Reg BI and AI meet in supervision: a broker-dealer can use AI to review retail recommendations for Reg BI compliance, because neither the SEC nor FINRA has a rule against it, but every obligation stays where it was. FINRA says its rules are technology-neutral and continue to apply when firms use generative AI; the SEC's Division of Examinations says it will examine how firms monitor what it calls "super intelligence (SI)," including in their Reg BI compliance. So the useful question for a chief compliance officer is not whether AI is allowed but where its authority ends. Botminds' Reg BI Compliance Review draws the line in one place: six agents assemble the evidence, test it against the care obligation and propose a disposition with their sources; a registered principal decides every flag, a second person confirms every closure, and the chief compliance officer approves every test. This guide is about that line, and about what to ask before trusting any tool that claims to sit on the right side of it.
The examples use the solution's fictional sample broker-dealer, Quillfield Securities. Where the page describes the solution's behaviour, it is the solution's design and settings, not a regulator's requirement.
Reg BI review, task by task: what agents may do and what a principal must
| Task | The agents may | A registered principal must | Never delegated |
|---|---|---|---|
| Gather the evidence | Join each recommendation to the profile, fee tables, shelf, holdings and payout grid | Rely on it only where every figure cites its source | Clearing anything whose data is missing |
| Test the care obligation | Price alternatives, test profile fit and concentration, read the rationale, check the payout differential | Read the findings for flagged items and weigh them | Treating the cheapest option as the best |
| Decide a flag | Propose a disposition and a reason code | Approve, follow up, escalate or overrule an agent, always with a reason | The decision itself |
| Clear routine items | Clear only within thresholds the CCO approved, with the evidence filed | Own the design of those thresholds and review disagreements | Clearing a complex product for a client 65 or older |
| Talk to the advisor | Draft the follow-up from the findings; pre-check the reply | Edit and send the follow-up | Writing the advisor's rationale for him |
| Talk to the client | Draft a letter from the firm template | Approve the letter before anything is sent | Sending anything unapproved |
| Close the case | Check the reply against every original finding | Propose closure; a second person confirms | Closing a case |
| Money owed to clients | Estimate restitution with its inputs | The CCO approves, rejects or asks for more | Treating an estimate as final |
Can AI be used for Reg BI compliance?
Yes. No SEC or FINRA rule prohibits it, and none requires it; the obligations that apply to a human reviewer apply to a system. FINRA's Regulatory Notice 24-09, issued on June 27, 2024, states that "FINRA's rules–which are intended to be technology neutral–and the securities laws more generally, continue to apply" when firms use generative AI (FINRA, Regulatory Notice 24-09). Reg BI's compliance obligation asks for written procedures "reasonably designed to achieve compliance," and says nothing about whether a person or a program carries them out.
The SEC has no AI-specific rule for broker-dealers. It proposed rules in 2023 on conflicts of interest from the use of predictive data analytics by broker-dealers and investment advisers, then formally withdrew them as of June 17, 2025; in the withdrawal notice the Commission says it will not finalise them and would issue a new proposal if it returns to the subject (SEC Release 33-11377). A firm that uses AI in Reg BI review is therefore judged by the rules it already knows: Reg BI, the books-and-records rules and FINRA's supervision rule.
What does the SEC say about super intelligence in Reg BI programs?
It says examiners will look at it. The SEC Division of Examinations' fiscal 2027 priorities, published on 23 October 2026, use the term "super intelligence (SI)" and state: "The Division will also prioritize examinations of policies and procedures relating to monitoring SI, including its use in fraud prevention and detection, back-office operations, compliance with AML and Reg BI obligations, and trading functions" (SEC, FY2027 priorities).
The same document says what examiners will test where firms use automated tools for recommendations: whether what firms say about the tools is fair and accurate, and whether their operations and controls match what they disclose to investors. Applied to an AI reviewer, that means two practical questions. Does the firm's description of its supervision match what the system actually does? And can the firm show, for any recommendation, what the system checked, what it found and who decided? The Division also says its own use of SI adds capacity and oversight without taking the place of examiners' judgement, which is a fair description of the standard it will expect from firms.
Does FINRA allow AI in supervision?
Yes, inside the supervisory system and governed like any other part of it. Regulatory Notice 24-09 reminds firms that "pursuant to Rule 3110 (Supervision), a member firm must have a reasonably designed supervisory system," and that where generative AI is part of it, "its policies and procedures should address technology governance, including model risk management," as well as "data privacy and integrity, reliability and accuracy of the AI model."
