Overview
- FINRA distinguishes passive generative tools from task‑executing systems and tells firms to supervise automated actors under Rules 3110 and 3120 while preserving records under Rule 4511 and Exchange Act Rule 17a‑4.
- The report identifies four elevated risks: supervisory substitution, books‑and‑records gaps requiring process reconstruction, objective‑function drift with Reg BI consequences, and competence simulation in specialized tasks.
- For 2026 deployments, FINRA urges full‑chain telemetry, defined escalation triggers for automated actions, compliance review of objective and reward functions, stronger vendor controls on execution features, and updated incident‑response plans.
- FINRA links automation to rising cyber threats, flagging deepfake‑enabled identity spoofing, QR‑based phishing, and rapidly mutating AI‑generated malware as priorities for supervision and recordkeeping.
- A companion Unscripted podcast with senior leaders accompanies the early release to aid firms’ 2026 planning, and the document signals heightened expectations rather than immediate rule changes.