# 2026 FINRA Annual Regulatory Oversight Report: 2026 FINRA Annual Regulatory Oversight Report: GenAI: Continuing and Emerging Trends

Source: https://www.bankingnewsai.com/ai-regulation/documents/finra-annual-regulatory-oversight-report-2026
Last updated: Oct 5, 2026

FINRA's 2026 Annual Regulatory Oversight Report, published December 9, 2025, adds a section 'GenAI: Continuing and Emerging Trends', marked 'NEW FOR 2026'. It restates that FINRA rules and the securities laws apply to GenAI 'just as they apply when firms use any other technology or tool', reports that firms focus on efficiency in internal processes and information retrieval with 'Summarization and Information Extraction' the top use case, and lists what firms may consider on governance, testing and monitoring. It also adds a discussion of AI agents, naming six risks: autonomy, scope and authority, auditability and transparency, data sensitivity, domain knowledge, and misaligned reward functions. The report is observational guidance for broker-dealers, not a rule.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) |
| Type | Report |
| Status | In force |
| Published | Dec 9, 2025 |
| Effective | Dec 9, 2025 |
| Applies to | FINRA member firms (registered broker-dealers), including those owned by bank holding companies. The report is addressed to member firms; banks themselves are outside FINRA's membership. |
| Official text | https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai |

## Key points

- The report is dated December 9, 2025; the GenAI section is flagged 'NEW FOR 2026'.
- Regulatory obligations: GenAI can implicate rules on supervision, communications, recordkeeping and fair dealing; under Rule 3110 a firm relying on GenAI as part of its supervisory system may consider the integrity, reliability and accuracy of the model.
- Use portfolio: based on a FINRA survey of firms and engagement with other regulators, the top GenAI use case is 'Summarization and Information Extraction'; firms focus on efficiency gains in internal processes and information retrieval.
- Risks to consider: hallucinations (inaccurate or misleading output presented as fact) and bias (including outdated training data leading to concept drift), plus cybersecurity risks from firms' and vendors' GenAI use and threat actors' use of AI.
- Supervision and governance: formal review and approval processes with business and technology experts, and a supervision, governance or model risk management framework with comprehensive documentation.
- Testing and monitoring: robust testing of privacy, integrity, reliability and accuracy; ongoing monitoring of prompts, responses and outputs, which may include storing prompt and output logs, tracking which model version was used and when, and human-in-the-loop review.
- AI agents: systems that autonomously perform and complete tasks for a user; risks are autonomy, scope and authority, auditability and transparency, data sensitivity, domain knowledge, and rewards and reinforcement.
- For agents, firms may consider monitoring system access and data handling, where to place human-in-the-loop oversight, tracking agent actions and decisions, and guardrails limiting agent behavior.

## What changed for banks

The 2026 report adds a GenAI section flagged 'NEW FOR 2026' that includes a discussion of AI agents. It turns the general reminder in Regulatory Notice 24-09 into a list of considerations for governance, testing and monitoring, and it flags agentic AI as an area where supervision may need to be specific to the type and scope of agent.

## Use cases it governs

- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)

