FINRA issues Regulatory Notice 24-09 on generative AI and LLMs

Regulatory Notice 24-09 is guidance from the Financial Industry Regulatory Authority reminding its member firms that existing FINRA rules and federal securities laws apply to generative artificial intelligence and large language model tools just as they apply to any other technology. FINRA issued the Notice on June 27, 2024, and it is classified as guidance rather than a new rule.

What it is

The Notice is titled FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models. It confirms that FINRA's rules are meant to be technology neutral and that the Notice itself does not relieve member firms of any existing obligations under federal securities laws and regulations.

What it requires

The core principle is that the rules apply when member firms use AI, including Gen AI or similar technologies, in the course of their business, just as they apply when member firms use any other technology or tool. For supervision, if a firm is using Gen AI tools as part of its supervisory system, its policies and procedures should address technology governance, including model risk management, data privacy and integrity, reliability and accuracy of the AI model. For communications, FINRA has provided guidance that the content standards of Rule 2210 apply whether member firms' communications are generated by a human or technology tool. These obligations attach whether a firm builds Gen AI tools itself or uses a third party's technology, including embedded features in existing products. Depending on how a firm uses Gen AI, FINRA says such use could implicate virtually every area of a member firm's regulatory obligations.

What security leaders should do

Security and compliance leaders should evaluate Gen AI tools before deployment and confirm ongoing compliance with the rules applicable to the business use of those tools, since a member firm should evaluate Gen AI tools prior to deploying them and ensure that the member firm can continue to comply with existing FINRA rules applicable to the business use of those tools. They should document technology governance, model risk management, data privacy and integrity, and output reliability controls before letting Gen AI touch supervisory or customer-facing workflows, map AI-assisted communications into existing Rule 2210 review paths, and extend vendor due diligence to any third party or embedded Gen AI feature rather than treating it as outside the firm's regulatory perimeter. Firms with ambiguity about how a specific rule applies to their Gen AI use can seek FINRA's interpretive guidance process.