Executive Summary
- What’s new: Financial firms’ increasing deployment of LLMs and other AI tools that can access and analyze nonpublic information at scale raises questions of how existing insider trading and MNPI-handling rules apply.
- Why it matters: Broker-dealers and investment advisers must maintain policies reasonably designed to prevent misuse of MNPI, and firms risk scrutiny if AI tools foreseeably could use restricted data improperly, even absent actual trades.
- What to do next: Firms should consider inventorying data restrictions, segregating and permissioning AI access to nonpublic information, using explainability and audit trails, and asking key governance questions before granting AI tools such access.
__________
The U.S. Securities and Exchange Commission (SEC) has long treated the protection of material nonpublic information (MNPI) as central to market integrity. Broker-dealers and investment advisers must maintain policies and procedures reasonably designed to prevent the misuse of MNPI, even when no one ultimately trades on that information. For financial firms adopting large language models (LLMs) and other AI tools, those obligations raise a practical question: How should firms control AI tool access to nonpublic information to mitigate the risk of a trading, surveillance or enforcement problem?
Financial firms can now use LLMs to analyze data sets that exceed the practical limits of human review. The obvious rule is that a firm should not give a model MNPI about an issuer whose securities the model may trade or contribute through research or otherwise to the decision to trade. The harder questions involve less obvious categories of information, such as nonpublic information about private companies received under an NDA or alternative data available only to paying customers. No reported case has yet addressed insider trading by or through an AI model, but the existing securities law framework raises several considerations. The better way to frame the issue is not whether a machine can commit insider trading in the abstract, but whether people and firms have designed AI systems that foreseeably allow MNPI to influence trading or recommendations.
How Existing Insider Trading Principles Apply to AI Tools
AI-related trading can create regulatory risks relating to insider trading even though the model itself is not a traditional market participant. At a high level, insider trading under the federal securities laws requires (i) a purchase or sale of securities, (ii) on the basis of (iii) MNPI, (iv) in breach of a fiduciary duty or similar duty of trust or confidence, and (v) with the requisite scienter.1
Each of these elements matters in the AI context. The decision to continue holding securities, even if informed by MNPI, generally is not enough; there must be a purchase or sale. The “on the basis of” element also matters because courts have taken different approaches: Some require proof that the trader used the MNPI, while others treat knowing possession at the time of the trade as sufficient.2 The SEC’s Rule 10b5-1 reflects the agency’s preference for the more lenient knowing possession standard.3 And in either formulation, the information must be material — important to the total mix of information available to investors — and nonpublic, meaning it has not been broadly disseminated.
The duty element is what distinguishes insider trading from legitimate trading based on informational advantages. Insiders owe duties to shareholders not to trade on company information, and the misappropriation theory of insider trading prohibits trading on the basis of information obtained under a duty or obligation of confidentiality. It also can reach tippees who receive that information from someone subject to the duty. In the Second Circuit, a tipper need not know the precise legal character of the breach but must understand that disclosing the information would violate a confidence.4
Applying that framework to trading involving an AI model, a firm may face regulatory risk where employees design, permission, deploy or supervise a model in circumstances where they know — or consciously avoid knowing — that it can use MNPI in breach of a duty. This framework does not require that the SEC somehow seek to ascribe scienter — manipulative or deceptive intent — to the model. While a firm does not automatically inherit every fact known by every employee, the knowledge and conduct of employees acting within the scope of their responsibilities — particularly personnel involved in data ingestion, model development, compliance approval, portfolio management, trading or surveillance — may under some circumstances be attributed to the firm. For example, the SEC might argue that an employee who knowingly gives a trading model access to MNPI subject to a confidentiality obligation may possess the knowledge relevant to the firm’s risk analysis.
Under these principles, the SEC might seek to establish scienter not by asking whether the model “knows” the information is confidential, but by focusing on the humans and governance processes around the model: How were data sources reviewed and approved, did anyone know that they included MNPI, how were use restrictions and permissions set up and monitored, and did a human-in-the loop review the model’s outputs?