## What does the FINRA 2026 Annual Regulatory Oversight Report require of firms using GenAI and AI agents?

The 2026 FINRA Annual Regulatory Oversight Report, published December 9, 2025, does not impose new requirements; it says FINRA's technology-neutral rules and the securities laws apply to GenAI as to any technology and that GenAI can implicate supervision, communications, recordkeeping and fair dealing. In a section new for 2026, it lists what firms contemplating GenAI may consider: supervisory processes at enterprise level, mitigation of hallucination and bias, cybersecurity that covers vendors and threat actors' use of AI, formal review and approval, a governance or model risk management framework, robust testing, and ongoing monitoring of prompts and outputs. It also adds a discussion of AI agents, whose autonomy may call for supervisory processes specific to the agent's type and scope. These considerations apply to broker-dealers; a bank group should apply them to its FINRA-member affiliates.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| GenAI section — Regulatory Obligations (Rule 3110) | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) | Using GenAI can implicate supervision, communications, recordkeeping and fair dealing rules; a firm relying on GenAI in its supervisory system may consider the integrity, reliability and accuracy of the model. | Published December 9, 2025 | [2026 FINRA Annual Regulatory Oversight Report](https://www.bankingnewsai.com/ai-regulation/documents/finra-annual-regulatory-oversight-report-2026) |
| GenAI section — Accuracy and bias | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) | Firms may consider approaches to identify and mitigate hallucinations (inaccurate or misleading output presented as fact) and bias, including outdated training data leading to concept drift. | Published December 9, 2025 | [2026 FINRA Annual Regulatory Oversight Report](https://www.bankingnewsai.com/ai-regulation/documents/finra-annual-regulatory-oversight-report-2026) |
| GenAI section — Cybersecurity | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) | Assess whether the cybersecurity program contemplates risks from the firm's and its vendors' use of GenAI and how tools, data provenance and processes identify threat actors' use of AI against the firm or customers. | Published December 9, 2025 | [2026 FINRA Annual Regulatory Oversight Report](https://www.bankingnewsai.com/ai-regulation/documents/finra-annual-regulatory-oversight-report-2026) |
| GenAI section — Supervision and governance | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) | Implement formal review and approval processes with business and technology experts, and a supervision, governance or model risk management framework with clear policies and comprehensive documentation. | Published December 9, 2025 | [2026 FINRA Annual Regulatory Oversight Report](https://www.bankingnewsai.com/ai-regulation/documents/finra-annual-regulatory-oversight-report-2026) |
| GenAI section — Testing and monitoring | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) | Test GenAI for privacy, integrity, reliability and accuracy, and monitor prompts, responses and outputs, which may include prompt and output logs, model-version tracking and human-in-the-loop review. | Published December 9, 2025 | [2026 FINRA Annual Regulatory Oversight Report](https://www.bankingnewsai.com/ai-regulation/documents/finra-annual-regulatory-oversight-report-2026) |
| GenAI section — Emerging Trends: Agents | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) | For AI agents, consider supervisory processes specific to the agent: monitoring system access and data handling, human-in-the-loop oversight, tracking agent actions and decisions, and guardrails limiting agent behavior. | Published December 9, 2025 | [2026 FINRA Annual Regulatory Oversight Report](https://www.bankingnewsai.com/ai-regulation/documents/finra-annual-regulatory-oversight-report-2026) |
| Regulatory Notice 24-09 | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) | The report cites Regulatory Notice 24-09 as the underlying statement that FINRA rules apply to GenAI; the notice names Rules 3110 and 2210. | June 27, 2024 | [FINRA Regulatory Notice 24-09](https://www.bankingnewsai.com/ai-regulation/documents/finra-regulatory-notice-24-09) |
| Regulatory Notice 26-14 (Rule 2210 modernization proposal) | [FINRA](https://www.bankingnewsai.com/ai-regulation/finra) | FINRA proposed to modernize Rule 2210, citing advances in generative AI, by replacing principal pre-use approval of retail communications with risk-based supervision standards; comments closed September 11, 2026. | Proposed July 9, 2026 | [official text](https://www.finra.org/rules-guidance/notices/26-14) |

The GenAI section is deliberately descriptive. It frames its content as 'considerations' and as shared terminology that may help 'fellow regulators, member firms, and others', and it grounds the use-case picture in a FINRA survey of firms and engagement with other regulators. The top use case, 'Summarization and Information Extraction', is a reminder that most current firm use is internal and information-retrieval oriented, where the main controls are accuracy, data handling and recordkeeping rather than customer-facing suitability.

