Originally published at jy-labs.com. Updated 2026-10-07.
AI automation for financial advisors and community banks should start with meeting notes, then compliance lookups, then lead qualification, because those three produce the audit trail examiners ask for. This October 2026 update covers what the SEC, FINRA, and the bank regulators said in the last 18 months, when an AI output becomes a record you must keep, what the named vendors charge, and where a small firm should build instead of buy.
The problem
A two-advisor RIA in Georgetown and a three-branch community bank face the same question in October 2026: which AI tools survive an exam. The rules moved less than the headlines suggest. The SEC withdrew its predictive data analytics proposal in June 2025 and has not replaced it. FINRA's 2026 Oversight Report restated that its rules are technology-neutral. The OCC, Federal Reserve, and FDIC rewrote model risk guidance in April 2026 and carved generative AI out of it. You are applying rules written for email and spreadsheets to tools that write client summaries on their own. The firms doing well picked use cases where the audit trail comes built in, bought the commodity pieces, and built the pieces that touch their own documents.
The approach
What the regulators said since this post first ran
Six changes matter for a small advisory firm or community bank. Dates and sources are below so your compliance consultant can check them.
The SEC withdrew the predictive data analytics proposal. On June 12, 2025 the Commission withdrew fourteen pending proposals, including S7-12-23, effective June 17, 2025. The withdrawal notice says the SEC "does not intend to issue final rules with respect to these proposals" and will "issue a new proposed rule" if it returns to the subject. Nothing has replaced it as of this update. Your fiduciary duty, the Marketing Rule, and the books-and-records rule still apply to every AI output.
SEC exam priorities for 2026 name Regulation S-P and AI representations. The Division of Examinations published its 2026 priorities on November 17, 2025 and said it "will also examine for compliance with new rules, such as the 2024 amendments to Regulation S-P." Law firm summaries of the full document (Katten, Simpson Thacher) report that examiners will review adviser statements about AI capabilities for accuracy and check for policies that supervise AI use.
FINRA's 2026 Annual Regulatory Oversight Report added a generative AI section. The report (December 2025, pages 24 to 27) says FINRA rules "continue to apply when firms use GenAI," cites Rule 3110 on supervision, lists "summarization and information extraction" as the top use case among member firms, and covers AI agents for the first time. Page 46 says a firm using GenAI for chatbot communications with investors must ensure "retention of those chat sessions." Page 30 tells firms to assess each vendor's use of GenAI and to add contract language that bars firm or customer data from being fed into a vendor's open-source GenAI tool.
Bank regulators rewrote model risk guidance and left generative AI out of it. OCC Bulletin 2026-13 (April 17, 2026) replaced the 2011 interagency guidance. The bulletin says "Generative AI and agentic AI models are novel and rapidly evolving" and "are not within the scope of this guidance," that the guidance "does not set forth enforceable standards," and that the agencies plan a request for information covering banks' AI use. OCC Bulletin 2025-26 (October 6, 2025) states that the guidance "does not, and should not be interpreted to, require community banks to perform annual model validation."
Proposed third-party risk management guidance is open for comment. On September 11, 2026 the FDIC, Federal Reserve, NCUA, and OCC proposed new third-party guidance and a companion guide for Fed-supervised community banks. Comments close 60 days after Federal Register publication. The agencies also issued a statement on how they will weigh community bank relationships with core providers in supervisory decisions. Any AI vendor that touches customer data falls under this framework once it is final.
Regulation S-P amendments are in force for every adviser. The SEC adopted the amendments on May 16, 2024. Per Seward and Kissel, smaller entities (advisers under $1.5 billion in AUM) had until June 3, 2026. Larger entities had until December 3, 2025. You must notify affected customers within 30 days of a qualifying incident, and your service providers must notify you within 72 hours. An AI notetaker or a RAG vendor holding client data is a service provider under your incident response program.
Texas added a state layer. The Texas Responsible Artificial Intelligence Governance Act took effect January 1, 2026. Per Ashurst Perkins Coie, its prohibitions (behavioral manipulation toward self-harm, intentional unlawful discrimination, and others) apply to any person who develops or deploys AI, while the duty to tell consumers they are talking to an AI falls on government agencies and health care providers. The Attorney General has exclusive enforcement, some violations carry a 60-day cure period, and penalties run $10,000 to $200,000 per violation. Nothing in this section is legal advice. Have counsel read the statute.
When an AI output becomes a record you must keep
This is the question that stalls most advisory firms, so here is the framework compliance counsel use.
