Reference · Securities
FINRA Regulatory Notice 24-09: Generative AI and Large Language Models
Regulatory obligations when using generative AI and large language models
Regulatory Notice 24-09, issued 27 June 2024, reminds FINRA member firms that FINRA's rules and the federal securities laws apply to generative AI and large language models exactly as they apply to any other technology. The Notice creates no new requirements and no new interpretations of existing ones.
Who it applies to
FINRA member firms. The Notice applies whether a generative AI tool was built in-house or supplied by a third-party vendor — outsourcing the technology does not outsource the obligation.
What it requires
Nothing new, which is the point. FINRA's rules are written to be technology neutral, so obligations that already exist attach to AI use without amendment. The Notice identifies where firms should expect those obligations to bite:
- Supervision. A firm's supervisory system must reasonably cover its use of generative AI, including technology governance, model risk management, and data integrity.
- Communications with the public. Content standards apply to AI-generated communications on the same terms as any other communication.
- Books and records. Recordkeeping obligations apply to AI-generated and AI-assisted records.
- Third-party vendors. Supervisory obligations relating to outsourcing continue to apply, as set out in Regulatory Notice 21-29.
- Customer information protection and cybersecurity obligations apply to data handled by AI systems.
Control mapping
What a reviewer expects to be able to see.
| Obligation | What the system must do | Evidence a reviewer expects |
|---|---|---|
| Supervisory system | Bring AI use under written supervisory procedures covering approval, monitoring, and escalation | WSPs naming AI systems, their approved uses, and review procedures |
| Technology governance | Record which models are approved, for what purposes, and who authorised them | Approved-model register with owner, purpose, and authorisation date |
| Data integrity | Control and evidence what data reaches the model and what leaves it | Data flow documentation and inline enforcement records |
| Communications review | Route AI-generated communications through applicable content review | Review records tied to specific generated communications |
| Books and records | Retain AI-generated and AI-assisted records under applicable retention rules | Retained records with retrieval within required timeframes |
| Vendor oversight | Apply outsourcing supervision to third-party AI providers | Due diligence files, contractual controls, and ongoing monitoring evidence |
Key dates
- 10 June 2020FINRA report on artificial intelligence in the securities industry.
- 31 October 2021Regulatory Notice 21-29 on supervisory obligations for outsourcing to third-party vendors.
- 27 June 2024Regulatory Notice 24-09 issued.
- OngoingGenerative AI continues to be addressed in FINRA's Annual Regulatory Oversight Reports.
Primary sources
Common gaps
What examiners find when a firm has adopted generative AI faster than its supervisory system.
- Shadow adoption. Staff use tools never approved, inventoried, or covered by written supervisory procedures. A firm cannot supervise what it cannot see.
- Procedures that predate the technology. WSPs written for deterministic systems assume repeatable output. Generation needs procedures addressing variability, not just approval.
- No record of what the model was given. Both supervision and recordkeeping assume inputs are reconstructable. Unretained prompts and context defeat each.
- Vendor answers accepted as evidence. Outsourcing supervision obligations still apply under Notice 21-29, and an attestation is not documentation adequate to supervise.
- Communications review bypassed by workflow. AI-assisted drafts reaching customers without content review is the most common finding, and usually a routing problem.
- Retention that misses AI artefacts. Chat transcripts, generated summaries, and model output inside customer communications are frequently outside the retention system.
In practice
Related
Last reviewed August 14, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.