FINRA Regulatory Notice 21-29 and AI Vendors: Supervising LLM Providers and AI Agent Vendors

What Notice 21-29 states

Regulatory Notice 21-29, published August 13, 2021, is titled "FINRA Reminds Firms of their Supervisory Obligations Related to Outsourcing to Third-Party Vendors." It does not create new obligations. It reminds member firms to establish and maintain a supervisory system, including written supervisory procedures (WSPs), for activities or functions performed by third-party vendors, including sub-vendors. That system must be reasonably designed to achieve compliance with applicable securities laws and regulations and FINRA rules.

The obligation under Rule 3110 extends to outsourced "covered activities," meaning activities or functions that would require a supervisory system and WSPs if the firm performed them directly. The Notice quotes earlier guidance that outsourcing "does not relieve members of their ultimate responsibility for compliance" with applicable securities laws and FINRA and MSRB rules.

The Notice also summarizes trends in exam findings, observations and disciplinary actions, and poses questions firms may consider when evaluating vendors. FINRA states there is no one-size-fits-all approach. Firms use risk-based approaches, with different levels of oversight depending on the activity or function. After due diligence and selection, firms may wish to consider a written contract addressing both the firm's and the vendor's roles for outsourced regulatory obligations. Oversight approaches it lists include documentation evidencing compliance by responsible parties and vendors, vendor attestations or certifications that obligations were fulfilled, and onsite vendor testing or observation depending on risk-based factors.

Extending the Notice to LLM providers and AI agent vendors

FINRA's later materials connect the Notice to AI. Notice 24-09 (June 2024) says FINRA rules are technology neutral and apply whether a firm develops Gen AI tools itself or uses a third party's technology, including embedded features in existing third-party products. It tells firms to evaluate Gen AI tools before deploying them and to ensure they can keep complying with FINRA rules. It states that it creates no new legal or regulatory requirements. The 2025 oversight report's third-party risk section cites Rules 3110 and 4370 and Regulation S-P as examples of rules for which vendor-performed activities must be supervised, and it also cites Notice 24-09.

The 2026 oversight report expects a reasonably designed supervisory system, including WSPs, for outsourcing, and encourages a supervision, governance or model risk management framework for GenAI. It adds that firms exploring AI agents may wish to consider whether an agent's autonomous nature raises novel regulatory, supervisory or operational considerations.

The following points are reasonable extensions, not stated requirements. First, an LLM provider performing or supporting a covered activity is a vendor, and its upstream or downstream providers may fall within the sub-vendor language. Second, vendor AI can enter through non-AI products, so the vendor inventory should include embedded Gen AI features. Third, an AI agent vendor whose agent generates outputs, calls tools or touches customer and firm data raises the same supervision question the Notice asks of any vendor, with less visibility into behavior. Firms with open questions can raise them through an interpretive request or their Risk Monitoring Analyst.

What due diligence can establish and what only runtime evidence can

Contract review, questionnaires and attestations are valuable, but they are point-in-time or periodic. Ongoing supervision of a vendor model or agent in live use needs a record of individual interactions and tool calls. This split is an inference from the Notice's oversight approaches, not language in the Notice.

• Data handling: Due diligence: the vendor's stated data practices and contract terms. Runtime evidence: which customer or firm data actually reached the model, and what was redacted or blocked.
• Access and tool use: Due diligence: the vendor's described permissions model. Runtime evidence: which tools an agent called, under what policy, and with what outcome.
• Change management: Due diligence: the vendor's change notification commitments. Runtime evidence: the policy and model configuration in force when a given output or action occurred.
• Performance monitoring: Due diligence: periodic reviews and attestations. Runtime evidence: a continuous record of allowed, redacted, blocked and escalated actions.
• Supervisory review: Due diligence: WSPs that assign reviewers. Runtime evidence: a record that a human approved or rejected a specific high-risk action.

What the firm retains regardless of the vendor

Ultimate responsibility for covered activities stays with the firm. A vendor's certification that its model is safe does not discharge the firm's duty to supervise how that model is used in the firm's processes. The firm keeps the obligation to maintain WSPs that address the vendor's activity, to apply oversight proportionate to risk, to manage the vendor relationship from onboarding through ongoing monitoring to off-boarding, and to supervise changes to or integration of vendor systems.

That last point reflects FINRA's 2022 exam findings, which cited firms with no formal documented policies for reviewing vendors' cybersecurity controls, no lifecycle management for vendors, and inadequate supervision of technology changes, including changes to or integration of vendor systems, that led to books-and-records and data-integrity violations. Model and agent updates are a plausible AI analogue, so it is prudent to log their review before they affect regulated activity.

The firm also decides how a tool is deployed, and the applicable rules depend on that deployment. A vendor cannot make that determination on the firm's behalf.

Enforcing policy in the execution path as a supervisory record

As of November 2026, the guidance reviewed here does not prescribe runtime enforcement mechanisms. The following is an extension of the Notice, offered as one way to keep supervision with the firm rather than with the vendor.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers. Each individual interaction or tool call can be allowed, redacted, blocked, rate limited or escalated for human approval, and enforcement happens at runtime, not through review after the fact. Because the firm sets the policy, the vendor's model or agent operates inside limits the firm defined. Each enforcement decision generates audit-ready evidence of what the AI was allowed to do and what it did. Scope is individual interactions and tool calls. Trussed does not trace entire agentic workflows end to end.

For a firm's supervisory file, that evidence can complement vendor attestations. It speaks to live use and to model risk management, which is where examiner scrutiny of AI vendors is likely to concentrate. Trussed deploys self-managed in the customer cloud, with configurable retention and data residency, so the firm controls where evidence is stored and for how long. The platform has run continuously in a regulated enterprise production environment for more than 18 months and holds SOC 2 Type II and ISO 27001, among other certifications. Insurance is its deepest regulated sector. Firms should confirm separately how any evidence maps to their own recordkeeping obligations.

Evidence an examiner would reasonably ask for

The Notice's oversight approaches point to the likely categories. An examiner reviewing an AI vendor relationship would reasonably expect the vendor inventory, the due diligence file, the executed contract, the WSPs covering the activity, and attestations or certifications. For AI specifically, it is reasonable to expect questions about what the model or agent could access, what it did with customer and firm data, how changes were reviewed, and who approved high-risk actions. These are anticipated questions, not stated requirements.

Books-and-records treatment of AI-generated or agent-executed activity depends on the activity and the rules that apply to it. Confirm that analysis with counsel and your regulatory contacts, and keep the conclusion in the supervisory file. A useful test is whether, for a single disputed output or tool call, the firm can show the policy in force, the data involved, the decision taken and any human approval. If it can only show the vendor's contract and last year's questionnaire, the supervisory record has a gap.