FINRA Rule 3110 and AI Supervisory Review: What a Defensible System Requires

What Rule 3110 requires of a supervisory system

Rule 3110(a) requires each member to establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations and FINRA rules. The rule states that final responsibility for proper supervision rests with the member.

At a minimum, the system must provide for written procedures and, where applicable, designation of appropriately registered principals with authority to carry out the member's supervisory responsibilities for each type of business. Rule 3110(b) requires the member to establish, maintain and enforce written supervisory procedures (WSPs) reasonably designed to achieve compliance.

Two requirements matter most for AI. The WSPs must provide for review by a registered principal, evidenced in writing, of transactions relating to the member's investment banking or securities business. Reviews of correspondence and internal communications must also be conducted by a registered principal and evidenced in writing, electronically or on paper. FINRA's supervision guidance adds that WSPs should list the specific individuals responsible for each review, the supervisory activities they will perform and the review frequency.

How FINRA expects its rules to apply to AI

FINRA's position is technology neutral. Regulatory Notice 24-09, issued in June 2024 and still cited in FINRA's current oversight reporting as of November 2026, states that FINRA rules apply when members use AI, including generative AI, just as they apply to any other technology or tool. The notice says members should evaluate these tools before deployment and confirm they can still comply with existing rules.

The notice also addresses the case at hand. If generative AI is part of the supervisory system, for example to review electronic correspondence, policies and procedures should address technology governance, including model risk management, data privacy and integrity, and the reliability and accuracy of the model. FINRA's report on AI in the securities industry adds that firms using AI-based tools should update and test related supervisory procedures and reflect those updates in their WSPs.

The 2026 Annual Regulatory Oversight Report lists example controls for firms that rely on generative AI as part of a supervisory system: formal review and approval involving business and technology experts, stored prompt and output logs, tracking of which model version was used and when, and human-in-the-loop validation of outputs with regular checks for errors or bias.

Where assistance ends and delegation begins

The rule text assigns review to a registered principal and requires that review to be evidenced in writing. The rule does not mention AI. A defensible reading is therefore that AI output can inform the principal's review, but the recorded reviewer and decision-maker should be the principal. This is an inference from the text, and it is the conservative design for an examination.

In practice, assistance looks like AI screening a population of communications, ranking items by risk, summarizing context or drafting a rationale for a principal to accept, change or reject. Delegation looks like AI closing items without principal review, or a principal approving in bulk without seeing the basis for each determination. The second pattern leaves the written evidence of principal review thin, and it leaves the firm answerable for decisions no accountable person made.

The test is whether the principal's determination is a separate, attributable action. If the record shows only that the system cleared an item, the firm cannot show the review the rule requires. Accountability does not transfer to the tool or its vendor, because final responsibility rests with the member.

What an examiner would reasonably ask to see

Examiners test whether the firm can show what its system was designed to do, what it did, and who decided. For an AI-assisted review, that translates into three questions. What was the tool permitted to access and do? What did it do for the sample the examiner selected? How did a principal review and, where needed, escalate the result?

The first question is answered by written procedures and by the limits actually enforced on the tool. A policy document alone shows intent. The second is answered by interaction-level records such as prompts, outputs and the model version in use at the time. The third is answered by the principal's written determination and the escalation trail.

Model risk management scrutiny follows the same lines. Reviewers will ask how the firm validated accuracy and reliability, how it detects drift or error, and whether the model in production is the model that was approved. Records generated at the time of each action are more persuasive than summaries assembled when an exam request arrives.

Runtime policy enforcement and audit-ready evidence

Limits that exist only as written policy depend on users and developers following them. Enforcing policy in the execution path means each model interaction and tool call is checked against policy as it happens, and the outcome is one of a defined set: allow, redact, block, or escalate for human approval. For supervisory use, escalation matters most, because it routes a determination to a principal instead of letting the tool proceed.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, at the level of individual interactions and tool calls. Enforcement generates audit-ready evidence as a by-product, so the record of what was allowed, redacted, blocked or escalated exists without separate reconstruction. Trussed has run continuously in production in a regulated enterprise for more than 18 months, and its deepest experience is in insurance. It has no financial-services deployments to point to, and it makes no claim of Rule 3110 certification.

The scope is deliberate. Enforcement and evidence cover individual interactions and tool calls. The firm's WSPs, the principal's written determination and validation results remain the firm's own records, and a complete supervisory file combines them with the enforcement evidence.