FINRA AI Guidance for Advisers: A Checklist for AI-Written Content

FINRA says its rules are technology neutral: Rule 2210 applies to client communications whether a person or a generative AI tool wrote them. Regulatory Notice 24-09 (27 June 2024) creates no new rules. A small firm should check content standards, principal approval or supervision, and records, with a named person signing off each step.

That last part is where firms slip. "The AI wrote it" is not a role in your supervisory procedures, so every AI-drafted message needs a human who answers for it, exactly as if they had typed it. The fix is structural: pair every duty with a sign-off step and a named role, from drafter to principal to records owner, so nothing rests on the tool.

Follow me on Instagram@sagnikteaches

One boundary first. I am explaining what the regulator's own notice and rule text say, and how a small firm can organise itself around them. I am not giving legal advice, and your written supervisory procedures and compliance officer decide what applies to you. If you are a registered investment adviser rather than a broker-dealer, different rules and a different regulator apply, so check which of the duties below carry over.

Connect on LinkedInSagnik Bhattacharya

What Notice 24-09 actually says, and what it leaves out

Read the notice itself rather than a summary, because most commentary overstates it. It is short. Three points matter for content.

Subscribe on YouTube@sagnikteaches

• No new requirements. The notice states that it does not create new legal or regulatory requirements or new interpretations of existing ones.
• The rules are technology neutral. FINRA's rules apply when a firm uses generative AI, whether the firm builds the tool or uses a third party's, "including through embedded features in existing third-party products". That last phrase catches the AI button that appeared in your email client or CRM last quarter.
• Content standards apply however the text was made. The notice points to guidance that Rule 2210's content standards apply whether communications are generated by a human or a technology tool.

The notice also tells firms to evaluate generative AI tools before deploying them and to be sure they can keep complying with existing rules. And if you use AI inside your own supervisory system, for example to review electronic correspondence, your procedures should address technology governance: model risk management, data privacy and integrity, and the reliability and accuracy of the model.

What it leaves out is just as useful. There is no list of approved tools, no required disclosure wording, no rule on prompts. The duty is the old duty. What changes is how easily a volume of plausible-sounding but wrong text can reach clients, which is why the checklist below is built around approval and evidence, not around the tool.

Which approval route does each message take?

Rule 2210 sorts communications by audience size, and that decides your sign-off step. The definitions are in the rule text: correspondence is a written communication sent to 25 or fewer retail investors in any 30 calendar-day period; a retail communication goes to more than 25 retail investors in that window; an institutional communication goes only to institutional investors.

Two cautions. First, an AI tool makes it easy to blast the same drafted message to many people, which can quietly turn "correspondence" into a "retail communication" that needed a principal's approval beforehand. Count recipients over the rolling 30 days, not per send. Second, the exceptions in (b)(1)(D) carry conditions, so confirm with your compliance officer before relying on one for AI-generated content.

The checklist: each duty with a named sign-off

Run this for every AI-assisted client-facing item. Give each line an owner by role, such as "drafter", "principal" and "records owner", so nobody can say it was somebody else's step.

1. Content standards (drafter, then reviewer)

• Fair and balanced. Rule 2210(d)(1)(A) requires communications to be fair and balanced and to give a sound basis for evaluating the facts. Check that the draft does not play up a benefit while burying the risk. Reviewer initials the line.
• No exaggerated, promissory or misleading claims. Rule 2210(d)(1)(B) bars false, exaggerated, unwarranted, promissory or misleading statements. AI drafts love words like "guaranteed", "safe" and "proven". Search the draft for them.
• No predictions or projections. Rule 2210(d)(1)(F) generally bars predicting or projecting performance or implying past performance will recur, with limited exceptions. A model asked to "make it persuasive" will often add an optimistic forecast.
• Risks beside benefits. Rule 2210(d)(1)(D) requires balanced treatment of risks and potential benefits. Check that the risk sentence did not get dropped when the AI shortened the text.
• Comparisons disclose material differences. Under (d)(2), any comparison between investments or services in a retail communication must disclose all material differences, such as costs and liquidity. If the AI wrote "cheaper than the alternatives", the evidence needs to be on file.
• Firm name shown. Rule 2210(d)(3) requires retail communications and correspondence to prominently disclose the member's name. AI output often omits the signature block.
• Audience fit. Rule 2210(d)(1)(E) asks you to consider the audience. A draft written for sophisticated readers may mislead a retired client.

2. Facts and numbers (drafter, then a second person)

• Every figure, date, fee and product name in the draft traced to a source document, with the source noted. Generative tools produce confident wrong numbers.
• Tax or income claims checked against Rule 2210(d)(4): you may not describe income as tax-free or tax-exempt when the tax is only deferred, and a reference to tax-free income must say which income taxes apply. AI drafts blur "tax-deferred" and "tax-free" easily.
• Nothing in the draft quotes a client, testimonial or third-party rating unless your procedures cover it and compliance has cleared it.