Skadden's analysis of Advisers Act Rule 204-2 and Exchange Act Rule 17a-4 turns on transmission. Content that sits inside an application is not a "sent or received" communication. The obligation attaches when someone sends it, by email, chat, portal, or report, and the subject matter falls inside the rule. For advisers, Rule 204-2(a)(7) covers written communications about four things: recommendations or advice, receipt or delivery of funds or securities, order placement or execution, and performance. For broker-dealers, Rule 17a-4(b)(4) covers communications relating to the business as such, which is broader.
FINRA went further for chatbots. The 2026 Oversight Report (page 46) says a firm using GenAI for chatbot communications with investors must supervise and retain those communications and the chat sessions themselves.
The industry is pushing back. On October 15, 2025 SIFMA petitioned SEC Chairman Atkins to exclude "AI-generated meeting transcripts and collaborative platform inputs" from retention and to set a uniform three-year period. I found no SEC action on that petition as of this update, so the current rules stand.
Three lines for your written supervisory procedures:
- Anything an AI drafts and you send to a client is a record. Archive it the same way you archive the email it rode in on.
- A meeting summary that contains a recommendation and gets emailed to the client is a record. A summary that stays inside the notetaker and never leaves is a closer call. Pick a tool that lets you set a retention policy and export, so the answer does not depend on the vendor's defaults.
- A client-facing chatbot transcript is a record. Log every session with a timestamp and the model version, which is also what FINRA's monitoring section asks for.
Meeting notes: where most advisory firms start in 2026
FINRA's survey found summarization is the top GenAI use case among member firms, and that matches what I see. A notetaker is cheap, vendor-hosted, and the retention question above is the only hard part.
Three vendors built for advisors, with list prices as of October 2026:
- Jump: Meet plan at $100 per advisor per month for the notetaker, meeting prep, follow-up emails, and CRM sync. Onboard (form completion, document intake) and Grow (meeting analytics, coaching) are $50 add-ons each. The compliance dashboard, custom attestations, and custom disclosures sit on the Enterprise tier, which is priced by quote. Annual billing saves up to 20 percent.
- Zocks: Essentials $67, Professional $117, Ultimate $184 per user per month on annual billing ($80, $140, $220 monthly). Zocks records no audio or video on any tier and stores data in the U.S. Audit logs, transcript archiving, configurable retention, and PII redaction start at Professional, so budget $117 if you want the compliance features.
- Zeplyn: Per WealthManagement.com (July 24, 2026), seats start at $120 per advisor per month for the Meeting Assistant, with the Agent Nexus upgrade (manager reports, AI role-play) from $195. Enterprise pricing is custom.
The tradeoffs. Zocks answers the recording question by never making one, which simplifies consent and retention but removes the audio if a client later disputes what was said. Jump has the widest integration list and the most mature CRM workflow, with compliance controls gated behind Enterprise. Zeplyn costs the most per seat and is the youngest of the three.
For a firm under ten advisors, buy one of these. Do not build a notetaker. The money goes further on the next two items.
Compliance lookups: the piece worth building
Your compliance manual, Form ADV, written supervisory procedures, past deficiency letters, and the FINRA notices your consultant forwards are the documents your advisors search by hand. A RAG agent indexes that set and answers questions with the clause it pulled from, so the compliance officer verifies the source instead of re-running the search.
FINRA's 2026 report names the failure mode: hallucinations where "misrepresentation or incorrect interpretation of rules, regulations or policies" affects decisions. A citation-first design is the answer. If the agent cannot point to a clause, it says so instead of guessing. RAG agents versus FAQ chatbots explains the difference in plain terms.
The closest numbers I can share are from a regional law firm, a different industry with the same document problem. Across 50,000 documents, daily research time per attorney dropped from 3.2 hours to 38 minutes, validated against 200 real queries until accuracy passed 95 percent. A compliance library at a 5-advisor RIA is smaller and the questions repeat more, which makes the index easier to build and test.
Why build rather than buy here: the value sits in your documents and your firm's past interpretations, and no vendor ships those. Keep the index inside your own cloud account with role-based access, which also satisfies the vendor-data clause FINRA asks you to put in contracts.
Lead qualification without a suitability problem
Qualifying a prospect means checking accredited status, asset minimums, and stated risk tolerance before an advisor takes the call. AI lead generation applies your written criteria to every inquiry the same way and logs why each prospect was routed or declined.
The log is the point. Per the law firm summaries above, 2026 exams will check whether algorithms lead to advice consistent with an investor's profile. A qualification trail that shows the inputs, the rule applied, and the outcome is what you hand the examiner.
For scale, the only client numbers I will cite are from a B2B SaaS pipeline build: qualified pipeline grew 3.1x and cost per qualified lead fell from $340 to $129. Advisory inbound volume is lower and the criteria stricter, so expect the time savings before the volume gains.
