FINRA rules applied to generative AI and AI agents — broker-dealers
This page is generated from the requirement table the AiSSAY engine ships for this framework. When the engine produces an evidence pack, each row below gets a status computed from the operator's own records at that moment. This page shows the table, not anyone's results.
Informational mapping prepared by the operator's own tooling. Not a legal opinion, not a certification, and not a substitute for advice of counsel. It organizes the operator's records against the cited requirements; whether those records satisfy the requirements is a determination for the operator, counsel, and the examiner.
Regulatory Notice 24-09 (27 June 2024) says existing rules apply to generative AI and creates no new requirements. The 2026 Annual Regulatory Oversight Report's AI-agent practices are guidance, not rules. Notice 26-14 (July 2026), on supervising retail communications including AI-generated ones, was a proposal as of September 2026. SEC Rule 17a-4 has its own view.
The requirement table
8 rows: 6 mechanism, 1 organizational, 1 named gap
| Requirement | Mechanism, duty or gap | Type |
|---|---|---|
| Rule 4511 — make and keep books and records; six years where no period is specified | per-record retain-until dates (default seven years); deletion before that date is refused without a recorded override; legal hold blocks deletion outright | mechanism |
| Rule 3110(a) — a supervisory system reasonably designed for compliance | organizational: the written supervisory procedures are the firm's. The record evidences what supervision saw and did. | organizational |
| Rule 3110(b)(4) — principal review of correspondence, evidenced in writing with the reviewer and the date | a named reviewer's countersign is sealed beside the run with its date; reviewers' reads are logged with attribution | mechanism |
| Rule 2210 — communications, including AI-generated ones: approval where required, fair and balanced content, retained with dates | the output an agent produced is sealed verbatim with its run; irreversible sends are held until the firm's policy answers, and the decision is recorded as a step. Fair-and-balanced content is the firm's judgment. | mechanism |
| Regulatory Notice 24-09 — protect customer information when using generative AI | records sealed on the firm's own machines under its key, with no vendor-side copy; every read, export and deletion logged | mechanism |
| 2026 Oversight Report (guidance) — for AI agents, keep a human in the loop, track actions and decisions, keep prompt and output logs | every tool call, decision and output is recorded per run; irreversible actions pend for a human answer; findings and holds are in the record | mechanism |
| 2026 Oversight Report (guidance) — track which model version an agent used | every record carries two model fields, never merged: the model string the provider's own API response reported, captured by the recording proxy or by code that received the response, and the model the integrator declared. The pack counts the two kinds separately and counts the runs that record neither. The model is never inferred from how the output reads. | mechanism |
| Reliance on this tool — independent evaluation of its controls | NOT IMPLEMENTED. No penetration test, no third-party review of the cryptography and no independent report on this software's controls exist yet. Anyone relying on these records as evidence must evaluate the tool themselves, and this row says so first. | named gap |
How a status is earned
- Evidenced
- a deterministic check ran against your records and the counts support the row. A store holding no relevant records reads unevidenced — a true statement, not a passing one. Empty never counts as clean.
- Delegated
- the mechanism is enforced by a system you already trust — a store sealed by your own key manager delegates access control to it, and the pack says the enforcing log is your key manager's, not ours. The pack names the endpoint the key manager was reached at. An AWS endpoint other than AWS's own default for the region reads delegated to that endpoint, with a request that you confirm it is your key management service. One backend — AWS KMS — has run against the real AWS KMS service; no other backend has.
- Test seam
- sealed by an in-process test backend — a stub, or a stand-in for the AWS client — and the status names which. No key manager enforces access. The seam is built and tested, and the pack refuses to call that delegation.
- Partially evidenced
- the mechanism is built and some of your runs carry its evidence, but not all — usually because they were sealed before the mechanism existed. The pack says how many runs are in each group, and never counts the missing ones as passing.
- Organizational
- the requirement is a procedure only people can perform. The pack names it as yours instead of dressing a policy up as a mechanism.
- Named gap
- the pack cannot evidence it — either the mechanism is not built, or no software can supply it — and it says which. The gap is printed, because a reviewer should read it here rather than discover it.
No status is typed in by hand: every status is recomputed from the store each time a pack is produced, the requirement and mechanism text is written and reviewed as part of the engine, and the dependency evidence comes from our release scan. A failing mechanism can never be read as evidence that the control works.