." FINRA states that under the proposal "the substantive content standards would not change", although the notice would also replace the Rule 2210(d)(7) provisions on communications containing recommendations and change filing requirements.

Until a final rule takes effect, pre-use approval remains the requirement. Risk tiers built now also serve today's correspondence program (interpretation).

Checklist

• Every AI tool producing investor-facing content is inventoried, including embedded features
• Each tool's output is classified as correspondence, retail or institutional, with reasons recorded
• A qualified principal approves AI-drafted retail communications before use or filing, unless an exception applies
• Chatbots that reach many retail investors are limited to content a principal has already approved
• Correspondence review is risk-based, evidenced, and goes beyond opening the message
• Chatbot sessions are retained and sampled, with search terms aimed at AI errors
• Reviewers test AI output for false, promissory or exaggerated claims, projections that do not meet Rule 2210(d)(1)(F)'s conditions, and hallucinated facts
• Recommendations made through AI are checked against Regulation Best Interest
• Any AI review tool is vetted, tested and monitored, and approval stays with a registered principal
• Records show the approver or preparer, dates of use, sources of figures, and the tool and model version
• Retention meets Rule 17a-4(b) periods and format requirements
• The firm tracks Regulatory Notice 26-14 and keeps pre-use approval until any change takes effect

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.