AI Regulation Tracker / Regulator guidance
FINRA names generative AI a 2026 exam priority, pushing broker-dealers to update supervision procedures
FINRA's 2026 Annual Regulatory Oversight Report flags generative AI and AI agents as a new area examiners will probe this cycle. Broker-dealers should expect questions about how they govern, test, and log their AI tools.
FINRA has told broker-dealers where its examiners will be looking in 2026, and generative AI now has a section of its own. In its 2026 Annual Regulatory Oversight Report, the self-regulatory organization added a Generative AI section, and FINRA marks the generative-AI section "new for 2026," signaling that firms adopting the technology should expect direct questions about how they control it. The report does not create a new rule. It applies obligations that already sit in FINRA's rulebook to a fast-moving use case.
What the report actually says
The Generative AI section frames the technology as something that "can implicate rules regarding supervision, communications, recordkeeping and fair dealing." It cites FINRA Rule 3110, the supervision rule, by name, noting that a firm relying on GenAI tools in its supervisory system may need policies and procedures that "consider the integrity, reliability and accuracy of the AI model." The report treats GenAI not as a novel category of risk but as a new surface for long-standing duties: if an AI tool touches a supervised function, the firm still owns the outcome.
That framing matters for how a compliance officer should read this. The obligations are not new. The expectation that firms can demonstrate control over a specific, opaque tool is what the report sharpens.
The expectations examiners will probe
The report describes several practices FINRA associates with sound GenAI use. It points to establishing a supervision, governance, or model risk management framework with clear policies to develop, implement, use, and monitor the technology. It describes testing that FINRA describes as covering "privacy, integrity, reliability, and accuracy." And it lists concrete recordkeeping and oversight practices: storing prompt and output logs for accountability and troubleshooting, tracking which model version was used and when, and building in validation and human-in-the-loop review.
Read together, those items form a checklist a firm can hold against its own written supervisory procedures. A firm that cannot show testing records, version tracking, or retained logs for a GenAI tool used in a supervised process has a gap the report has now told it examiners may find.
What it does not do
This is guidance, not rulemaking. The report does not impose penalties, set a compliance deadline, or add a rule number to the FINRA rulebook. It does not ban any use of generative AI, and it does not certify any particular tool as compliant. It flags fair-dealing concerns around AI "hallucinations" and bias but stops short of prescribing specific fair-dealing controls beyond general risk mitigation. Firms should treat the document as a preview of examiner focus, not as a checklist that, once completed, ends the inquiry.
The report names Rule 3110 explicitly. It references the broader areas of communications, recordkeeping, and fair dealing without attaching rule numbers in the Generative AI section itself. Firms mapping their procedures should therefore look to the full body of FINRA rules governing communications with the public, books and records, and fair dealing rather than assume a single citation captures the obligation.
Why it lands now
FINRA publishes the Annual Regulatory Oversight Report at the start of each examination cycle so member firms can align their compliance programs before examiners arrive. Placing generative AI in the report is the mechanism by which an emerging practice becomes an exam topic. For a broker-dealer, the practical signal is timing: the window to document governance, testing, and logging is before an examination, not during one. This is distinct from FINRA's separate work on agentic AI and deepfake fraud risk; here the throughline is supervision of the firm's own GenAI use.
Frequently Asked Questions
What changed with FINRA and generative AI in 2026?
FINRA added a Generative AI section, marked "new for 2026," to its Annual Regulatory Oversight Report. It makes GenAI supervision an examination focus for the 2026 cycle by applying existing FINRA rules to the technology. It is guidance, not a new rule.
Who does this affect?
Broker-dealers and FINRA member firms that use or are piloting generative AI in supervisory systems, client communications, research, or operations, plus their compliance, legal, and technology teams responsible for written supervisory procedures.
Is this a binding rule with penalties?
No. The report is regulatory guidance describing examiner expectations. It applies existing obligations, including FINRA Rule 3110 on supervision and rules covering communications, recordkeeping, and fair dealing, rather than creating a new rule or a fixed deadline.
What should a firm do first?
Read the Generative AI section, inventory where GenAI touches supervised activity, and compare the report's stated expectations, governance framework, testing, version tracking, prompt and output logging, and human review, against current written supervisory procedures to find gaps.
Sponsored Training
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.