The Default Is the Policy
The AI rule financial firms are waiting for is not coming. The obligations are already here.
The most common sentence in financial services AI conversations right now is some version of: “We are waiting to see how the regulation shakes out before we formalize anything.”
It is a reasonable sounding sentence. It has the cadence of prudence. And it rests on a premise that is now demonstrably false: that somewhere ahead is a rule, a date, a starting gun, after which AI governance becomes mandatory and before which it is optional. The record says otherwise. The regulation did not arrive as a rule with an effective date. It arrived as a posture, stated in writing, that the rules firms already operate under never stopped applying. The wait is not prudence. The wait is exposure.
Start with what the SEC actually did, because it is widely misread. On June 12, 2025, the Commission formally withdrew fourteen pending rule proposals, among them the conflicts-of-interest proposal on predictive data analytics, proposed in August 2023 and the closest thing to an AI-specific rule the SEC had in motion. It stated that it does not intend to issue final rules on the withdrawn proposals. In many firms, compliance logged that as relief: the AI rule died, pressure off.
That reading gets the mechanics right and the meaning backwards. A withdrawn proposal means there will be no finalization date, no implementation window, no compliance deadline to plan against. Each of those would have been a future moment when a firm could say “now it begins.” Withdrawal removes the future moment. What remains is the present one: the antifraud provisions, the fiduciary standards, the supervision and books-and-records rules that already reach AI-assisted conduct, with no on-ramp, because they have applied the entire time. The Commission’s AI-washing enforcement, brought under existing antifraud provisions, makes the same point from the other direction: no new rule was needed to charge the conduct.
FINRA, for its part, stopped implying and started itemizing. The arc is worth seeing whole. In June 2020, it published a report on artificial intelligence in the securities industry. In 2024, it issued Regulatory Notice 24-09, reminding members that their regulatory obligations apply when using generative AI and large language models. And in December 2025, its 2026 Annual Regulatory Oversight Report arrived carrying a standalone GenAI section, marked new for this cycle. Each step says the same thing more loudly. That is not a regulator waiting to make up its mind. That is a regulator documenting expectations in ascending detail.
The section’s first move is doctrinal. FINRA states that its rules are “intended to be technologically neutral” and that they “continue to apply when firms use GenAI or similar technologies in the course of their businesses, just as they apply when firms use any other technology or tool.”
Technological neutrality is the quiet death of the regulatory-lag myth. A technology neutral rule cannot lag the technology, by construction. Rule 3110’s requirement of a reasonably designed supervisory system covered the telephone, then email, then chat applications, and covers generative AI now, without a single amendment. The lag firms perceive was never in the rulebook. It was inside the firm: the distance between what employees adopted and what leadership wrote down.
Then the report itemizes. It describes the expected shape of governance: a supervision, governance or model risk management framework with “clear policies and procedures to develop, implement, use and monitor GenAI, while maintaining comprehensive documentation throughout.” And it describes the documentation with unusual specificity: “storing prompt and output logs for accountability and troubleshooting; tracking which model version was used and when; and validation and human-in-the-loop review of model outputs.”
That specificity deserves a pause. Prompt logs. Output logs. Model version histories. Named human checkpoints. None of these is an aspiration. Each is an artifact: a thing a firm can either produce on request or cannot. When an oversight body shifts from describing principles to describing artifacts, it is telling you what the request will look like when it comes.
The same report contains FINRA’s first dedicated guidance on AI agents, systems capable of autonomously performing tasks on a user’s behalf, planning and acting without predefined rules. Read the risk list closely, because none of the entries is about capability. They are about accountability. Agents acting without human validation. Agents acting beyond “the user’s actual or intended scope and authority.” Multi-step agent reasoning that is “difficult to trace or explain, complicating auditability.” And the suggested responses are accountability mechanics: tracking agent actions and decisions, placing human-in-the-loop oversight, establishing guardrails that limit agent behavior. The structure is the message. As autonomy increases, the regulator’s attention moves from what the system can do to who answers for what it did. Statements like that tend to run a year or two ahead of the enforcement that follows them.
