The annual NSCP National Conference took place in Orlando from October 25 to 28. Compliance professionals from broker-dealers, investment advisers and more filled three days of panels, hands-on labs, and small talk groups, with keynotes from FINRA’s CEO and the executive director of NASAA. The program ran from enforcement and CCO accountability to cybersecurity, digital assets, and AI. One attendee joked that the conference is "the Super Bowl" for compliance professionals.
AI was everywhere at the conference, on the exhibit floor as much as in the sessions. It felt less like a buzzword than at past events, with vendors showing it at work in review, automation, and reporting. Among compliance professionals, the conversation has moved on from whether to use AI to how to let advisers use it safely and compliantly.
It has also never been easier to build a tool of your own, and the pull is obvious. In a peer discussion on using technology to work more efficiently, an attendee described an AI assistant built in-house for marketing review, and others raised the questions they expect an examiner to ask: how the prompts were built, whether the builder was equipped to build them, how the tool is controlled, and whether it serves the whole firm or one person. AI makes it easy to build something that works, but compliance needs something that holds up. The rules keep changing, the detail examiners expect keeps growing, and a tool built by one person reflects that person’s reading of the rules at one point in time. Keeping it current, secure, and able to scale becomes a job in itself, and it falls to whoever built it.
There is no new AI rulebook, but firms are still accountable for how they use AI. Panelists in a session on AI in compliance, including a former SEC examination leader, said regulators are applying the rules that already exist, such as vendor due diligence and the Marketing Rule’s requirement to substantiate claims. They pointed to the SEC’s AI-washing cases, in which advisers were charged for overstating their use of AI, and one advised firms that use AI to generate client communications to disclose it.
The rules are also still taking shape. Asked when firms will get guidance on recordkeeping and supervision for AI-generated content such as meeting summaries, notes, prompts, and outputs, FINRA’s CEO said the question comes up often, that it sits with the SEC, and that FINRA is working with the Commission on it. He did not expect every question to be answered at once.
In the meantime, a full audit trail is the safest course, because it means AI is never a black box and the firm has complete transparency over what it did and why. Keeping a person in the loop matters for the same reason: a person can be held accountable for a decision, and an AI tool cannot.
Consolidation came up repeatedly in conversations across the conference. As operations grow more complex, firms want fewer vendors: one system to log into, one invoice to pay, and one contact to call, in place of a long list. There was genuine interest in what the combination of Red Oak and MirrorWeb means for the same reason.
Red Oak covers the full regulated communications lifecycle with one vendor, from the review and distribution of marketing content to the supervision and archiving of the emails and messages your people send.
Red Oak’s AI Review checks marketing content against your handbook and applicable regulation before use, and 4U then gets approved content to partners and advisers. Mira, our communications supervision agent, applies the same standard to emails and messages.
Both AI Review and Mira leave a record, which matters while guidance on AI recordkeeping is still being developed. AI Review explains its findings, and Mira logs every decision with a plain-language reason and a timestamp, including those that never reach a reviewer, so a firm can show an examiner what happened and why at every stage.
Human judgment belongs in the final decision, and our products are built around that. Your team defines the policies and makes the final decision on anything the AI escalates, so accountability stays with a person.
Talk to our team about defensible AI and simplifying your compliance stack.