Phone and chat for community banks: your core provider decides
The customer-facing AI options for a community bank in 2026 run through the core.
- Jack Henry expanded its Google Cloud agreement on June 25, 2026 to build an AI security platform and to deploy Gemini Enterprise Agent Platform for support and operations. The release says about 7,400 community banks and credit unions depend on Jack Henry, and cites early adopters reporting administrative time savings of up to 70 percent. That figure is Jack Henry's, from early adopters, with no published method.
- Fiserv launched agentOS on May 14, 2026 with OpenAI, an agent marketplace across its core and payments platforms. It was in beta with two institutions at launch and Fiserv said it expected wide availability by August 2026.
- Posh sells voice and digital assistants plus an employee knowledge assistant and says it serves more than 100 financial institutions. Posh publishes no pricing. Ask for the integration list for your core and digital banking platform before you ask for a quote.
For an advisory firm or a bank branch without a core-level option, a voice agent handles scheduling, statement requests, and hours-and-location calls, and routes anything about an account balance or a recommendation to a person. The numbers I can cite come from a regional healthcare network: no-shows fell from 18 percent to 4.9 percent and the agents answer 99.2 percent of calls within three rings. Scheduling is scheduling. The routing rule is what changes for a bank.
One caution from FINRA's agent section: do not let an agent execute a regulated action on its own. Scheduling an appointment is fine. Moving money or changing a beneficiary needs a human in the loop, and the report lists "human in the loop" oversight and action tracking as the controls it expects.
Marketing content: AI drafts under the Marketing Rule and Rule 2210
The SEC's Investment Adviser Marketing rule (adopted December 22, 2020, effective May 4, 2021) and FINRA Rule 2210 apply to a draft whether a person or a model wrote it. FINRA's Regulatory Notice 24-09 said so in June 2024, and the 2026 report repeats it.
Two specific traps:
- Claims about your own AI. The SEC fined Delphia $225,000 and Global Predictions $175,000 on March 18, 2024 for overstating what their AI did. FINRA's 2026 report asks that retail communications mentioning AI "accurately describe how these offerings incorporate AI technology" and balance benefits with risks. If your site says "AI-powered," be able to show what the AI does.
- Missing disclaimers and prohibited claims. A general-purpose writing tool does not know your firm's approved language. Content automation configured with your disclaimer blocks and prohibited-claim list produces drafts your reviewer passes more often. The review step stays.
Two review vendors for firms with volume: Hadrius (AI marketing review, employee attestations, exam packs, claims 500 or more client institutions) and Saifr (SaifrReview for marketing, owned by FMR LLC). Neither publishes pricing. For a solo advisor, a configured drafting workflow plus your existing compliance consultant costs less.
Where to start if you are a smaller firm
The order, for a firm of two to ten advisors or a bank under $1 billion in assets:
- Buy a notetaker this month. $100 to $120 per advisor per month. Set the retention policy before the first client meeting and write one paragraph in your WSP about where summaries go.
- Build the compliance lookup. This is the piece with the clearest audit trail and the one that touches every advisor. Budget six to eight weeks, longer than a standard RAG build because of the review and testing regulated data needs.
- Add lead qualification once inbound volume justifies it. My rule of thumb is 20 or more qualified inquiries a month.
- Add phone or chat last. For a bank, wait for your core provider's option and compare it against a standalone vendor on the integration list, not the demo.
Before any of it, do three things. Confirm your Regulation S-P incident response program covers each AI vendor as a service provider with the 72-hour clause in the contract. Add the FINRA vendor-data clause that bars your client data from a vendor's open-source model. Decide who reviews prompts and outputs each quarter and write that down.
Advisory firms in Georgetown and the wider Austin metro tend to add lead qualification sooner, because the inbound volume is there once the compliance foundation is in place.
JY Labs builds the compliance lookup and lead qualification pieces and configures the content workflow. Pricing is on the site. The first step is a $350 AI strategy session, credited in full toward a build, where we map your document set and your exam history to the order above. Book it here. If you want the broader argument for a part-time builder over a full-time AI hire at this firm size, read fractional AI operator versus in-house hire.
Results
A firm that follows this order ends up with three things an examiner asks for: a retention policy for AI-generated summaries, a compliance lookup that cites its source for every answer, and a qualification log that shows why each prospect was routed. The only client numbers I will attach are from the linked case studies, in other industries: research time cut from 3.2 hours to 38 minutes a day at a law firm, and 99.2 percent call answer rate at a healthcare network. Expect the compliance lookup to pay back in advisor hours first and in exam preparation second. Order beats speed. Start where the audit trail is clearest and the data stays inside your own account, then expand.
FAQ
Is AI automation compliant with SEC and FINRA regulations for financial advisors?