The agent discussion is the novel part. FINRA defines AI agents as capable of autonomously performing and completing tasks on a user's behalf and plans, makes decisions and acts to achieve goals, and lists six agent-specific risks. It then says the rapidly evolving capabilities of agents 'may call for supervisory processes that are specific to the type and scope of the AI agent being implemented'.

The report should be read alongside bank-side guidance for a bank group. Model risk (SR 26-2 for Federal Reserve-supervised banks) and third-party risk expectations govern the bank; FINRA's report governs the broker-dealer affiliate. The two agree on the main controls (inventory, testing, monitoring, human oversight) but are separate regimes with separate examiners.

### What this means in practice

- Inventory GenAI and agent use in the broker-dealer, including vendor features, and tie each to Rule 3110 supervision procedures.
- Log prompts, outputs and model versions for GenAI used in supervision or communications; the report names these as monitoring practices firms may consider.
- For any AI agent, define permitted systems and data, escalation points for human approval, action logging and hard guardrails before deployment.
- Test for hallucination and bias, and include vendor and threat-actor AI risk in the cybersecurity programme.
- Align bank-level model risk governance with the broker-dealer's but keep separate FINRA evidence for exams.

## FAQ

### Does the FINRA 2026 oversight report apply to banks?

It applies to FINRA member firms, meaning broker-dealers, including bank-owned broker-dealers. It does not apply to banks themselves, which the Federal Reserve, OCC and FDIC supervise.

### What does the FINRA 2026 report say about AI agents?

It defines AI agents as systems capable of autonomously performing and completing tasks on behalf of a user and lists risks: autonomy without human validation, acting beyond intended scope and authority, difficulty tracing multi-step reasoning, sensitive data misuse, lack of domain knowledge, and misaligned reward functions. It suggests firms consider monitoring agent access, human-in-the-loop oversight, tracking agent actions, and guardrails.

### Is the FINRA Annual Regulatory Oversight Report binding?

No. The report shares observations and considerations; the binding requirements are FINRA's rules, such as Rule 3110 on supervision, which the report says apply to GenAI as to any other technology.

### How does the 2026 report compare with Regulatory Notice 24-09?

Notice 24-09 (June 2024) reminded firms that existing rules apply to generative AI; the 2026 report goes further with observed use cases, governance, testing and monitoring considerations, and a discussion of AI agents.

## Related documents

- [FINRA Regulatory Notice 24-09](https://www.bankingnewsai.com/ai-regulation/documents/finra-regulatory-notice-24-09) — FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (Jun 27, 2024)
- [Bailey: Frontier AI and the Question of Governance (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-bailey-frontier-ai-governance-2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026)
- [Atkins remarks at Investor Advisory Committee (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/sec-atkins-iac-ai-disclosure-remarks-2026-09) — Remarks at the SEC Investor Advisory Committee Meeting on AI Technologies and the Public Markets Information Ecosystem (Sep 10, 2026)
- [FIN-2026-Alert005 (Digital Asset Investment Scam Centers)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2026-scam-centers) — FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers (Sep 3, 2026)
- [FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fca-frontier-ai-cyber-resilience-2026) — Frontier AI and Cyber Resilience (Sep 2, 2026)
- [FSB Chair's letter to G20 (Aug 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-chair-letter-g20-august-2026) — FSB Chair's letter to G20 Finance Ministers and Central Bank Governors: August 2026 — risks arising from frontier artificial intelligence models (Aug 31, 2026)
- [ESA Statement on ICT risks from frontier AI models (JC 2026 25)](https://www.bankingnewsai.com/ai-regulation/documents/esas-jc-2026-25-frontier-ai-statement) — ESA Statement: Toward a consistent and risk-based approach for ICT risks from frontier AI models (Jul 31, 2026)
- [FIN-2026-Alert004 (Federal Student Aid Fraud)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2026-federal-student-aid-fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026)

Last reviewed Oct 5, 2026. Cite the official text (https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/finra-annual-regulatory-oversight-report-2026
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.