SEC and FINRA Rules on AI for Advisors

Both regulators describe their rules as technology-neutral: what matters is the activity, not the tool that performs it. For FINRA member broker-dealers, the key rules are these. Rule 3110 requires a supervisory system reasonably designed to achieve compliance, which covers how AI tools are approved, monitored and tested. Rule 2210 governs communications with the public. A written communication distributed or made available to more than 25 retail investors within any 30-calendar-day period is a retail communication. One sent to 25 or fewer is correspondence. Each category has its own content standards and review requirements, and firms have to decide how chatbot output and AI-drafted material fits. Rule 4511, together with Securities Exchange Act Rules 17a-3 and 17a-4, requires firms to create and keep business records. That can include prompts and outputs when they are business communications. Regulation Best Interest applies whenever a recommendation reaches a retail customer, whether a person or a model produced it. For registered investment advisers, the Advisers Act fiduciary duty of care and loyalty applies. So do the compliance program rule (Rule 206(4)-7), the books and records rule (Rule 204-2) and the Marketing Rule (Rule 206(4)-1), which covers any claims a firm makes about its own AI. In July 2023 the SEC proposed a rule on conflicts of interest from predictive data analytics. The Commission withdrew that proposal in June 2025. A common misconception is that the withdrawal left AI unregulated. Conflicts, supervision failures and misleading statements are still addressable under existing rules, and SEC examination priorities have continued to mention AI. Vendor tools raise their own issue. FINRA has said that outsourcing a function does not outsource the responsibility for it.