AI automation is compliant with SEC and FINRA regulations when the firm configures it to meet the rules that already exist. FINRA's 2026 Oversight Report says its rules are technology-neutral and apply to generative AI the same way they apply to any tool. The SEC withdrew its AI-specific predictive data analytics proposal in June 2025, so the fiduciary duty, the Marketing Rule, and the books-and-records rule govern. A RAG agent that cites its source and a lead qualification system that logs its criteria produce the audit trail examiners expect. Have compliance counsel review the configuration before launch.
Can a RAG agent access confidential client financial data safely?
Yes, a RAG agent accesses confidential client financial data safely when it runs inside the firm's own cloud account or an isolated environment with role-based access controls. Data stays encrypted in transit and at rest, and access matches who sees the underlying documents today. Under the amended Regulation S-P, in force for all advisers since June 3, 2026, any vendor holding that data is a service provider in your incident response program and must notify you within 72 hours of a breach.
How long does it take a financial services firm to deploy AI automation?
A financial services firm deploys a compliance-focused RAG agent in six to eight weeks, longer than a standard build because regulated data needs added review and testing. A vendor notetaker such as Jump or Zocks takes days, with the retention policy as the only setup decision that matters. Lead qualification and voice agent deployments follow similar six to eight week timelines once the compliance foundation is in place.
Will AI replace financial advisors?
No, AI will not replace financial advisors. AI automation removes the search and administrative work around advising, such as finding a regulation, summarizing a meeting, or qualifying an inbound lead, so advisors spend more time on the relationship and judgment calls a client pays for. The advisor still makes every recommendation, and FINRA's 2026 report asks for human-in-the-loop review of AI outputs.
What size firm is AI automation practical for?
AI automation is practical for firms with as few as two or three advisors, because the manual search problem exists at every size and a notetaker costs $100 to $120 per advisor per month. Lead qualification and multi-channel automation make sense once inbound volume justifies setup, at 20 or more qualified inquiries a month. For a community bank, the practical size question is which core provider you use, since Jack Henry and Fiserv now ship AI through the core.
Did the SEC predictive data analytics rule pass?
No, the SEC predictive data analytics rule did not pass. The SEC withdrew the proposal (file S7-12-23) on June 12, 2025, effective June 17, 2025, along with thirteen other pending proposals, and said it would issue a new proposed rule if it revisits the subject. As of October 2026 no replacement exists. Existing conflict-of-interest, fiduciary, and recordkeeping rules still apply to AI tools.
Do AI meeting notes count as records under SEC rules?
AI meeting notes count as records under SEC rules when the firm sends them and they cover advice, movement of funds or securities, orders, or performance, the four categories in Advisers Act Rule 204-2(a)(7). Notes that stay inside the application and never get transmitted fall outside that rule under the analysis compliance counsel use. FINRA's 2026 report requires retention of chatbot sessions with investors. SIFMA asked the SEC in October 2025 to exclude AI transcripts from retention, and the SEC had not acted on that request as of this update.
What does FINRA's 2026 report say about generative AI?
FINRA's 2026 Annual Regulatory Oversight Report says FINRA rules continue to apply when firms use generative AI, cites Rule 3110 on supervision, and lists summarization and information extraction as the top use case among member firms. It asks firms to test tools for accuracy and bias, log prompts and outputs, track model versions, keep a human in the loop, assess each vendor's use of GenAI, and retain chatbot sessions with investors. It covers AI agents for the first time and warns against agents executing regulated actions without human approval.
Can a community bank use generative AI under the 2026 model risk guidance?
Yes, a community bank can use generative AI under the 2026 model risk guidance, which excludes generative and agentic AI from its scope and sets no enforceable standards. OCC Bulletin 2026-13 (April 17, 2026) says those tools fall under the bank's broader governance and risk controls, and the agencies plan a request for information on AI use. OCC Bulletin 2025-26 confirms community banks are not required to validate models annually. Proposed third-party risk guidance from September 2026 will cover AI vendors once final.
Does the Texas AI law apply to a financial advisory firm?
The Texas Responsible Artificial Intelligence Governance Act applies to a financial advisory firm in a limited way. Its prohibitions, such as using AI to manipulate behavior toward self-harm or to discriminate unlawfully against a protected class, apply to any person who develops or deploys AI in Texas. The duty to tell consumers they are interacting with AI applies to government agencies and health care providers. The law took effect January 1, 2026, the Attorney General enforces it, and some violations carry a 60-day cure period. This is a summary, not legal advice.
JY Labs builds AI automation for businesses: RAG agents, lead generation, content automation, and voice agents. Read the original post and more at jy-labs.com.
Top comments (0)