On 9 December 2025, FINRA published its 2026 Annual Regulatory Oversight Report. For the first time, the report includes a standalone section on generative AI. The previous year’s report addressed AI within broader sections. The 2026 report treats it as a formal supervisory priority with governance expectations, testing requirements, and oversight controls that FINRA expects firms to implement.
The report establishes that firms need the ability to validate AI-generated marketing content against the specific regulations that apply to it, document the result, and demonstrate that a human reviewed the output. That is not a best practice recommendation. It is a supervisory expectation.
This article focuses on what the report means for marketing teams and the compliance officers who supervise their output.
Marketing Content Made FINRA’s GenAI List
FINRA’s 2025 report identified three GenAI use cases that member firms had implemented: summarisation, data analysis, and policy retrieval. The 2026 report expands that list to fifteen. Among them, listed explicitly, is content generation and drafting, which FINRA defines as technologies that create written materials such as documents, reports, or marketing content.
For marketing teams, this means every AI tool used to draft client-facing content now falls within FINRA’s regulatory scope. The firm’s written supervisory procedures must name it, the compliance function must oversee it, and the output must be reviewable. A marketer drafting a social media post with an AI assistant is no longer operating outside the governance framework.
For compliance officers, the obligation is specific. A firm may have enterprise AI governance covering its trading algorithms and customer service chatbots. If that governance does not extend to the marketing department’s use of AI for content creation, the 2026 report treats that as a supervisory gap, not an oversight still in progress.
GenAI Moved from Guidance to Supervision
FINRA’s content rules are technology neutral. Rule 2210 applies to AI-generated marketing materials the same way it applies to content written by a person. The 2026 report goes further. Firms now must update their written supervisory procedures to address how AI tools are used to create content, and FINRA will examine against this standard.
The report identifies two specific risks that apply directly to marketing content. The first is hallucination, which FINRA defines as instances where the model generates information that is inaccurate or misleading yet presented as factual. The second is bias from training data, which can produce content that reflects outdated or skewed information rather than current regulatory requirements.
For a marketing team, this changes the workflow. If a firm uses an AI tool to draft a social media post, an email campaign, or a landing page, the written supervisory procedures must name that tool. The review process must account for AI-specific risks such as a fabricated statistic or a performance claim the AI constructed from training data rather than the firm’s approved disclosures. A general review that treats AI-generated content the same as human-written content does not meet this standard.
For compliance officers, the requirement is operational. The procedures must define who reviews AI-generated content, what they review it against, and how that review is recorded. If a marketer drafts copy with an AI assistant on Monday and it is published on Wednesday, the firm must be able to show FINRA the documented review that happened in between.
The Compliance Standard Did Not Change. The Volume Did.
AI does not change the compliance standard. It changes the volume that must meet it. In Gartner’s 2025 CMO Spend Survey, 27% of CMOs cited improved capacity to produce more content or handle more business as a direct outcome of generative AI investment (Gartner, n=402). For marketing departments at regulated firms, every additional piece of content carries the same obligation under Rule 2210.
For marketing teams, the efficiency AI offers in production does not carry over to compliance. Every variant, every adaptation, every localised version is a separate piece of content that must be reviewed against the applicable regulations. The speed advantage disappears if the review process cannot keep pace with the output.
For compliance officers, this is a capacity problem. AI increases the volume of content that requires review without increasing the capacity to review it. The 2026 report makes this pressure explicit: firms must govern AI-generated content at the scale AI produces it.
A Human Must Review the Output
FINRA expects human review of AI-generated output as a supervisory requirement. The 2026 report discusses AI agents for the first time. These are systems that research, draft, personalise, and distribute content with limited human intervention. FINRA’s position is that the fewer points at which a human touches the content, the stronger the controls must be at each one.
For a marketing team, this defines where a human must intervene. An AI tool drafts a social media post about fund performance and includes a return figure. Before publication, someone must verify that the figure is accurate, that it is calculated in accordance with the applicable methodology, and that the required disclosures are present. If the content moves from draft to publication without that step, the firm has a supervision failure.
For compliance officers, the requirement extends beyond confirming that content looks reasonable. The reviewer must be able to compare the output against the specific regulation it is meant to satisfy. If the AI drafted a risk disclosure, the reviewer needs the actual regulatory text in front of them, not just the AI-generated version. Checking that a disclosure exists is not the same as verifying that it complies.
AI Washing Carries Its Own Compliance Exposure
FINRA explicitly references AI washing charges brought by other regulators. In March 2024, the Securities and Exchange Commission (SEC) settled charges against two investment advisers for overstating how AI was used in their investment processes. Both firms had made claims in marketing materials and client communications that did not reflect the actual capabilities of their technology. In September 2024, the Federal Trade Commission (FTC) launched Operation AI Comply, a coordinated enforcement action against five companies for deceptive practices involving AI, ranging from overstated capabilities to AI tools used to facilitate consumer fraud. The risk applies directly to marketing content. A firm that describes its service as powered by advanced AI when the underlying technology is a basic rules engine has made a misleading claim. A campaign stating that our AI analyses thousands of data points in real time must be accurate about what the system actually does, not just compliant with the product disclosures.
This creates a dual compliance obligation for marketing teams. The content that AI generates must comply with the regulations governing the product it promotes. Separately, any claim the firm makes about its own use of AI must itself be accurate and substantiated. A compliance officer reviewing a campaign now has two questions. Does the content comply with the applicable product regulations? And are the claims the firm makes about how it uses AI true?
Your Vendor’s AI Is Your Compliance Problem
The firm’s supervisory obligation does not transfer when it outsources content creation. An agency uses an AI tool to draft a campaign copy for a FINRA member firm. The AI fabricates a compliance disclosure that does not match the product’s actual risk profile. The regulatory liability sits with the firm, not the agency. The same applies to a freelancer, a technology vendor, or any third party producing content on the firm’s behalf.
The report raises a vendor risk that most contracts do not yet cover. An AI vendor updates its underlying model without disclosure. The new model handles regulatory language differently, and content that met compliance standards last month may not meet them today. The report’s emphasis on third-party risk governance and ongoing monitoring suggests firms should consider contractual controls that require disclosure of material model changes and supervisory processes that account for shifts in output quality.
Five Expectations for Marketing and Compliance Teams
FINRA’s 2026 report establishes five expectations for anyone producing or supervising marketing content at a member firm:
First, marketing content created by AI is a named, supervised use case. It is not covered by general AI governance unless the governance explicitly addresses content creation.
Second, written supervisory procedures must require that AI-generated marketing content is reviewed against the applicable regulations before publication.
Third, human review of AI-generated marketing content is a supervisory expectation. Fully automated content pipelines do not meet that standard.
Fourth, claims about AI capabilities in marketing materials must be accurate and balanced. AI washing is a stated concern.
Fifth, outsourcing content creation does not outsource the compliance obligation. Third-party content must meet the same standard.
The operational requirement behind all five is the same. Validate marketing content against the specific regulations that govern it, before publication, with a documented record of the result.
In a single scan, Intercepta AI validates marketing content against 1000+ regulatory rules across US, UK, EU, Canada, Australia, and New Zealand. Each scan covers every jurisdiction the content reaches and produces a documented compliance report with remediation guidance per rule. Marketing teams validate before publication. Compliance teams get a documented regulatory record.
Run your first three scans on us at intercepta.ai.