Beneath the federal posture, the state layer has begun arriving on statutory schedules rather than discussion schedules. California’s AB 2013 took effect January 1, 2026: developers of generative AI systems made available in the state must publicly post summaries of their training data, with no user threshold. The California AI Transparency Act, SB 942, becomes operative August 2, 2026 following amendment, requiring large providers to label AI-generated content and offer free public detection tools, with civil penalties of five thousand dollars per violation per day. Precision matters here: those statutes aim at AI developers and large platforms, not at broker-dealers or advisers. They are cited not as obligations on financial firms but as evidence of direction and tempo. Transparency obligations now arrive with effective dates attached. Meanwhile, inside most firms, the foundational question, where is AI being used and who owns each use, still has no written answer.
Put the layers together and the popular framing inverts completely. There is no regulatory vacuum. There is a regulatory perimeter, already drawn, around a space most firms have never mapped internally.
Which is why the real policy question is not the one firms keep asking. The question is not “what should our AI policy say when we eventually write one.” Every firm already has an AI policy in force today. If leadership did not author it, the policy is the sum of what employees are actually doing: which tools they signed up for with corporate email, what client information they paste into which windows, which outputs leave the building under the firm’s name unreviewed. That is a real policy. It governs real conduct, every day. It simply has no author, no review, no documentation, and no defense. A default is just governance without a named author.
The first act of replacing the default is not philosophical. It is an inventory. Where AI is used, by whom, for what, approved by whom, owned by whom, by name. You cannot supervise what you have not inventoried. You cannot assign ownership to uses you do not know exist. You cannot log what you have not located. Every control the FINRA report describes presumes the inventory exists, and most firms have not built it, because it feels administrative and because the first draft is always embarrassing. It is also the cheapest control in the stack, and the one all the others stand on.
From there, the discipline is the same one that governs any consequential system, and none of it is exotic. A written policy that states what is permitted, what is prohibited, and for whom. Workflow controls that make the policy operative rather than aspirational. Ownership: a named human answerable for each use. Approval and escalation paths, so new uses and exceptional moments route to people instead of defaults. And monitoring, because usage drifts, and a policy never checked against reality is a document, not a control. None of this waits on a rule. All of it is what the existing rules, by the regulators’ own account, already expect.
The firms reading this moment correctly are not the ones waiting. They are the ones who noticed that the waiting period was cancelled, quietly and in writing, and that the question, when it comes, will be answered with an artifact or an absence. The firms running on defaults are not ungoverned. They are governed by policies no one wrote, and they will be examined on them all the same.
The default is the policy. The exam assumes you are the author. Become one before the assumption gets tested.
The Evolving Mindset publishes weekly on AI governance and organizational accountability. If your organization could not produce its AI inventory, its named owners, or its logs on request, that gap is the work. Reach out through the link in the profile.
Sources and notes
SEC: formal withdrawal of fourteen notices of proposed rulemaking, June 12, 2025, including Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers (File No. S7-12-23, proposed August 2023). The Commission stated it does not intend to issue final rules with respect to the withdrawn proposals. AI-washing enforcement actions referenced were brought under existing antifraud provisions; cited as posture, not individual case analysis.
FINRA: 2026 Annual Regulatory Oversight Report, published December 2025; GenAI section marked “NEW FOR 2026.” Quoted language verified against the report page on finra.org: “intended to be technologically neutral”; “continue to apply when firms use GenAI or similar technologies in the course of their businesses, just as they apply when firms use any other technology or tool”; “clear policies and procedures to develop, implement, use and monitor GenAI, while maintaining comprehensive documentation throughout”; “storing prompt and output logs for accountability and troubleshooting; tracking which model version was used and when; and validation and human-in-the-loop review of model outputs”; AI agents risks including action beyond “the user’s actual or intended scope and authority” and reasoning “difficult to trace or explain, complicating auditability.” Escalation arc: Artificial Intelligence in the Securities Industry report (June 2020); Regulatory Notice 24-09 (2024); 2026 report (December 2025). Top member-firm GenAI use case per FINRA: summarization and information extraction.
California: AB 2013 (generative AI training data transparency), effective January 1, 2026; applies to developers of generative AI systems made available in California, without a user threshold. SB 942 (California AI Transparency Act), operative August 2, 2026, as amended by AB 853 (signed October 13, 2025); requires covered providers (over one million monthly users) to label AI-generated content and provide a free public detection tool; civil penalties of $5,000 per violation per day. Both statutes target developers and large providers rather than financial firms and are cited as direction and tempo of the state layer only.
Nothing in this piece constitutes legal advice. Firms should consult qualified counsel on their specific regulatory obligations.