FINRA Rule 3110 Supervision of Copilot Studio Agents: Who Reviews What

What Rule 3110 requires, and how it reaches agents

Rule 3110 requires each member to establish and maintain a system to supervise the activities of each associated person, reasonably designed to achieve compliance with securities laws and FINRA rules. Final responsibility for supervision rests with the member. The rule calls for written supervisory procedures covering the types of business the firm conducts, designated principals with authority over each type of business, and review of incoming and outgoing correspondence and internal communications.

Regulatory Notice 24-09 states that FINRA rules apply to AI, including generative AI, as they do to any other technology. That holds whether the firm builds the tool or uses third-party technology, including embedded features in existing products. The 2026 Annual Regulatory Oversight Report goes further and describes AI agents as systems that can autonomously perform and complete tasks on behalf of a user. It identifies risks including autonomy (acting without human validation and approval), scope and authority (acting beyond the user's actual or intended scope), and data sensitivity.

A Copilot Studio agent can retrieve data, generate outputs, and call tools and connectors. Each of those capabilities is a point where a supervisory question arises. The rule is a framework the firm owns, so the work is to decide who answers each question and to show that the answer was acted on. As of November 2026, FINRA's rulebook lists a version of Rule 3110 among immediately effective rule changes pending SEC notification, so confirm current rule text when updating procedures.

A role-by-role review matrix

Rule 3110 requires designated principals and assigned supervisors. It does not prescribe how compliance, security and model risk functions divide agent review. The matrix below is one defensible allocation. Whatever the firm chooses should be written into its procedures. FINRA looks first to senior business management and supervisors when a failure to supervise occurs, and Regulatory Notice 22-10 describes the chief compliance officer's role as advisory unless the firm designates supervisory responsibility in its procedures or otherwise.

• Agent owner: Documents intended scope and authority, the data sources and tools the agent may use, and the business line it supports. Operates the agent. Does not approve or review its own agent's supervised output.
• Supervising principal: Designated for the business line under Rule 3110(a)(2). Reviews outputs that function as correspondence, internal or public communications. Approves or denies escalated actions.
• Compliance: Advises on written procedures, defines sampling and escalation criteria, and tests whether review is occurring. Takes supervisory liability only if the firm assigns it.
• Information security and IT: Governs identity, authentication, connector and knowledge-source access, and data sensitivity limits. Investigates actions outside intended scope.
• Model risk management: Reviews the agent before deployment with business and technology participants. Monitors performance and drift, and maintains lifecycle documentation.

Separating limits, approval and after-the-fact review

Not every agent action deserves the same treatment. The following split is an editorial inference from FINRA's emphasis on human validation and approval for autonomous agents, not a rule requirement. It helps keep principals from reviewing everything or nothing.

• Pre-defined policy limits: Actions bounded tightly enough to decide in advance: which knowledge sources an agent may read, which connectors it may call, which data it must redact, which actions it must never take. These are enforced when the action occurs.
• Human approval before execution: Actions that move funds or securities, change customer instructions, send external communications, or exceed the agent's defined scope. A named principal approves or denies, and the decision is recorded.
• After-the-fact review: Lower-risk, high-volume interactions such as internal drafting or summarization. Compliance and principals review samples against defined criteria and document findings.

Review points: inputs, outputs, tool calls and escalations

Inputs and retrieval raise data sensitivity questions. Security owns which sources an agent may query and under whose identity. The agent owner owns the stated purpose, and the principal confirms that purpose fits the supervised business line.

Outputs raise communications questions. Regulatory Notice 24-09 states that Rule 2210 content standards apply whether a communication is generated by a human or a technology tool. The design should let outputs that qualify as correspondence, internal communications or public communications be identified and routed to a principal, rather than leaving classification to whoever happens to read the chat.

Tool calls raise scope and authority questions. A connector call that writes to a system of record differs from one that reads a reference document. Each tool an agent can call should be inventoried with its permitted use, so an out-of-scope call is detectable.

Escalations raise accountability questions. When an agent hands a decision to a human, the firm needs to know who received it, what they saw, and what they decided. Independence matters here: Rule 3110(b)(6) requires procedures prohibiting supervisory personnel from supervising their own activities, so the person who builds or operates an agent should not be the one approving its consequential actions.

The same logic applies to vendor-provided and embedded AI features. Notice 24-09 does not carve them out, so the inventory should cover them as well as firm-built agents.

Where runtime enforcement supports the supervisory system

Review that happens only after the fact tells a firm what went wrong. Policy enforced at runtime changes what can go wrong, and the enforcement decision itself becomes a record. A firm can allow, redact, block or escalate an interaction or tool call for human approval, and each decision produces evidence of what the agent was permitted to do and what it did. That evidence gives principals, compliance and model risk a common record to review. It does not replace their judgment, and no tool satisfies Rule 3110 on its own.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers: allow, redact, block, rate limit, and escalate for human approval, at the level of individual interactions and tool calls. Enforcement generates continuous, audit-ready evidence. Trussed can be self-managed in the customer's cloud, with configurable retention and data residency. Its deepest experience is in insurance, a regulated financial sector, and the evidence it produces is framed around examiner scrutiny and model risk management. Trussed does not claim a FINRA mapping or Rule 3110 certification, and the supervisory system remains the firm's to design, run and defend.

When evaluating any approach, native or third-party, ask three questions. Is the policy applied before the action completes? Does the record show the decision, not just the activity? Can the firm produce it for a specific agent and period without reconstruction?