3. Approval or supervision (principal)

• Route chosen from the table above, and noted on the file.
• For retail communications: a qualified registered principal approves the final version before first use (Rule 2210(b)(1)(A)).
• For correspondence: the item is inside your Rule 3110 review process, whether by sampling, lexicon-based flags or another method your procedures describe.
• The approver reads the version that will be sent. Approving the prompt, or an earlier draft, is not approval.

4. Records (records owner)

• For retail and institutional communications, Rule 2210(b)(4) points to the retention period and format required by SEA Rule 17a-4(b). The record must include a copy of the communication, the date of first use (and last use, if applicable), the name of the principal who approved it and the date, and the source of any statistics, charts or projections it uses. That last item suits AI drafts well: if nobody can name where a figure came from, it should not be in the communication.
• Keep the final text exactly as sent. Decide with compliance whether prompts and intermediate drafts are kept as well, and write that decision into your procedures so it is applied consistently.
• Confirm where the tool stores your content. An AI feature that holds client text on a third party's servers is part of your technology governance review.

5. Tool governance (compliance officer, annually and on change)

• A tool list: every AI tool in use, including built-in features of your CRM, email, note-taker and website builder.
• For each, what client data it may see, whether it trains on your inputs, and who approved it for use.
• A rule on what staff must never paste into a public AI tool, such as account numbers and identity details.

A 14-person branch's market-update email, from prompt to filing

Illustration only. Say a 14-person broker-dealer branch wants a monthly market-update email to about 400 clients. A junior adviser pastes last month's note into an AI tool and asks for "a punchier version for this month".

Step 1, routing. 400 retail recipients is far above 25, so it is a retail communication and needs a principal's approval before use. Nothing in the AI step changes that. The routing line is signed by the drafter.

Step 2, the draft comes back with three problems. It says the portfolio approach "has delivered steady growth", which implies past performance will recur. It says the fund range is "much cheaper than typical alternatives" without the comparison data. The risk paragraph from last month's version has shrunk to half a sentence. The reviewer flags all three against lines in the content-standards block.

Step 3, the fixes. The drafter deletes the growth sentence, replaces the comparison with a plain statement of the fund fees from the fee schedule, and restores the full risk paragraph. A second person checks every number against the source documents.

Step 4, approval. The principal reads the final version, approves it and records the date. The records owner files the sent text with the approval record. Elapsed time: about 40 minutes, of which the AI drafting took five.

The saving is real but small, and the review time is what stays. Treat the AI as a faster first draft, not as a way to cut the sign-off.

Five more cases and how they route

A reply to one client's question about fees

One recipient, so it is correspondence under Rule 3110 supervision. The AI may draft it, but the adviser checks that the fee numbers match the client's agreement and that the reply is not promissory. The supervisor's sampling covers it.

A LinkedIn post about retirement planning

Visible to the public, so treat it as a retail communication unless your procedures place it in a different category. Social posts drafted by AI tend to be punchy and absolute ("never run out of money"). Principal approval before posting is the safe default. Where your procedures treat a live post in an interactive forum under the (b)(1)(D) exception in the table, supervision replaces pre-approval, but the content standards still apply in full. Our tutorial on AI marketing that clears compliance covers the content side.

A chatbot on the website

A bot that answers visitors is generating communications in real time, so nothing is approved in advance. The notice's point about third-party tools applies fully. Your procedures should cover the tool evaluation, the limits on what it may say, how its conversations are retained and reviewed, and a handover to a person. Ask compliance whether the firm discloses that it is a bot.

A client portal summary of a meeting

If an AI note-taker produces a summary that goes to the client, it becomes a communication to that client. Review the summary before release. See AI note takers for financial advisers for records and consent.

A webinar invitation with AI-written claims

Sent to a prospect list far above 25 people, so it is a retail communication. A principal approves the final invitation, and the invitation mentions only what the webinar will cover, not predicted outcomes.

A prompt that produces reviewable drafts

You cannot prompt your way to compliance, but you can make the draft easier to review. Ask for the structure a reviewer needs.

Draft a client email from [firm name] about [topic].
Rules for the draft:
- Plain English for retail clients.
- No forecasts, no guarantees, no words such as "safe", "proven" or "guaranteed".
- Any figure must come from the source text I paste below; if a figure is missing, write [NEED SOURCE] instead of estimating.
- Include a short paragraph on the main risks.
- End with the firm name and a line telling the client to contact their adviser.
After the draft, list every claim and number in a table with the sentence it appears in.

Illustrative output: a draft with two [NEED SOURCE] markers and a claims table. What you would fix: the AI listing "diversified" as a claim without support, and the table's omission of one figure that appears in a heading. The table is a reviewer's aid, not evidence of compliance.

