AI Use Inventory for Broker-Dealers and RIAs: Examiners

An AI use inventory is the first document an SEC or FINRA examiner asks for once an exam touches artificial intelligence: a system-by-system list of every AI tool in production, each one tagged with its business function, the customer data it touches, who supervises it, and whether the Form ADV or communications disclosure on file actually matches what the system does. Neither regulator has written a new AI rule. The SEC’s Fiscal Year 2026 examination priorities and FINRA’s Regulatory Notice 24-09 both start from the position that existing disclosure, supervision, and recordkeeping obligations already apply to AI, and the inventory is the one artifact that proves a firm has mapped its AI footprint to those obligations. A broker-dealer or RIA that cannot produce that list inside a typical exam response window reads to an examiner as having no AI governance program at all. This guide sets out what belongs in the inventory, the field schema that makes it usable in an exam, how it maps to the rules examiners cite, and the sequence for building one before the request letter arrives.

Working through this in production? See how we run a broker-dealer AI compliance.

Why the AI use inventory became a 2026 exam priority

The SEC Division of Examinations published its Fiscal Year 2026 priorities on November 17, 2025. AI does not appear as an isolated line item. It is woven into the cybersecurity, emerging technology, operational resilience, and advisory conduct priorities, which is the signal that matters: examination staff expect to touch AI oversight in the course of a normal exam, not only when a firm markets itself as an AI-driven adviser. Three things are consistent across the priorities documentation. First, whether marketing materials, Form ADV disclosures, and client communications accurately describe the extent and limits of a firm’s AI use, since overstating AI capability to gain a competitive edge (AI washing) is treated as a disclosure and conduct problem. Second, whether the firm has written policies and procedures that monitor and supervise AI use for the investment process and for operational and compliance tasks. Third, whether supervisory procedures exist to catch AI errors or bias before they reach a client.

Want to put this into practice? Use our AI inventory & risk-tiering wizard.

FINRA reached the same place from a different direction. Regulatory Notice 24-09, issued June 27, 2024, reminded member firms that FINRA’s existing rules are technology-neutral: supervision under Rule 3110, communications with the public under Rule 2210, recordkeeping under Rule 4511, and vendor management obligations apply to generative AI and large language models exactly as they apply to any other technology, whether built in-house or bought from a vendor. FINRA’s Annual Regulatory Oversight Report has carried a dedicated generative AI section in both its 2025 and 2026 editions, alongside a third-party risk section that treats AI vendors as a subset of the same oversight problem.

No regulator is asking a firm to comply with a new AI statute. Both are asking it to show that its existing supervision, disclosure, and recordkeeping program actually reaches the AI systems in production, and the inventory is the evidence that mapping happened.

What examiners actually ask to see

An examination request letter touching AI rarely asks an open-ended question like “describe your AI use.” It asks for specific artifacts, each one scoped by an inventory that has to exist behind it.

The AI use inventory field schema

A list of tool names is not what an examiner is asking for. The inventory needs enough structure to answer the questions above without a follow-up meeting. This is the field schema we build with broker-dealer and RIA compliance teams, and it is the piece most inventories built for internal IT purposes are missing.

Discovery, not documentation, is the hard part of populating this schema. Most firms undercount their AI footprint because tools arrive through individual advisers, marketing staff, or a desk’s own subscription rather than procurement. The channel-by-channel method for finding that shadow AI footprint before an examiner finds it first is covered in Shadow AI Discovery for Finserv: Build a Real AI Inventory.

Where broker-dealer and RIA obligations diverge

The inventory schema is shared, but the rules that pull on each field differ by registration.

A broker-dealer’s inventory work is anchored in FINRA membership. Rule 3110 requires a supervisory system with a named reviewer for every AI system that touches a customer or a customer-facing decision. Rule 2210 requires principal pre-approval for AI-assisted retail communications, so the customer-facing content flag has to route into that approval workflow. Rule 4511 incorporates SEC Rule 17a-4’s books-and-records regime, so the evidence-location field points to that retention schedule. Where the AI system touches customer nonpublic personal information, the firm’s Reg S-P incident response program has to name that system too, a connection covered in Regulation S-P 2024 Amendments for Broker-Dealers and RIAs.

An RIA’s inventory work is anchored in the fiduciary and disclosure regime under the Investment Advisers Act. The disclosure-status field is the one examiners press hardest, because Form ADV Part 2A and client agreements have to describe AI use specifically enough that a client can understand how the tool influences a recommendation, not a general statement that the firm “uses technology to enhance the advisory process.” SEC Rule 204-2 sets the recordkeeping horizon: most records tied to recommendations, advice, and performance must be kept at least five years, the first two easily accessible at the firm’s principal office, and an AI-influenced recommendation is a record like any other under that rule.

A dual registrant carries both regimes, which is why the deployment-type and governing-WSP fields exist as separate entries: a single AI system can be in scope for FINRA supervision on one side of the business and SEC disclosure on the other, and the inventory needs to show both.

