Follow the rules, ask questions when using gen AI, Finra tells firms

Finra has issued a reminder to member firms regarding their regulatory obligations when incorporating generative AI and similar tools into their operations.

In a notice Thursday, the watchdog emphasized that its rules as well as securities laws in general remain applicable, even as firms adopt advanced technologies like gen AI.

“Finra reminds its member firms that Finra’s rules... continue to apply when member firms use Gen AI or similar technologies in the course of their businesses,” Finra said.

While stressing that it’s not introducing new legal requirements or interpretations of its rules, the self-regulator highlighted the ongoing relevance of existing regulations under federal securities laws.

It said the rapid advancement of AI technology in the 2020s creates new factors to consider. With the appearance of gen AI, firms can generate high-quality text, synthetic data, images, and other media, unlocking new opportunities and risks.

Finra highlighted other use cases for gen AI tools, such as analyzing vast sets of financial and market data, summarizing complex documents, enhancing educational resources for investors. Beyond that, the technology can assist associated persons in querying firm policies, generating research summaries, and obtaining issuer-specific information from SEC filings and earnings call transcripts.

This week, Morgan Stanley took another step on its gen AI journey as it unveiled a tool for advisors to generate notes from client meetings, subject to clients’ approval.

"While these potential uses are promising, the development of gen AI also has been marked by concerns about accuracy, privacy, bias, intellectual property, and possible exploitation by threat actors, among others," the notice said.

Finra said member firms must ensure their supervisory systems are well-designed and tailored to their business when using gen AI tools, particularly under Rule 3110. This includes addressing technology governance, model risk management, data privacy and integrity, and the reliability and accuracy of AI models.

Those rules apply whether firms develop gen AI tools in-house or utilize third-party technologies, Finra stressed, adding that the applicable rules will depend on how the technology is deployed.

"Finra will consider issuing further guidance on how particular rules may apply with respect to specific use cases," it said.

The watchdog highlighted its earlier clarification around Rule 2210 in May, reiterating that the rule applies to communications generated by both humans and AI tools.

“Depending on the ways in which a member firm may use Gen AI, such use could implicate virtually every area of a member firm’s regulatory obligations,” it said.

Firms encountering ambiguity in applying Finra rules to their specific use of gen AI can seek interpretive guidance from the regulator, it said, further encouraging firms to maintain ongoing discussions with their risk monitoring analyst regarding AI-related issues or other business changes.

The watchdog also invited general feedback on how its rules might be modernized in light of gen AI and other emerging technologies, noting that it’s keeping the door open to further guidance or rule amendments as necessary.