For the first time, FINRA's Annual Regulatory Oversight Report addresses generative AI. The report applies the existing supervision and recordkeeping rules to AI tools and identifies summarization as the most common use case. For compliance officers, the capture and retention of notes produced by AI meeting assistants are a top priority.
If an AI assistant sits in on your client meetings and writes up the notes, FINRA's 2026 Annual Regulatory Oversight Report is about you, and the most useful thing about its new section on generative AI is how little it changes.
The 2026 report treats generative AI the way FINRA has treated every technology before it. The rules do not move; the examiner's vocabulary does. The report names the tools, describes how firms use them, and sets out the governance it expects to find in writing. For advisors at firms of every size, the notes an AI assistant writes after a client call are treated as what they are, a record of that conversation. For whoever holds the compliance role, whether a team or the firm's principal, the section is a map of the questions the next examination will ask.
What the report says
The framing is deliberately neutral. In FINRA's words, "FINRA's rules, which are intended to be technologically neutral, and the securities laws more generally, continue to apply when firms use GenAI or similar technologies in the course of their businesses, just as they apply when firms use any other technology or tool." (Page 25)
From that principle, the Communications with the Public section draws two expectations. The first concerns communications written with AI assistance: "When using GenAI to generate or otherwise assist in creating communications to customers, ensuring that these communications comply with applicable federal securities laws and regulations and FINRA rules." The second concerns chatbots: "When using GenAI to create or otherwise assist in creating chatbot communications that are used with investors, ensuring the appropriate supervision and retention of those communications, and retention of those chat sessions, in accordance with applicable securities laws and regulations and FINRA rules." (Page 47) In both cases the obligation attaches to what the client or investor receives, where recordkeeping has always attached.
The report also documents how firms use the technology. FINRA's survey found the most common use to be "summarization and information extraction", defined as "condensing large volumes of text and extracting specific entities, relationships or key information from unstructured documents." (Page 27) That is the meeting note, described in FINRA's terms.
On governance, the effective practices include "establishing a supervision, governance or model risk management framework that establishes clear policies and procedures for AI/LLM development, implementation, use and monitoring, while maintaining comprehensive documentation throughout." (Page 32) FINRA's Rule 2210 FAQ compresses the same expectation into a sentence: "Firms are responsible for their communications, regardless of whether they are generated by a human or AI technology."
The sentence about prompts
Much of the commentary since December has read the report as extending recordkeeping to the prompts and drafts behind a communication. The source is a single sentence on page 27. Among the practices a firm "may want to consider" when adopting generative AI, FINRA lists ongoing monitoring of the tools, which "may include storing prompt and output logs for accountability and troubleshooting." The passage concerns the governance of a firm's own AI systems, alongside model testing and bias checks. It is not a recordkeeping requirement, and it does not make an advisor's prompts a client communication.
Where the new record is
An email drafted with AI assistance is still sent as an email, and the firm's archive retains it; texts and social media posts follow the same path. The records that fall outside the archive are those an AI tool creates on its own, and the clearest is the note a meeting assistant produces after a client call. It documents a client conversation in detail, it may come from software the firm never approved, and it travels through no channel the firm captures. Where a firm offers a client-facing chatbot, the conversations investors hold with it are a second example. Each of these records needs a path into the archive and a place in the written procedures.
What this means at your firm
- Every AI tool in use at the firm, including the assistant an advisor signed up for on a phone, belongs on the firm's list, with its approved use written down.
- The approved uses belong in the firm's written supervisory procedures, the document that sets out how the firm supervises its people, where an advisor can find the answer.
- Vendor due diligence extends to AI tools, including the ones advisors bring in. The report asks firms to assess "the third-party vendor's use of GenAI in their products or services" and to include contract language "that prohibits firm or customer sensitive information from being ingested into a third-party vendor's open-source GenAI tool." (Page 31)
Questions for compliance leaders
- Where are the notes produced by your advisors' AI meeting assistants retained today, and could the firm produce them for a given client and date?
- Does every advisor know which AI tools the firm has approved, and where the notes those tools produce are supposed to go?
Rethinking where recordkeeping ends
Archive Intel's integration with Zocks, the AI meeting assistant many advisors use to capture client conversations and draft notes, exists for this record. Notes generated in Zocks flow into Archive Intel, where Contextual AI reviews them in the context of SEC and FINRA recordkeeping rules and archives them alongside the firm's other channels. The note becomes part of the record rather than remaining in the assistant.
The report did not change what a record is. It named the tools now creating them, and a firm that can say where its AI-generated records live will find the new section describes what it already does.