Building the inventory before the request letter arrives

1. Find the full AI footprint, including shadow AI. Reconcile procurement records, expense reports, browser and SaaS audits, and a no-blame survey of advisers and reps against what compliance already knows. Most gaps are tools nobody thought to disclose, not tools anyone hid.
2. Populate the field schema for every system found. Assign a supervisory owner and a governing WSP section to each row; an inventory with unowned rows is not ready to show an examiner.
3. Cross-check disclosure language against actual system behavior. Pull Form ADV Part 2A, client agreements, and recent marketing materials for every disclosed AI capability and confirm each inventory entry matches what is claimed. Correct whichever side is wrong: the disclosure or the system’s actual use.
4. Confirm the recordkeeping trail is retrievable, not just retained. A record that technically exists but cannot be produced inside a normal exam window functions the same as a missing record.
5. Set a review cadence and stick to it. A vendor’s model version change, a new sub-processor, or a desk adopting a tool outside procurement all make the inventory stale the moment they happen. Quarterly review is the floor for a firm actively deploying AI in client-facing or decision-influencing roles.

What this guide is / What it is not

What it is: a practitioner orientation for broker-dealer and RIA compliance officers on what an AI use inventory needs to contain, why FINRA and SEC examiners ask for it, and how its fields map to Rule 3110, Rule 2210, Rule 4511, Rule 17a-4, Rule 204-2, and Form ADV disclosure obligations.

What it is not: legal advice, a compliance certification, or a guarantee of any examination outcome. DSE prepares organizations for audit and examination; it does not certify, and it does not guarantee passing an exam. Whether a specific AI system’s disclosure or supervisory treatment satisfies FINRA or SEC expectations is a legal and factual determination for your counsel, not a conclusion in a blog post.

FAQ

What is an AI use inventory and why do examiners ask for it first? An AI use inventory is a system-by-system list of every AI tool a broker-dealer or RIA has in production, tagged with its business function, the customer data it touches, its supervisory owner, and its disclosure status. Examiners ask for it first because every other artifact they request, supervisory procedures, disclosure language, recordkeeping evidence, vendor due diligence, is scoped by what the inventory says exists. A firm without a current inventory cannot answer a follow-up question about a specific system without a delay that itself becomes a finding.

What specifically do SEC examiners look for in a Form ADV AI disclosure? Examiners check whether the disclosure describes AI use specifically enough that a client could understand how the tool influences the advisory process, not a general statement about using technology to enhance service. They compare that language against what the inventory shows the system actually does. A mismatch, where the disclosure overstates or understates the AI’s role, is read as an AI-washing or accuracy problem under the FY2026 examination priorities.

Does FINRA Rule 2210 apply to AI-generated marketing content? Yes. FINRA Regulatory Notice 24-09 makes clear that existing rules are technology-neutral, so content drafted or generated with AI assistance is subject to the same Rule 2210 principal pre-approval and fair-and-balanced standard as content a person writes without AI. A firm’s inventory should flag every system capable of touching customer-facing communications so that flag routes into the existing Rule 2210 review workflow.

How is an RIA’s AI inventory obligation different from a broker-dealer’s? An RIA’s inventory work centers on Form ADV Part 2A disclosure accuracy and the five-year recordkeeping horizon under SEC Rule 204-2. A broker-dealer’s centers on FINRA Rule 3110 supervision, Rule 2210 communications review, and the Rule 4511 and Rule 17a-4 recordkeeping regime, plus Reg S-P where the AI system touches customer nonpublic personal information. A dual registrant needs inventory fields that can carry both sets of obligations for the same system.

How often should the AI use inventory be reviewed and updated? Quarterly is the floor for a firm actively deploying AI in client-facing or decision-influencing roles, and any material change, a new system, a vendor’s model version update, a business unit adopting a tool outside procurement, should trigger an off-cycle update. An inventory that was accurate at onboarding but has not been checked since decays the same way a discovery exercise that never repeats does, and a stale inventory reads to an examiner the same as a missing one.

The Bottom Line

Neither the SEC nor FINRA has written an AI-specific rule for broker-dealers and RIAs. What both have done, in the FY2026 examination priorities and in Regulatory Notice 24-09, is confirm that the disclosure, supervision, and recordkeeping obligations already on the books reach every AI system a firm runs, whether built internally or bought from a vendor. The AI use inventory is not paperwork alongside that obligation; it is the artifact that proves the mapping happened, and the field schema and disclosure cross-check behind each entry are what turn a list of tool names into evidence an examiner accepts.

If your firm has not yet built that inventory, or built one that has gone stale since onboarding, start with the AI Governance Checklist to structure the discovery and field-by-field work, and review the AI governance for RIAs page for the adviser-specific readiness path alongside the broker-dealer engagement referenced above.