The most useful thing I’ve learned building AI inside a regulated firm is that the regulatory conversation goes best when you start it, before launch, before filing, before anyone asks.
The preview-first pattern.
For each significant AI feature we’ve built, I’ve briefed our regulators proactively before launch: the pipeline architecture, the codified rule set, the verification framework, and the authorities it was built against, down to production system prompts, model identifiers, and vocabulary rules reproduced verbatim. We make a point of encouraging the regulator’s internal AI specialists to join these demos and previews, and they typically do. The goal is simple: nothing about our approach should surprise an examiner when the feature later shows up in routine examination.
What those briefings look like.
Two documents I’ve authored show the pattern in practice.
- AI Chips: a regulator preview briefing. Before launching AI-assembled text blocks on the app’s portfolio detail pages, I prepared a full architecture-and-controls briefing for our regulator’s risk team. It walks through the deterministic pipeline end to end: eligibility gates, verified-data retrieval where no free-text user input ever reaches the model, version-controlled prompts with an approved-vocabulary dictionary and a prohibited-connective list, a rule-based post-generation filter with a deterministic model-free fallback, offline compliance scoring of every output, and the supervisory program around it all, with the production system prompts reproduced verbatim in the appendices. The design premise: the user, not the firm, draws every conclusion.
- The Arlo Compliance Layer. A technical whitepaper on how an AI investing advisor keeps suitability, disclosures, supervision, and the record of advice under control. The core idea: treat the language model as one bounded, replaceable component inside a deterministic pipeline, so the model can vary how something is phrased but cannot vary the underlying claim, invent a fact, or skip a disclosure. Around it sit core compliance invariants with firm-configurable overlays, bounded and fully traced sub-agent orchestration, and an immutable system of record that can reconstruct any answer after the fact.
Definitional rigor is what makes these documents work: whether an AI output is a “recommendation,” whether individualized output at scale is correspondence or a retail communication, where the advisory perimeter sits for a technology layer. Getting these classifications right, in writing, before launch is what lets a compliant product ship at all.
I currently serve on a FINRA regional committee and speak regularly with peers, clearing partners, and industry groups about AI supervision architecture.