FINRA AI Governance: Conference Takeaways

AI Governance Took Center Stage

Overview

Listen

We break down the key AI governance takeaways from the FINRA Advertising Regulation Conference in Washington, D.C. Hear how FINRA treats AI-generated content, why review has become the bottleneck, and what firms need to verify where content actually ends up.

Critical Questions Powered by Red Oak

FINRA says its rules are technology-neutral, so AI-generated communications are subject to the same requirements as any other communication, however they were produced. The regulator set this out in the conference’s opening plenary in Washington, D.C. on October 15 and 16. It also said human expert judgment is still needed in final reviews, because large language models are not consistently accurate.

At the conference, much of the AI governance discussion centered on vendor AI: how to manage it, how to configure it, and how much flexibility a firm has to do so. Governing it means being able to manage it, configure it, and reproduce a record of its activity for internal audits and regulators.

Red Oak’s AI Review starts from your own handbook and applicable regulation, so you get a working review quickly without writing prompts, and your team decides what it learns from reviewers’ decisions. It explains its findings, so the firm stays in control of how the AI behaves. Mira, our communications supervision agent, applies the same principles. It reads your handbook alongside SEC and FINRA regulations, explains its decisions in plain language, clears what it can, and flags the rest for a person. Every decision, including those that never reach a reviewer, is recorded with a timestamp, and you can export the record when an examiner asks why.

A panel at the conference made the point that a prohibition on off-channel communications is not a control unless a firm can also detect off-channel use. Supervision also has to see what was actually posted, and record-keeping is an ongoing challenge: capturing and preserving ephemeral and edited posts is difficult, and some platforms allow edits after approval. The panel’s advice was to compare what is live with what was approved. As part of its supervision offering, Red Oak captures edited, deleted, and ephemeral messages on supported platforms, so firms can make that comparison and keep a record of what was live at different points in time.

Transcript

0:00 This is the brief on FINRA’s AI governance takeaways.

0:03 So at the recent FINRA advertising regulation conference down in DC, AI governance was the center of attention, making it absolutely crucial for financial firms to understand exactly how regulators are treating these powerful new tools.

0:17 First, FINRA is keeping a strictly tech neutral stance, meaning AI generated content follows the exact same rules as any other communication.

0:26 You kind of have to think of AI as an eager intern, right?

0:29 It can churn out content incredibly fast, but the human boss is still required to sign off on the final product.

0:36 Human expert judgment isn’t optional, it’s mandatory, because large language models just aren’t consistently accurate yet.

0:44 Second, treating AI like a superfast intern creates a massive new problem, and that’s the review bottleneck.

0:51 Because the AI writes way faster than humans can actually review it, the real holdup shifts from creation straight to review.

0:57 To solve this, true AI governance means your firm’s got to be able to actively manage its vendor AI, configure it properly, and seamlessly reproduce a verifiable record of its activity for internal audits and regulators.

1:11 Finally, just as you need a record of your AI’s decisions, you absolutely need to track where that content actually ends up.

1:17 I mean, a policy banning off-channel communications is pretty useless if you can’t actually detect what’s happening out there.

1:24 To fix this recordkeeping headache, Red Oak captures edited, deleted, and even ephemeral messages on supported platforms, so you can easily compare what’s live against what was actually approved.

1:34 Ultimately, surviving the AI revolution in finance isn’t just about adopting the fastest tools, but building provable human-led oversight you can stand behind.

Read the Blog Post

Our team was one of a small number of vendors exhibiting at the FINRA Advertising Regulation Conference in Washington, D.C. on October 15 and 16, and it was busy. The keynote room was full of industry professionals keen to hear where FINRA is heading on advertising and communications. AI came up in nearly every conversation we had.

FINRA Is Focused on How Firms Govern Their AI

AI governance drew a tremendous amount of discussion. Much of the conversation was about vendor AI: how to manage it, how to configure it, and how much flexibility a firm has to do so. The ability to reproduce records for internal audits and regulators was a big part of the discussion too.

FINRA Treats AI-Generated Content Like Any Other Communication

The conference opened with a plenary session in which FINRA set out its forward initiatives and regulatory developments. On AI, FINRA said its rules are technology-neutral, so AI-generated communications are subject to the same requirements as any other, however they were produced. The regulator also shared that human expert judgment is still needed in final reviews, because large language models are not consistently accurate.

AI tools now let teams produce content faster than it can be reviewed. Because the same requirements apply to every piece, and a person needs to make the final call, review, not content creation, is becoming the limiting factor.

A Policy Is Only a Control If You Can Verify It

A panel on social media compliance and influencer risks covered how influencers are becoming a more popular way to promote products in this space, and also made points about supervision more broadly. On off-channel communications, the message was that a prohibition is not a control unless a firm can also detect off-channel use. The panel also highlighted record-keeping as an ongoing challenge: capturing and preserving ephemeral and edited posts is difficult, and because some platforms allow edits after approval, it advised comparing what is live with what was approved.

How Red Oak Can Help

Governing vendor AI means being able to manage it, configure it, and reproduce a record of its activity for internal audits and regulators. Red Oak’s AI Review starts from your own handbook and applicable regulation, so you get a working review quickly, without writing prompts, and your team decides what it learns from reviewers’ decisions. It explains its findings, so the firm stays in control of how the AI behaves. It is also built to cut down review cycles, which helps your team keep pace as AI produces more content.

Mira, our communications supervision agent, applies the same principles to supervision. Like AI Review, it starts from your compliance handbook, read alongside SEC and FINRA regulations, and explains its decisions in plain language. It clears obvious non-issues and flags the rest for a person. Every decision, including those that never reach a reviewer, is recorded with a timestamp, and you can export the record when an examiner asks why.

Supervision also has to see what was actually posted, including edits, deletions, and content that disappears. On supported platforms, we capture edited, deleted, and ephemeral messages, so firms can compare what is live with what was approved, and keep a record of what was live at different points in time.

Human judgment belongs in the final decision, and our products are built around that. Your team defines the policies and makes the final decision on anything the AI escalates. With AI producing more content than people can review piece by piece, the goal of our automation is fewer, more meaningful decisions for your team, so their judgment goes where it matters.

Talk to our team about AI governance and processes you can stand behind.