Rule 3110 itself sets the boundary that matters most. Review of transactions must be by a registered principal and evidenced in writing; Supplementary Material .05 allows a risk-based review system to focus the principal's attention (FINRA Rule 3110). An AI reviewer fits naturally as the risk-based system that chooses what reaches the principal and assembles the file. It does not fit as the principal. The duties to review, evidence and follow up belong to a registered person, and procedures that let a model clear recommendations must be designed, approved and tested by people who answer for them.
One flagged recommendation: who does what, from overnight test to closure
Agent
Intake, Care, Profile, Rationale and Conflicts agentsJoin the data, run the four tests independently and file each finding with its source and a confidence score.
Never: Never clear an item whose data has not arrived, or a complex product for a client 65 or older.
A person decides
Supervising principalReads the findings, asks the agents questions, decides with a reason code, edits and sends the follow-up.
Agent
Remediation and Records agentChecks the advisor's reply against every original finding and drafts the client letter from the firm template.
Never: Never sends anything or closes a case.
A person decides
Compliance analystConfirms the closure the principal proposed; prepares any restitution calculation.
A person decides
Chief compliance officerApproves restitution, every threshold and every agent change, each proposed by someone else.
Can AI clear a recommendation without a person?
Only within limits a person set, approved and can defend. Rule 3110's risk-based review allows a firm to avoid detailed review of every transaction if its system lets it focus on the riskiest, and the SEC's 2019 Reg BI release gave firms room to focus "on specific areas of their business that pose the greatest risk of noncompliance" rather than reviewing each recommendation in detail (Release No. 34-86031). Clearing routine recommendations automatically is that same design choice made with better information, and the firm owns it.
In the sample firm the limits are explicit settings the chief compliance officer approved. An item clears automatically only when all four tests pass with confidence of at least 0.85, with its evidence filed; a complex product for a client 65 or older always goes to a person; nothing clears without its data, so when the compensation file arrived 48 minutes late, the Conflicts agent waited and re-ran 412 items rather than clearing them. On the sample night, 4,519 of 4,812 recommendations cleared that way, 1,410 of them on firm-approved rationale templates, and 293 went to a principal. A firm that adopts such limits should test them on closed files first and sample the cleared items afterwards, so the clearing itself is supervised.
When agents disagree, both views go to the principal
A single risk score hides the argument a principal needs to see. When two agents read the same file differently, the review should show both, with their sources, and let the principal choose. In the sample, a 66-year-old's $180,000 short-surrender annuity passes the cost test because a September CRM note says he will buy a home in about three years, and fails the profile test because the profile on file, 44 months old, still says ten years or more. The principal sides with the cost test and asks the advisor to update the profile, recording reason code OVR-DATA-STALE.
What happens to that choice afterwards matters as much. In the solution, a principal's choice and reason code do not retrain either agent automatically; an analyst reviews disagreements weekly, and any change to a test is proposed by one person, tested on last week's recommendations and approved by another. That keeps the model from learning a principal's shortcuts and keeps every change on the record.
An advisor's reply, checked by an agent, waiting for two people
What alerts alone do not fix
Automated flags have been part of supervision for years, and the enforcement record shows their limit: a flag that nobody resolves on the evidence is not supervision. In April 2026 FINRA fined Cambridge Investment Research $200,000 over one representative's early sales of unit investment trusts. "The firm relied on an automated system that flagged every sale of a UIT followed by the purchase of another UIT within a set period of time." His recommendations generated about 60% of all such alerts firmwide while accounting for about 10% of the firm's UIT business, supervisory personnel escalated concerns from June 2020, and the firm did not act until 2023; 184 customers paid at least $389,200.62 in costs they would not otherwise have incurred (FINRA, June 2026).
An alert system and an evidence-assembling review, on the same problem
Alert system: A flag and a one-line reason, for executed trades that break a rule.
Agents assemble, principal decides: Every recommendation tested; the flagged ones arrive with the costs, alternatives, profile, rationale and payout already set out.
Alert system: Each alert stands alone; a representative with 60% of a rule's alerts looks like 60 separate tickets.
Agents assemble, principal decides: Clusters by advisor, branch and wording are shown as one item with one follow-up.
Alert system: The representative's stated reason, taken as given.
