That Excel Macro Might Be an AI Agent Now Under FINRA's 2026 Taxonomy
There is a particular kind of automation that quietly runs a firm: the macro or script someone built years ago that pulls data, applies a rule, and routes a result without anyone watching it work. It processes hundreds of items a day, it is profitable, and it has never been thought of as anything more than plumbing. FINRA's [2026 Annual Regulatory Oversight Report](https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai), released in December 2025, may have quietly reclassified it.
The report does something new: it treats AI agents, systems capable of autonomously performing and completing multi-step tasks on a user's behalf, as a distinct supervisory risk category. The line it draws is sharp and it is not about how modern your code is. Generative AI outputs content; an agent outputs action. The moment a system takes steps rather than merely drafting text, FINRA's view is that your supervisory, books-and-records and governance obligations shift materially. A long-running automation that queries systems, evaluates against criteria and initiates a downstream trigger can meet that definition regardless of whether a large language model is anywhere near it.
That reframing has teeth for anyone under FINRA's remit. Legal analysts have flagged that [the same obligations now apply](https://www.swlaw.com/publication/finras-2026-oversight-report-signals-a-supervisory-reckoning-for-autonomous-ai/) that govern a human performing the equivalent function: supervision under Rules 3110 and 3120, and recordkeeping under Rule 4511 and Exchange Act Rule 17a-4, which means you must be able to reconstruct the full chain of what the system did and why. If your automation's logs are incomplete, or its human-oversight design exists but was never documented the way examiners expect, that is now a gap rather than a nicety. Examiners are already asking about agent governance in this year's exam cycle, with enforcement expected to follow into 2027.
None of this means ripping out the automation. It means inventorying what you run, documenting where a human validates each consequential step, limiting each system to a clearly defined scope, and keeping an auditable record of the process, not just the output.
At Cell Fusion Solutions Inc we help firms catalogue their existing automations, decide which now read as agents, and build the oversight and logging trail before an examiner asks for it. The macro did not change. The rulebook around it did.