Where the ‘Mosaic Theory’ May Leave Room for Nonpublic Data
The mosaic theory remains important for AI-enabled research and trading. Analysts have long combined many pieces of information, i.e., a “mosaic” — such as public information, immaterial nonpublic information and industry data — to assess the value of securities. For example, credit-card spending data, app-usage data, satellite imagery and other alternative data can provide insights into consumer behavior that may not be apparent from any single source. LLMs can amplify that process by identifying patterns across large and disparate data sets. Nonpublic information may appropriately be part of that analysis if it is not material and is not subject to a use restriction that would make trading improper.
While incorporating nonpublic information can offer an edge, its use carries regulatory risks because reasonable minds can disagree on what is material, and the mosaic may be a problem if a single piece of information is both nonpublic and material.
Regulatory Risk Beyond Insider Trading
In the SEC’s toolkit are provisions requiring that broker-dealers and investment advisers establish, maintain and enforce policies and procedures reasonably designed to prevent the misuse of MNPI.5 The SEC has brought cases where information barriers were not properly established, documented or respected. These provisions can come into play even when the SEC does not allege actual insider trading: If a trading desk, investment team or AI tool has access to MNPI in circumstances where the SEC believes misuse was foreseeable, the firm may face scrutiny over whether its controls were reasonable.
That distinction is important for AI systems. Instructing a model not to trade in the securities of an issuer after it receives MNPI from that issuer can be an important control, but there may be circumstances where additional controls make sense. An NDA may prohibit using deal information to obtain any financial benefit, and similar restrictions may appear in vendor terms, alternative-data licenses, portfolio-company agreements or joint-venture documents. Firms should not assume that risk is limited to trading in the issuer that supplied the information. While some might say that the current SEC may be less interested in novel theories like “shadow trading”, which involves using MNPI about company A to profit from trading in company B’s stock (where B’s stock price correlates to A’s), it’s not clear the agency’s interest has waned in enforcing regulatory provisions concerning MNPI policies and procedures that do not turn on the actual misuse of MNPI.
The standard for these provisions is reasonableness, which is a legal standard informed by prevalent industry standards adopted by market participants.6 Because those industry standards are still coalescing, there is no agreed-upon roadmap or checklist for what firms must and must not do. For firms thinking through this issue, below are some considerations.
Practical Controls for AI Access to MNPI
Controls Beyond Model Instructions
Written instructions and prompts are useful, but depending on the facts and circumstances, firms may want to consider additional controls. In a 2023 U.K. study, an AI bot reportedly disregarded instructions not to trade on certain information because the perceived risk of inaction outweighed the insider trading risk (and, when questioned, the bot denied doing so).7 Even if newer models are less likely to behave that way, financial firms may want to consider the risk of cross-deal contamination, which can arise when AI agents ingest data from multiple active matters into a shared knowledge base, allowing the model to infer relationships or retrieve confidential insights across workspaces.
Data Segregation and Permissions
Firms might consider extending traditional information-barrier concepts to AI architecture. That may include:
- segregating data by deal team, strategy, issuer, account or contractual restriction;
- limiting which models and users can access restricted data;
- encrypting restricted data separately; and
- maintaining approval workflows before a model can use sensitive information for research, recommendations or trading.
Cloud and other infrastructure tools may help support those controls, but the legal question is whether the firm can show that access to MNPI was limited, monitored, and aligned with the firm’s confidentiality and trading obligations.
Firms should further consider which employees have access to internal models and whether any problems can arise through their potential access to data ingested by those models. For example, AI models may be properly designed to respect information barriers between investment banking and equity research, but steps should also be taken to ensure that employees on one side of the wall cannot access an AI model on the other side.