Agents assemble, principal decides: The stated reason tested against the file and the shelf.
Alert system: Often a closed alert with no recorded basis.
Agents assemble, principal decides: A decision with a reason code, a named principal and a second person on closure.
Alert system: Concerns travel by email.
Agents assemble, principal decides: Possible restitution goes to the CCO with the calculation prepared.
How should AI reviews be recorded?
As a supervisory record a principal and an examiner can both read: what the system looked at, what it found, with what confidence, which version of it ran, and what the registered principal decided and why. Rule 3110 requires review "evidenced in writing"; the SEC's priorities ask whether operations match what firms disclose; FINRA asks for model governance. A record that holds only the final disposition answers none of those.
In the sample firm every agent step and every human decision is written to an append-only, fingerprinted audit trail with the agent's version, and a case file holds the recommendation, the rationale, a snapshot of the profile, the cost and alternatives evidence with prospectus pages, each finding with its confidence, and the decision with its reason code and both names. Client data is masked by default when the file is exported for a FINRA or SEC request. Communications the agents draft for clients remain communications of the firm, subject to the same review and approval as any other.
What to ask before buying an AI tool for Reg BI review
The questions that separate a tool a principal can rely on from one that adds risk are about evidence, authority and change. Ask them of any vendor, including us, and ask to see the answer on your own past recommendations rather than on a demonstration file.
Ten questions to ask any AI tool for Reg BI compliance review
- Does every finding cite its source?
The prospectus page, the profile field, the rationale form, the payout grid line. A finding a principal cannot check is a finding an examiner will not accept.
- What happens when data is missing?
The right answer is that the item waits and is never cleared.
- Who can clear a recommendation, and within what limits?
Ask to see the thresholds, who approved them and which items can never be cleared automatically.
- Does it test holds and declined recommendations, not only executed trades?
The SEC criticised surveillance that saw only executions.
- Does it compare against your shelf or a vendor's universe?
Reasonably available alternatives are the firm's, per profile.
- Does it read rationales across the book?
Copied reasons are invisible one ticket at a time.
- What happens when two checks disagree?
Both views should reach the principal, with sources, not a blended score.
- Does it ever write or rewrite an advisor's reasons?
If it does, the file no longer records what the representative thought.
- How are changes made and recorded?
Proposed by one person, tested on past recommendations, approved by another, with the model version on every finding.
- Can you export one examination file with every decision and both names?
If it takes a project to answer a regulator, the record is not ready.
Where Reg BI Compliance Review fits, and where it does not: it reviews retail recommendations against Reg BI and assembles the supervisory file; it does not replace trade surveillance for market abuse, electronic communications surveillance or the firm's books and records system, and it needs the firm's order, CRM, product cost, compensation and document systems connected before it can test anything. The test those agents apply is described in the Reg BI care obligation, and the principal's day around them in a supervisory principal's morning. To see it on your own past recommendations, start from Reg BI Compliance Review.
Questions people ask
Who is accountable when AI flags, or misses, a recommendation?
The firm and its registered principals, as before. FINRA's rules apply whether a person or a tool performs a task, and Rule 3110 places review with a registered principal. A tool that misses a pattern is a weakness in the firm's supervisory system, which the firm must design, test and correct.
Has the SEC adopted an AI rule for broker-dealers?
No. The SEC's 2023 proposal on conflicts from predictive data analytics was formally withdrawn as of June 17, 2025, and the Commission said it would issue a new proposal if it acts again. Existing rules apply, and the SEC's fiscal 2027 examination priorities say examiners will look at how firms monitor SI used in Reg BI compliance.
Can AI write a Reg BI rationale for the advisor?
It can draft text, but a rationale is meant to record why the representative believed the recommendation was in the customer's best interest at the time. A rationale written by a tool after the fact records the tool's view, not the representative's; Reg BI Compliance Review checks advisors' replies and never writes them.
Do AI-drafted follow-ups and client letters need approval?
Yes. They are communications of the firm. FINRA's notice on generative AI says its communications rules apply whether a person or a technology tool generates the content, and the firm's own review and approval procedures apply as for any other letter.
What does model risk management mean for a Reg BI review tool?
Knowing which version ran on which recommendation, testing changes on past data before they go live, measuring how often the tool's findings are overruled and why, and having a person with authority approve each change. FINRA's 2024 notice names technology governance, model risk management, data integrity and the reliability and accuracy of the model as areas firms' procedures should address.