Where AI drafts fail the checklist most often

• Confident numbers with no source. The fix is the [NEED SOURCE] instruction plus a second-person check.
• Softened risk language. When you ask for "shorter" or "friendlier", the risk text is the first thing to shrink. Re-read the risk paragraph on every edit.
• Implied promises. "Helps you stay on track" can read as a promise. Reviewers should read as a retail investor would.
• Missing firm name or required wording. Templates in the tool may drop the signature block.
• Edits after approval. A colleague "tidies" the text in the email tool after the principal signed. Lock the version at approval and send exactly that.
• Shadow tools. Staff use a personal AI account for client text. Your tool list and a clear rule on this matter more than any template.

A filled-in sign-off log for the market-update email

The checklist only helps if it leaves evidence. A one-row-per-step log is enough for a small firm. Here is the market-update example from above, filled in. The names are roles, and every date is illustrative.

Notice that the AI tool appears nowhere in the owner column. That is deliberate: it is a drafting aid, and every accountable step belongs to a person.

Questions to put to an AI vendor before staff use it

Because the notice says firms should evaluate a tool before deploying it, keep a short vendor questionnaire on file. These are practical questions to ask, not a regulatory list.

• Where is our text processed and stored, and for how long?
• Is our content used to train the vendor's models, and can that be switched off in writing?
• Can we export a log of prompts and outputs by user, in case compliance decides to keep them?
• Which AI features are switched on by default in the products we already use, and who can turn them off?
• What happens to our data if we stop using the tool?

File the answers with the date. When the vendor adds a new AI feature to a product you already use, which happens often, repeat the review for that feature rather than assuming the old approval covers it.

Proving the process works

An examiner, or your own compliance officer, will ask to see the process rather than hear about it. Each month, pick five AI-assisted items at random and trace each from request to sent version. For each, you should be able to show the route chosen, the drafter's checklist, the reviewer's initials, the principal's approval record where needed, and the filed final text. Any item you cannot trace is a gap. Fix the cause, not just the file.

Also check the opposite direction once a quarter: ask staff which AI tools they use and compare the answers to your tool list. A mismatch tells you more than a policy review does.

If you would like help turning this into a one-page procedure for your own firm, that is what a 1:1 call covers, and you can book through the contact page. The regulator's wording and your compliance officer's decisions stay the authority either way. For the primary sources, read Regulatory Notice 24-09 and Rule 2210 in full. Pair this with the question of whether advisers can use ChatGPT at all for the tool-choice side.

Questions small firms ask about AI content and FINRA

Does FINRA ban AI-written client emails?

No. Regulatory Notice 24-09 says FINRA's rules are technology neutral and apply to generative AI just as they apply to any other tool. It creates no new requirements and no ban. The duty is the same as for a human-written email: the content standards, supervision and record-keeping still apply, and a named person remains responsible.

Do I have to disclose that AI wrote a message?

Notice 24-09 does not set a blanket disclosure rule for AI-written content, and I have not found one in Rule 2210. Your firm may still choose to disclose, particularly for chatbots, so clients know what they are talking to. Ask your compliance officer or counsel, and write the answer into your procedures.

Does an AI-drafted one-to-one email need principal approval?

Under Rule 2210, correspondence (25 or fewer retail investors in 30 days) is supervised and reviewed under Rule 3110 rather than pre-approved. Retail communications to more than 25 retail investors generally need approval by a qualified registered principal before use. Check your own procedures for exceptions.

Are my prompts and AI outputs records?

Treat them as potentially in scope. If an AI-drafted message is sent as a communication, the sent version and its approval trail are what Rule 2210 and the recordkeeping rules point to. Whether drafts and prompts must be kept depends on your firm's procedures and retention rules, so settle that with compliance before you start.

Can the AI tool review its own output for compliance?

It can flag likely problems as a first pass, but it cannot be the sign-off. Notice 24-09 says that if a firm uses AI inside its supervisory system, the policies should cover model risk, privacy, reliability and accuracy. A qualified person still approves.

Further reads

• Claude vs ChatGPT for Financial Advisers: Meeting Prep and Records — Two assistants compared on meeting prep and the records they leave.
• AI Website Copy for Financial Advisers: Service Pages and Bios — Service pages and bios written with a review step.
• Jump vs Zocks: Which AI Notetaker Fits Your Compliance Set-Up? — Note-taker choice judged on records and consent.
• AI Automation for Financial Advisers: Onboarding Without Re-Keying — Where AI fits in onboarding without re-keying client data.
• How Advisers Use AI to Prepare for Annual Client Reviews — Review preparation with AI and what stays human.
• Financial Adviser Client Agreement: Draft the Terms With AI, Then Check — Drafting the client agreement terms and checking them.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: FINRA Regulatory Notice 24-09 (27 June 2024) and FINRA Rule 2210 text on finra.org, read 4 November 2026.