Explainability, Audit Trails and Human Review
Another way to help ensure limiting instructions are followed is through “Explainable AI,” which refers to a set of techniques that give professionals a way to understand, trust and manage AI-generated decisions.8 That record can be useful for compliance review, supervisory escalation and, where necessary, demonstrating that a trade was not informed by restricted information. Explainability may not be a cure-all, especially in jurisdictions or circumstances where knowing possession is enough, but it can help a firm show that its AI governance was designed to prevent and detect improper use.
Contractual Restrictions, Data Provenance and Staleness
One of the most important safeguards is a disciplined inventory of the duties and restrictions attached to nonpublic information. Vendor agreements, alternative-data terms, NDAs, portfolio-company agreements and joint-venture agreements may impose confidentiality or use restrictions that could affect whether particular data can be used in AI-assisted research or trading. Firms should track the source of each restricted data set, the scope of any use restriction, the securities or strategies affected, the personnel and systems permitted to access it, and the date the information was received. Data provenance also matters because stale information is less likely to remain material, while recent information may warrant heightened approvals, access limits and surveillance.
Questions Firms Can Consider Asking Now
Before allowing AI tools to access nonpublic information, firms may want to consider several practical questions:
- What nonpublic data sources can the tool access?
- Which contractual or fiduciary restrictions apply to those sources?
- Can the tool use restricted information to inform or generate trading ideas, recommendations or portfolio decisions?
- Are deal-specific, issuer-specific or strategy-specific barriers reflected in the model’s permissions?
- Are outputs logged in a way that compliance personnel can review?
- Can surveillance detect when AI-informed trading occurs in securities connected to restricted information?
Conclusion
Policies-and-procedures rules requiring broker-dealer and investment adviser to properly handle MNPI may pose more direct risk to firms than rules giving rise to a traditional insider trading claim because they focus on reasonable controls and foreseeable misuse, not only on completed trades. That reasonableness standard can also work in favor of firms. Reasonableness does not mean perfection or strict liability for every control failure. It asks whether the firm designed, implemented, tested and enforced controls that were appropriate for its business, technology, data sources and trading activity. Thoughtfully designed controls — supported by training, permissions, approvals, testing, documentation and surveillance — may help demonstrate reasonableness even if an incident later raises questions.
While the timing of AI-specific regulatory or enforcement developments is uncertain, anticipating the applicability of existing MNPI obligations can be done now. Firms that develop, test, deploy or surveil AI models should treat MNPI governance as part of the model lifecycle. The firms best positioned to avoid being caught flat-footed will be those that can explain what data their models can access, why access is permitted, how use restrictions are enforced, and how the firm detects and escalates potential misuse. They also will be better positioned to avoid costly technological redesigns in the wake of regulatory guidance.
_______________
1 Not all circuit courts are aligned on how each requirement for insider trading may be satisfied, and this article does not address every difference among them. It also does not discuss requirements not directly relevant to the analysis, such as the requirement that a tipper receive a personal benefit.
2 See, e.g., United States v. Teicher, 987 F.2d 112 (2d Cir. 1993) (knowing possession standard) and United States v. Smith, 155 F.3d 1051 (9th Cir. 1998) (use standard).
3 See 17 C.F.R. § 240.10b5-1(b) (“[A] purchase or sale of a security of an issuer is ‘on the basis of’ material nonpublic information about that security or issuer if the person making the purchase or sale was aware of the material nonpublic information when the person made the purchase or sale.”).
4 See SEC v. Obus, 693 F.3d 276, 286 (2d Cir. 2012).
5 See Securities Exchange Act of 1934 Section 15(g) and Investment Advisers Act of 1940 Section 204A.
6 See SEC v. Ginder, 752 F.3d 569, 574–75 (2d Cir. 2014).
7 Philippa Wain and Imram Rahman-Jones, “AI Bot Capable of Insider Trading and Lying, Say Researchers,” BBC (Nov. 2, 2023).
8 Kelly Bailey, “Why Explainable AI Is Critical for Financial Decisionmaking,” Corporate Finance Institute (Mar. 18, 2025). This article discusses several techniques that can make AI decisions more open and interpretable.