FINRA Adds Dedicated AI and Cybersecurity Section to 2026 Regulatory Report

FINRA's 2026 regulatory report adds a dedicated AI and cybersecurity section for the first time, signaling increased scrutiny of emerging tech use.

FINRA's 2026 Annual Regulatory Oversight Report, published in December 2025, includes a dedicated section on artificial intelligence and cybersecurity for the first time, signaling that regulators are preparing to increase scrutiny of how wealth management firms use emerging technologies.

The nearly 90-page report identifies generative AI as a "rapidly evolving area" that presents both opportunities and risks for broker-dealers and their registered representatives. FINRA noted that firms are increasingly deploying AI tools for client communications, portfolio analysis, compliance monitoring, and prospecting — activities that fall squarely within the regulator's supervisory scope.

The new AI section outlines several areas of concern. First, FINRA is focused on how firms validate the accuracy of AI-generated communications sent to clients. Large language models are known to produce confident-sounding but factually incorrect outputs — a particular risk when the communication involves investment recommendations or market projections that could constitute material misrepresentation.

Second, the regulator is examining how firms handle data privacy in the context of AI tools. Many AI platforms process client data through third-party servers, raising questions about data security, client consent, and compliance with existing privacy regulations including Regulation S-P and state-level privacy laws.

Third, FINRA expressed concern about algorithmic bias in AI-driven prospecting and client segmentation tools. If an AI system systematically favors or disfavors certain demographic groups in its recommendations or client matching algorithms, the firm using the system could face discrimination claims — even if the bias was unintentional.

The cybersecurity component of the report is equally significant. FINRA highlighted several emerging threat vectors, including sophisticated phishing attacks that use AI-generated voice and video to impersonate firm executives, ransomware attacks targeting client data, and supply chain vulnerabilities in third-party technology vendors.

For financial advisors, the practical implications are significant. Firms will likely need to implement new policies governing the use of AI tools, including requirements for human review of AI-generated content, documentation of AI tool usage, and regular audits of AI system outputs. Advisors who use personal AI tools — ChatGPT, for example — to draft client communications may find themselves subject to new compliance requirements.

The 2026 report also reaffirms FINRA's ongoing focus on Regulation Best Interest (Reg BI) compliance, Consolidated Audit Trail (CAT) reporting, and anti-money laundering obligations. These perennial focus areas will continue to dominate examination priorities alongside the newer AI and cybersecurity concerns.

Industry compliance experts recommend that firms begin preparing now for increased regulatory scrutiny of their AI usage. Key steps include: documenting all AI tools currently in use, establishing governance frameworks for AI deployment, training registered representatives on appropriate AI use, and conducting risk assessments that specifically address AI-related risks.

What to watch: FINRA is expected to issue supplemental guidance on AI usage in the first half of 2026. The guidance will likely include specific expectations for how firms supervise AI-generated communications and manage the data privacy risks associated with third-party AI platforms. Firms that get ahead of these requirements will be better positioned when examination teams start asking questions.