FINRA told brokers their existing rules still cover chatbots

The conversation

On 27 June 2024, the Financial Industry Regulatory Authority published Regulatory Notice 24-09, titled to remind member broker-dealer firms of their regulatory obligations when they use generative artificial intelligence and large language models. The notice's own text states plainly that it ‘does not create new legal or regulatory requirements or new interpretations of existing requirements’; instead, it walks through how FINRA's existing rulebook already reaches AI tools, including any that face customers directly in a chat interface.

What the documents show

The notice states that FINRA Rule 3110, which requires a firm to ‘establish and maintain a system to supervise the activities of each associated person’ reasonably designed to achieve compliance with securities laws and FINRA's own rules, applies to a firm's generative AI use just as it would to any other technology or tool a firm adopts. It similarly ties generative AI communications with the public to Rule 2210's content standards. The notice discusses generative AI tools that can ‘analyze and synthesize’ large data sets, summarize complex documents, and support customer-facing educational content, framing these as use cases that remain subject to the same supervisory, recordkeeping and communications obligations that applied before generative AI existed as a category.

The system boundary

The boundary the notice draws sits with the firm's own supervisory system, not with the AI tool: under Rule 3110, as the notice restates it, a firm must have a reasonably designed system addressing technology governance, model risk management, data privacy and accuracy for any AI tool it deploys, meaning a human governance layer, not the model itself, carries the compliance obligation. The notice does not describe a chatbot as capable of satisfying supervisory or recordkeeping duties on its own.

Where it fails

Because the notice is explicitly framed as applying existing rules rather than creating an AI-specific one, it does not itself set new quantitative standards, testing thresholds or disclosure formats for customer-facing generative AI tools in the way some state statutes do; a firm reading only this notice would still need to map its specific chatbot's behavior against the pre-existing Rule 3110 and Rule 2210 texts to know what compliance looks like in practice.

• Has the firm's existing Rule 3110 supervisory system been extended, in writing, to cover the specific generative AI or large language model tool in question?
• Do customer-facing outputs from the tool meet Rule 2210's content standards for communications with the public, including any required disclosures?
• Is there a recordkeeping process that captures the AI tool's customer-facing outputs the way it would capture a human representative's communications?

This entry describes only what FINRA's own notice states; it is guidance interpreting existing rules, not itself a new rule with independent legal force.