Registered Principal Accountability for an AI Agent at a Broker-Dealer

What the existing rules already say about agents

As of November 2026, the sources reviewed show no FINRA or SEC rule written specifically for agentic AI. FINRA states that its rules are technology neutral and continue to apply when member firms use GenAI or similar technologies, as with any other tool. For a compliance leader, the question is therefore how existing obligations attach to a system that acts, not whether new ones exist.

Rule 3110 requires each member to maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with securities laws and FINRA rules. It also requires designation of an appropriately registered principal with authority to carry out supervisory responsibilities for each type of business the firm conducts. Reviews of correspondence and internal communications must be performed by a registered principal and evidenced in writing.

Communications rules follow the content. FINRA's Rule 2210 FAQ states that AI chatbot communications used with investors may be correspondence, retail communications, or institutional communications, depending on the nature and number of recipients. Retention follows as well. FINRA Regulatory Notice 25-07 describes Exchange Act Rule 17a-4(b)(4) as requiring preservation of originals of communications received and copies of communications sent relating to the firm's business, with FINRA rules requiring supervision and retention of internal and external communications for that period.

FINRA's 2026 Annual Regulatory Oversight Report is guidance, not a rule. Its GenAI section names four agent risks: autonomy, meaning action without human validation and approval; scope and authority, meaning action beyond the user's actual or intended scope; auditability and transparency, because multi-step reasoning is hard to trace; and data sensitivity. It says firms may wish to consider agent-specific supervisory processes.

Assigning a registered principal to an agent

The rule text does not say whether an AI agent is an associated person, and it does not describe how the Rule 3110(a)(5) requirement to assign each registered person to a supervising representative or principal applies to agents. Treat the following as a design interpretation. A firm that cannot name one accountable principal for each agent has no basis for showing reasonable supervision of it, so assignment should be explicit in the written supervisory procedures (WSPs).

Ownership is where this usually breaks down. A business line requests the agent, a technology team builds and runs it, and compliance reviews the policy. None of those roles is automatically a Rule 3110 designation. Reconcile them against the principal designated for each type of business. Where an agent spans business lines, for example drafting client communications and retrieving account data, the WSPs should state which principal answers for which actions rather than assigning the agent to a single owner by default.

Delegation is permitted within limits. Supplementary Material .08 allows certain correspondence and internal communication review functions to be delegated to persons who need not be registered. The principal remains ultimately responsible for all necessary supervisory reviews. The principal must take reasonable and appropriate action to ensure delegated functions are properly executed and should evidence performance of the procedures well enough to demonstrate overall supervisory control. Using an automated reviewer or a technology team as the delegate does not change that structure.

Scope, runtime enforcement and human approval

A principal cannot supervise what has not been defined. The first component is a written scope: the specific actions the agent may take, the tools it may call, and the data it may reach. FINRA identifies acting beyond intended scope and authority as an agent risk, so the scope should be a concrete list rather than a general statement of purpose. A distinct agent identity, separate from human users and service accounts and tied to a responsible individual, supports this. NIST has proposed that direction in its agent identity design tenets, as a starting point for design and not as a regulatory requirement. The same tenets suggest that authority passed to sub-agents should never exceed the parent's.

The second component is enforcement. A scope that exists only in a policy document depends on the agent behaving as described. Enforcement at runtime means each tool call or data request is checked against the scope as it occurs, with a defined outcome: allow, redact, block, or escalate.

The third component is human approval. FINRA's autonomy risk refers to agents acting without human validation and approval, and its report lists human-in-the-loop validation of outputs among possible controls. The WSPs should set thresholds that trigger principal approval. Examples a firm might consider include communications that would be retail communications, access to account data outside the agent's defined scope, and tool calls that change a customer record. The thresholds are a firm judgment. What matters is that they are written, applied consistently, and that each approval is recorded with who approved what and when.

Evidence a principal and an examiner would look for

Examiners expect written procedures and records. For an agent, the principal needs to show three things: what the agent was permitted to do, what it actually did, and when a human reviewed or approved it. FINRA's report points to prompt and output logs for accountability, tracking which model version was used and when, human-in-the-loop validation, and monitoring of agent system access and data handling. Because multi-step reasoning is difficult to trace, records at the level of individual tool calls are what make an after-the-fact explanation possible.

In practice this means retaining the agent's scope as it stood on a given date, the prompts and outputs, model version, tool and data access, approval events, and how exceptions were handled. Agent-generated communications also need classification under the Rule 2210 categories so the correct review path applies, and copies of communications sent and received need to be retained under the Rule 17a-4(b)(4) framework. Principal review, including any performed through delegated functions, should be evidenced in writing in enough detail to demonstrate supervisory control.

The test is retrieval. For a named agent and a specific date, can the firm produce the permitted scope, the activity, the approvals, and the exceptions without reconstructing them from several teams' systems?

Where runtime enforcement supports the supervisory record

Trussed enforces policy in the execution path across models, agents, tools and MCP servers. For each interaction or tool call, policy is enforced at runtime, not reviewed after the fact: the outcome is allow, redact, block, rate limit, or escalate for human approval. That maps directly to two of the components above, a scope that is applied rather than described, and approval points that a principal can define and rely on.

The same enforcement produces audit-ready evidence of what was permitted and what happened, which is the material a principal needs when an examiner asks for the supervisory record. Trussed supports self-managed deployment in the customer's cloud, with configurable retention and data residency. Trussed does not replace the principal's judgment, the WSPs, or the firm's retention and communications review obligations. It supplies enforcement and evidence for the individual interactions and tool calls those obligations depend on.

Trussed's depth is in insurance, a regulated financial sector, where examiner scrutiny and model risk management expectations shape how AI is run. It has 18+ months of continuous production in a regulated enterprise, 99.95% uptime on live production traffic, and 100+ models under one policy plane, with customers across four regulated verticals. Firms evaluating any approach should ask the same questions as in the checklist above, and test whether enforcement and evidence are produced by the system itself.