AI Chatbot Responses Under FINRA Rule 2210: Correspondence or Retail Communication?

What Rule 2210 says about the three categories

Rule 2210(a) sorts written communications, including electronic ones, by audience and by how many people receive them. Correspondence is a written communication distributed or made available to 25 or fewer retail investors within any 30 calendar-day period. A retail communication is one distributed or made available to more than 25 retail investors within any 30 calendar-day period. An institutional communication is distributed or made available only to institutional investors, and it does not include a member's internal communications.

A retail investor is any person other than an institutional investor, whether or not the person has an account with the firm. Institutional investors include entities with at least $50 million in assets, among other listed categories. All three definitions turn on whether the communication is distributed or made available, so a prospect who is not yet a customer still counts toward the retail total.

The category matters because it sets the controls. A registered principal must approve each retail communication before the earlier of its use or filing with FINRA's Advertising Regulation Department. Correspondence is instead subject to the supervision and review requirements of Rules 3110(b) and 3110.06 through .09, and members may adopt alternative supervisory procedures for correspondence and institutional communications.

What FINRA has said about chatbots and generative AI

FINRA's Rule 2210 FAQ, dated December 2025, addresses chatbots directly. Communications created with AI and used with investors may be correspondence, retail or institutional communications depending on the nature and number of persons receiving them. The firm must supervise them under Rules 2210(a), 2210(b) and 3110(b)(4) with 3110.06 through .09, and the content must be consistent with standards such as Rule 2210(d). FINRA also states that firms are responsible for their communications whether a human or AI generated them.

Regulatory Notice 24-09 takes the same technology-neutral position: FINRA rules apply when a firm uses generative AI as they would for any other tool, and the applicable rules depend on how the firm deploys it. The notice says firms should evaluate these tools before deployment.

Two developments bear on pre-use approval. Regulatory Notice 26-14 acknowledges that principal pre-use approval presents significant challenges for some categories of retail communications, including some generated by AI. It also describes retail communications that are not subject to pre-use approval, such as those posted on an online interactive electronic forum or that make no financial or investment recommendation and do not promote a member product or service. Those may be supervised more flexibly, like correspondence. A proposed Rule 2210 change was also noticed in the Federal Register in February 2026. As of November 2026, firms should treat the current approval requirement as the operative text while monitoring both items.

How chatbot behavior affects the analysis

FINRA's own examples tie classification to audience size and content. An answer given to a live question in a meeting with fewer than 25 retail investors is correspondence, while a file promoting a new mutual fund posted to more than 25 retail investors is a retail communication needing pre-use approval. Those are conferencing examples, and they do not map cleanly onto a chatbot.

A chatbot generates each response per interaction, so wording can differ between users and between sessions. The same underlying answer can still be repeated to many people. Whether similar outputs sent to different users count as one communication distributed to many, or as many separate one-to-one exchanges, is not addressed in published guidance and remains an open analytical question. A firm that treats every exchange as correspondence is taking a position that depends on that unresolved counting question, and it should document the reasoning.

Several deployment characteristics are relevant to that reasoning, though FINRA has not said how each one changes the outcome. A genuinely one-to-one exchange differs from a standardized or templated output. Retrieval from pre-approved content differs from free generation. A chatbot that answers purely informational questions may fall within the no-recommendation, no-promotion treatment described in Regulatory Notice 26-14, but that application has not been confirmed for chatbots. Escalation to a human reviewer changes who reviews content before it reaches the investor. Each of these should be a recorded design decision, not an assumption.

Where runtime policy enforcement fits

Classification is a legal judgment, and no tool makes it. Trussed does not determine Rule 2210 classification and does not guarantee compliance. What a firm can evaluate is whether its controls operate on each response and leave a record.

Trussed enforces policy in the execution path for individual interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. For a chatbot, this means a check applied at runtime to each output, not reviewed after the fact. An escalation event produces a record of the human approval, and a block or redaction event produces a record of what the policy stopped. The audit-ready evidence generated by that enforcement shows what the AI was allowed to do and what it did, which is the framing examiners and model risk management functions apply. Whether such records satisfy Rule 3110 or SEA Rule 17a-4 is a determination for the firm and its counsel.

Trussed is self-managed in the customer cloud, with configurable retention and data residency. It has run 18+ months in continuous production in a regulated enterprise, and insurance, a regulated financial sector, is where it is deepest. Its evidence is mapped to frameworks including NAIC, NYDFS and NIST. It does not claim a FINRA mapping, so firms should test fit against the checklist above.