United StatesFINRA Regulatory Notice 24-09, FINRA reminds members of regulatory obligations when using generative artificial intelligence and large language models
Guidance, not a law: FINRA's reading of FINRA Rule 3110, supervision. It binds nobody by itself; the law it reads does.
Guidance on an AI sector rules rule, addressed to private bodies.
- Enforcement body
- Financial Industry Regulatory Authority (FINRA)
- Instrument type
- guidance published by a regulator
- Obligation class
- Governance
- Audit expectation
- none
As of .
What the regulator expects
- It reaches you if you are a FINRA member firm that uses generative AI, large language models, or similar tools in your business: FINRA reminds member firms that FINRA's rules and the securities laws continue to apply to that use, just as they apply when a firm uses any other technology or tool (Regulatory Notice 24-09).
- FINRA says a firm that uses generative AI tools as part of its supervisory system, such as to review electronic correspondence, should address technology governance in its policies and procedures, including model risk management, data privacy and integrity, and the reliability and accuracy of the AI model (Rule 3110).
- FINRA says a firm should evaluate generative AI tools before deploying them and ensure that it can continue to comply with the FINRA rules that apply to the business use of those tools, whether it develops the tool for its own use or relies on a third party's technology, including embedded features in existing third-party products.
- FINRA says the content standards of Rule 2210 apply to a firm's communications whether a human or a technology tool generated them (Rule 2210).
What this law does
Regulatory Notice 24-09 reminds FINRA member firms that FINRA's rules, which are intended to be technology neutral, and the securities laws more generally continue to apply when member firms use generative artificial intelligence or similar technologies in the course of their businesses, and states that it does not create new legal or regulatory requirements.
The notice says that under Rule 3110 a member firm must have a reasonably designed supervisory system tailored to its business, and that a firm using generative AI tools as part of its supervisory system, for the review of electronic correspondence for instance, should address technology governance, including model risk management, data privacy and integrity, and the reliability and accuracy of the AI model, in its policies and procedures.
The notice says FINRA rules apply whether member firms are directly developing generative AI tools for their proprietary use or leveraging the technology of a third party, including through embedded features in existing third-party products. The notice says a member firm should evaluate generative AI tools prior to deploying them and ensure that the firm can continue to comply with existing FINRA rules applicable to the business use of those tools.
The notice says FINRA has provided guidance that the content standards of Rule 2210 apply whether member firms' communications are generated by a human or a technology tool. The notice cites FINRA's advertising regulation questions on supervising chatbot communications and on AI-created communications. FINRA may impose sanctions on a member or person associated with a member for each violation of FINRA rules, from censure and a fine to expulsion and a bar from association with all members.