FINRA's 2026 Oversight Report and AI Agents: What Advisors Need to Know
Prices and facts checked October 13, 2026. We don't accept payment for rankings.
On this page
What happened: on December 9, 2025, FINRA published its 2026 Annual Regulatory Oversight Report. For the first time it includes a section on AI agents, meaning tools that act on a user's behalf rather than just answering questions, and it substantially expands last year's generative AI guidance (Debevoise & Plimpton).
Why it still matters: the report is FINRA's clearest statement of what examiners expect when member firms use AI. Notetakers, email assistants and "agentic" CRM features have spread quickly through 2026, so its expectations now apply to most advisory practices with a broker-dealer affiliation, and they're a sensible standard for RIAs too.
Not legal or compliance advice. FINRA's report describes observations and effective practices; it doesn't create new rules. Your CCO and written supervisory procedures decide what your firm does.
The core message: same rules, more specific expectations
FINRA restates that its rules are technology neutral. Firms stay responsible for supervision, communications, recordkeeping and fair dealing however the work gets done, a point it first made in Regulatory Notice 24-09 in June 2024. What's new in the 2026 report is how specific the expectations have become (Debevoise & Plimpton). Lawyers summarizing it stress that FINRA doesn't want AI treated as "set it and forget it": it expects human oversight or adjusted quality-control testing, and written supervisory procedures that reflect how a firm actually uses AI (DLA Piper).
How firms are actually using generative AI
Last year's report listed three uses. The 2026 report lists around a dozen, with summarization and information extraction still the most common (Goodwin). Others include:
- conversational AI and question answering
- speech-to-text and translation, the basis of AI meeting notetakers
- drafting and content generation, such as follow-up emails
- classification, workflow automation and natural-language data queries
If your practice uses an AI notetaker, it falls squarely into the uses FINRA is now watching.
What FINRA expects for generative AI
| Area | FINRA's expectation |
|---|---|
| Governance | Supervisory processes for AI across the enterprise, with formal review and approval combining business and technology expertise |
| Known failure modes | Identify and mitigate hallucinations (confident but wrong output) and bias from limited or outdated data |
| Cybersecurity | Make sure your program covers both internal and third-party AI use, including attackers using AI |
| Testing | Test accuracy, reliability, privacy and data integrity before deployment, and again when models or uses change |
| Monitoring | Review prompts and outputs over time, keep prompt and output logs, and track which model version was used when |
| Human review | Keep a person in the loop to validate outputs and make decisions |
| Vendors | Add AI-specific questions to vendor due diligence, and reflect AI obligations in contracts |
Sources: Debevoise & Plimpton; Goodwin.
The new part: AI agents
FINRA defines AI agents as systems that can autonomously perform and complete tasks for a user. It lists six risks:
- Autonomy and scope creep: agents acting without human validation, or beyond the authority the user intended
- Auditability: chained, multi-step actions that are hard to reconstruct after the fact
- Sensitive data handling: agents retaining or revealing confidential information unintentionally
- Insufficient domain expertise: general-purpose agents lacking the specialist knowledge regulated tasks need
- Misaligned incentives: poorly designed objectives that lead an agent to optimize in ways that harm investors
- Existing AI risks: bias, hallucinations and privacy problems still apply
FINRA's suggested controls: decide where a human must approve an action, monitor what systems and data an agent can reach, log agent actions and decisions, and set guardrails that constrain behavior (Debevoise & Plimpton).
What this means for your AI notetaker and CRM tools
Most advisor tools now blur the line between "assistant" and "agent". A notetaker that drafts a follow-up email is an assistant. One that sends it, updates CRM fields and creates account-opening paperwork without review is acting like an agent.
- Map what each tool does on its own. Which actions happen without a click from you?
- Keep approval steps for anything client-facing: emails, recommendations, form submissions.
- Ask vendors for logs. Can you see what the tool did, when, and from which prompt or meeting?
- Review vendor AI configurations. Understand how each vendor uses AI, its data controls and its settings, and update your supervisory procedures to match (DLA Piper).
- Don't overstate AI in marketing. Describing your AI accurately matters; regulators have pursued "AI washing" cases, and the SEC's 2026 exam priorities check AI claims too (our guide to the SEC priorities; Foley & Lardner).
A quick checklist
- Inventory every AI tool and feature, including those built into your CRM and email.
- Classify each as assistant (drafts, you approve) or agent (acts on its own).
- Write the approval points and logging requirements into your supervisory procedures.
- Add AI questions to vendor due diligence: training on your data, retention, logs, breach notice.
- Review a sample of AI outputs monthly, and record that you did.
Comparing tools? See our guide to AI notetakers for financial advisors, and the recordkeeping rules for AI notes.
FAQ
Does FINRA's report create new rules for AI?
No. It applies existing rules and describes what FINRA has seen and what it considers effective practice. It does signal what examiners will ask about.
Is an AI notetaker an "AI agent"?
A notetaker that only transcribes and summarizes is generally not an agent. If it also sends emails, updates records or files paperwork on its own, it starts to behave like one, and FINRA's agent guidance becomes relevant.
Do we need to keep AI prompts and outputs?
FINRA's report includes prompt and output logging as part of effective monitoring. Separately, communications and records your rules already require you to keep stay required when AI produces them.
Sources
Pages we used for this article, checked on or before the update date above.
- Debevoise & Plimpton · debevoise.com
- Regulatory Notice 24-09 · finra.org
- DLA Piper · dlapiper.com
- Goodwin · goodwinlaw.com
- Amy Hirschi · unsplash.com
- Foley & Lardner · foley.com
Changelog: Oct 13, 2026: first published.