How to Document Due Diligence on a Generative AI Vendor for FINRA

Does FINRA require due diligence on generative AI vendors?

In effect, yes. FINRA has no separate AI vendor rule, but its existing supervision rules reach AI vendors, so a broker-dealer should be able to show a documented AI vendor risk assessment and due diligence for each tool. FINRA Rule 3110(a) requires a supervisory system reasonably designed to achieve compliance with applicable securities laws and FINRA rules, and Rule 3110(b)(1) requires written procedures to supervise the types of business the firm engages in.

Regulatory Notice 24-09, published in June 2024, confirms those rules apply when firms use generative AI, whether they build the tools or use a third party's technology, "including through embedded features in existing third-party products." Regulatory Notice 21-29, published in August 2021, reminds firms of their supervisory obligations when outsourcing and repeats the point from Notice to Members 05-48 that outsourcing "does not relieve members of their ultimate responsibility for compliance."

Put together, a GenAI vendor performs work your firm remains responsible for, and your file should show how you supervised the choice. Notice 21-29 asks the question an examiner will ask: "Does your firm document its due diligence findings?"

What should an AI vendor risk assessment and due diligence file contain?

Notice 21-29 groups its questions for firms into four stages: the decision to outsource, due diligence, vendor onboarding and supervision. Each maps onto a GenAI vendor file, and the first stage is where the AI vendor risk assessment belongs. Treat these as the questions your file should be able to answer.

Decision to outsource: the risk assessment

• What the tool does, who will use it, and which business functions will depend on it.
• What data it will see: customer information, account numbers, correspondence or trading data.
• Whether it supports a regulatory function, such as supervision, surveillance or communications with the public.

Due diligence

• The vendor's information security controls, a current SOC 2 report if one exists, and its business continuity plans.
• Subcontractors, including the underlying model provider when the vendor builds on another company's model.
• How prompts, files and outputs are stored, for how long, and whether any of them are used to train models.
• The vendor's financial condition and reputation, in proportion to how critical the tool will be.

Vendor onboarding and contract terms

• Data ownership and confidentiality.
• Cybersecurity event notification, at least as fast as Regulation S-P requires.
• Deletion of firm data on request and at termination.
• Access for regulators to any books and records the vendor holds for the firm.

Supervision, monitoring and exit

• Who reviews the vendor each year, and what triggers an earlier review, such as a change in terms or a new AI feature.
• How the firm would exit: data return, written confirmation of deletion, and a fallback process for the work.

What GenAI-specific questions belong in the file?

The model and its outputs need their own section. FINRA's 2026 Annual Regulatory Oversight Report lists effective practices that translate directly into due diligence questions:

• "Implementing formal review and approval processes to assess and evaluate GenAI opportunities and the necessary controls." Record who approved the tool, for which use cases, and on what basis.
• "Robust testing of GenAI to understand the capabilities, limitations and performance of the model." Record what you tested, with what data, and what you found.
• "Ongoing monitoring of prompts, responses and outputs," including "storing prompt and output logs for accountability and troubleshooting." Record whether the tool keeps logs your firm can access and export, and which model version was in use.
• "Validation and human-in-the-loop review of model outputs." Record who reviews outputs before they reach customers or the firm's records.

The report also lists "risks associated with the firm's and its third-party vendors' use of GenAI" as a cybersecurity concern, so ask the vendor how it protects its own AI features from misuse. If the tool drafts content for customers, FINRA Rule 2210 governs what it produces, so the file should note who approves that content.

How does Reg S-P change the due diligence?

If the vendor will receive customer information, it is a service provider under Regulation S-P, and oversight becomes a rule requirement. 17 CFR 248.30(a)(5)(i) requires written policies reasonably designed to require oversight of service providers, "including through due diligence and monitoring," and to ensure they notify the firm no later than 72 hours after becoming aware of a breach of a customer information system they maintain.

Broker-dealers must keep those policies, and documentation of the related contracts, under Rule 17a-4(e)(14). Contracts are kept until three years after they end. That makes the GenAI due diligence file part of your Reg S-P record set, and a missing 72-hour commitment a gap you need to resolve or document. Our guide to Reg S-P service provider contracts covers the contract language.

How should the review be recorded so an examiner can follow it?

Keep one file per vendor, dated, ending in a decision. A file an examiner can follow usually holds:

• A one-page summary: the tool, the plan or edition, approved use cases, data in scope, risk rating, decision, conditions and approver.
• Dated copies of the terms of service, data processing addendum, privacy policy and subprocessor list you reviewed, since AI vendors change terms often.
• The completed questionnaire and evidence received, such as the SOC 2 report.
• Test results and the date of testing.
• The section of your written supervisory procedures that assigns supervision of the tool. That answers another Notice 21-29 question: "Do your firm's WSPs address roles and responsibilities for firm staff who supervise Vendor activities?"
• The next scheduled review date.

Your annual testing under FINRA Rule 3120 is a good place to confirm the controls described in each file are actually working.

What should your firm do this quarter?

Start with the tools already in use, then make the process routine:

• List every GenAI tool in use, including AI features switched on inside platforms you already license.
• Open a due diligence file for each, starting with tools that see customer information.
• Collect and date the current terms, data processing addendum and subprocessor list for the exact plan you use.
• Confirm 72-hour breach notice and model training terms in writing, or record a dated exception with a deadline.
• Update WSPs to name who supervises each approved tool and how outputs are reviewed.
• Schedule annual reviews, plus a trigger review whenever a vendor changes its terms or adds an AI feature.

How does s90 help?

s90 helps broker-dealers and dual-registered firms inventory their GenAI tools, including AI features that appear inside existing software, and build vendor files that an examiner can follow from risk assessment to decision. Our own agreements include 72-hour breach notification and 24-hour evidence production. If you want help building your first GenAI vendor file, we can start with the tool your registered representatives use most.