How does FINRA Rule 2210 apply to AI-generated communications?

Registered representatives are drafting client emails with AI assistants, and most marketing and CRM platforms now offer AI-written posts. If you are the CCO or COO of a broker-dealer or dual-registered firm, the practical question is whether those drafts change what FINRA Rule 2210, the communications with the public rule, requires, and what an examiner will expect to find in your files. The rule has not changed. The sections below show where AI drafting makes it easier to miss.

Does FINRA Rule 2210 apply to content written by AI?

Yes. FINRA Rule 2210 applies to AI-written content the same way it applies to content a person writes. FINRA's advertising regulation FAQ D.8 states: "Firms are responsible for their communications, regardless of whether they are generated by a human or AI technology." Regulatory Notice 24-09, published June 27, 2024, says FINRA intends its rules to be "technologically neutral" and that they apply to AI use "just as they apply when member firms use any other technology or tool." There is no separate AI communications rule.

For a broker-dealer, or the brokerage side of a dual-registered firm, the drafting tool does not change the analysis. A market commentary drafted with a chatbot, a client email polished by an AI assistant, and a social post generated by a marketing platform are all judged by the same categories and content standards as work written by a registered representative.

Which Rule 2210 category does an AI-drafted piece fall into?

The audience sets the category, whoever or whatever drafted the piece. Rule 2210(a) sorts written communications into three groups:

• Correspondence: distributed or made available to 25 or fewer retail investors within any 30 calendar-day period.
• Retail communication: distributed or made available to more than 25 retail investors within any 30 calendar-day period.
• Institutional communication: distributed or made available only to institutional investors, excluding a member's internal communications.

AI makes the 25-investor line easier to cross without noticing. A template email that an AI tool personalizes and sends to 40 retail clients in a month is a retail communication, even though each message reads like one-to-one correspondence. Decide in advance how personalized mass messages are classified and who approves them.

Does a principal still have to approve AI-generated retail communications?

Yes. Under the current rule, a registered principal must approve each AI-generated retail communication before it is used. Rule 2210(b)(1)(A) requires an appropriately qualified registered principal to approve each retail communication "before the earlier of its use or filing" with FINRA's Advertising Regulation Department, subject to listed exceptions. Correspondence is supervised and reviewed under Rule 3110(b) instead.

Regulatory Notice 26-14, published July 9, 2026, proposes to "replace the prescriptive principal pre-use approval requirement with more modernized, risk-based standards." Firms would write procedures deciding which categories of retail communications need pre-use approval, and retail research reports would still need it. FINRA noted commenters' view that the current requirement "is incongruous with extensive use of AI," and said Gen AI communication tools "can be part of such a reasonably designed system" when they are vetted, tested and monitored. The comment period closed September 11, 2026. Until FINRA adopts a final rule and the SEC approves it, the pre-use approval requirement stands.

Which Rule 2210 content standards do AI drafts tend to miss?

The standards most exposed are fair and balanced presentation, accuracy and the limits on performance claims. Rule 2210(d)(1) requires communications to be fair and balanced, prohibits any "false, exaggerated, unwarranted, promissory or misleading statement or claim," and bars predictions or projections of performance, subject to narrow exceptions. Generative tools tend to produce:

• Confident statements about returns or outcomes that read as promissory.
• Benefits described without the matching risks.
• Facts, figures or citations that do not exist.
• Product details, fees or rates that are out of date.
• Superlatives and urgency that a principal would cut from a human draft.

Principals reviewing AI drafts should check for these patterns specifically, and the firm's written supervisory procedures should say so.

How must a firm supervise an AI chatbot that talks to investors?

A firm must supervise its chatbot's output under FINRA's rules, and the content must meet the Rule 2210(d) standards. FINRA's FAQ B.4 says a firm that uses AI to create chatbot communications with investors "must supervise the chatbot communications in accordance with applicable FINRA rules," with content consistent with applicable standards "such as those in FINRA Rule 2210(d)." Depending on the number and type of recipients, those communications can be correspondence, retail communications or institutional communications. The FAQ also notes that Regulation Best Interest may apply if AI is used to make a recommendation to a retail customer.

Because one chatbot can answer hundreds of investors, decide before launch how its scripted and generated responses fit the Rule 2210 categories, what topics it may not address, how responses are sampled and reviewed, and how the conversation records are retained.

For the supervision and logging side, see our guide to supervising GenAI under FINRA Rule 3110.

What records does Rule 2210 require for AI-drafted communications?

The same records it requires for any other communication. Rule 2210(b)(4) requires firms to keep retail and institutional communications for the retention period in SEA Rule 17a-4(b), with the dates of first and (if applicable) last use, the name of the approving principal and the approval date. Rule 17a-4(b)(4) covers communications relating to the firm's business as such and requires keeping them for at least three years, the first two in an easily accessible place.

FINRA's 2026 Annual Regulatory Oversight Report describes monitoring practices firms may want to consider for Gen AI, including "storing prompt and output logs for accountability and troubleshooting" and "tracking which model version was used and when." These are considerations, not rule text. They make it easier to show a reviewer or an examiner how a given communication was produced and who approved it.

AI notetakers and chat tools raise the same archiving questions. Our article on off-channel communications, Teams chats and AI notetakers covers what to capture.

What should a CCO do about AI-generated communications this quarter?

Start with an inventory and a written rule, then close the gaps before an examiner asks about them:

• Inventory every tool that drafts or edits client-facing text, including AI features built into email, CRM, social media and marketing platforms.
• Update written supervisory procedures to state that AI-generated content follows the same Rule 2210 categories, approvals and content standards.
• Give principals a short AI review checklist covering performance claims, balance, factual accuracy and current product details.
• Set a clear rule for AI-personalized mass messages so staff know when correspondence becomes a retail communication.
• Confirm your archive captures the final version of each communication and, where practical, the prompts and outputs behind it.
• Track Regulatory Notice 26-14 and sketch how you would document a risk-based approval standard if FINRA adopts one.

How can s90 help?

s90 manages the technology under your supervisory system: the archive, access controls on AI tools, and logging that shows who generated and approved what. We help compliance teams see which tools touch client communications, and our agreements commit us to produce supporting evidence within 24 hours of a request. If you are rolling out AI writing tools this year, we are glad to talk through the setup with you and your compliance team.