AI Decision Support and the Advice Line

The question every brokerage compliance team, prop-firm operator, and regulator eventually asks about AI chart analysis — is this investment advice? — has a more stable answer than the industry assumes. Across the Investment Advisers Act, Regulation Best Interest, the Commodity Exchange Act, MiFID II, and the UK and Australian regimes, the operative trigger is not the sophistication of the analysis, the confidence of the output, or the presence of an entry, stop, and target. It is whether the output is tailored to, or presented as suitable for, a particular person. The U.S. Supreme Court drew the boundary for publishers in Lowe v. SEC in 1985;¹ the Second and Fifth Circuits applied it to trading software in 2000, holding that system vendors fall within the commodity trading advisor definition while locating the constitutional and registration pressure points at personalization and mechanical execution;^2,3 MiFID II codifies the same split as the five-element “personal recommendation” test;^4,5 and the 2024–2026 wave of AI guidance from the SEC, FINRA, CFTC, ESMA, FCA, and IOSCO is unanimous that existing, technology-neutral frameworks govern — no regulator has moved the line for AI.^{6,7,8,9,10,11}

That stability is the strategic fact of this paper. It means the perimeter question for AI decision support is an engineering problem with a known specification, not a legal fog. Four conclusions follow.

1.1Impersonal AI analysis sits outside the advice perimeter in the US and EU — by design, not by disclaimer.

Output that is a pure function of the instrument and market state — identical for every user who asks about the same chart at the same moment — is the modern descendant of the market newsletter and the screening terminal: within the publisher tradition under the Advisers Act, outside the “personal recommendation” definition under MiFID II, and eligible for the self-executing CTA registration exemption in Reg 4.14(a)(9) for futures and FX.^1,4,12 This paper names the design rule person-invariance (§3, §11.1) and treats it as the load-bearing wall of the product. Disclaimers do not create this status; architecture does. Regulators in every surveyed jurisdiction apply substance over form (§3.4).

1.2The binding constraint on embedded deployment is the broker’s rulebook — so the vendor’s weapon is exportable compliance evidence.

When AI analysis is distributed inside a regulated broker, the hard obligations attach to the broker: Reg BI if a communication becomes a “recommendation,” FINRA 2210’s content standards (which FINRA has confirmed apply to chatbot and AI-generated communications), Rule 2214’s tool-disclosure regime, Rule 3110 supervision extended in FINRA’s 2026 report to prompt/output logging and human checkpoints for agentic systems — and, in the EU, the full MiFID II conduct stack, which ESMA’s May 2024 statement holds firms responsible for even when the AI is third-party.^7,9,13,14,15 The vendor that ships the broker’s compliance case — methodology documentation, output logs, supervision dashboards, 2210/2214-ready disclosure blocks, recordkeeping exports, DORA-ready contract terms — wins procurement against incumbents that ship a disclaimer (§10, §11.5).

1.3Auto-execution is the categorical boundary in every jurisdiction.

The moment signals execute without a human decision per trade, content becomes conduct: portfolio management under ESMA’s 2012 guidance and 2023 copy-trading briefing in the EU;^16,17 account direction that voids the CTA exemption in U.S. futures;¹² and, per Vartuli, output “to be followed mechanically” loses even the speech-protection arguments available to publishers.³ An autonomy roadmap is therefore a licensing roadmap — the broker’s license or the vendor’s — and must be priced and sequenced as one (§11.7).

1.4Enforcement risk in 2024–2026 concentrated on AI marketing claims, not AI analysis.

The SEC’s first AI enforcement actions — Delphia and Global Predictions, March 2024 — were “AI-washing” cases about false capability claims, not about AI advice itself;¹⁸ the CFTC and FTC actions in the same window targeted fictitious AI-bot returns.^8,19,20 The SEC then withdrew the one rule proposal aimed squarely at predictive analytics (June 2025) and pivoted to an internal AI Task Force posture.^6,21 The exposure a legitimate vendor must engineer against is therefore claims substantiation — which is precisely what ORIN Labs’ WP-01 benchmark program exists to provide (§11.4).

2.1Subject system

The analysis models an AI decision-support system with the ORIN feature set as the reference case: multimodal chart reading; pattern, level, and structure identification; setup scoring; proposed entry/stop/target levels; natural-language Q&A about user-selected instruments; alerting; and distribution both direct-to-trader and embedded in broker and prop-firm platforms via API/widget. Asset classes span exchange-listed equities and ETFs (securities regimes), and futures, options on futures, and retail FX/CFDs (derivatives regimes). Auto-execution is analyzed as a roadmap boundary, not a current feature.

2.2Jurisdictions and instruments in scope

2.3Method

Doctrinal analysis of primary sources — statutes, regulations, adopted rules, case law, and official guidance — supplemented by the enforcement record and by regulator publications through August 2026. Each 2024–2026 development cited (SEC PDA withdrawal and AI Task Force; FINRA 2026 Regulatory Oversight Report; CFTC December 2024 staff advisory; ESMA May 2024 statement; EU Digital Omnibus adoption; FCA March 2026 perimeter report and July 2026 Mills Review; IOSCO 2025–26 program) was verified against the issuing body’s own publication or contemporaneous professional reporting during the August 2026 review. Secondary commentary is used only for characterization, never as the source of a legal proposition. Where the law has not been tested against AI-specific facts, the paper says so explicitly in open question blocks rather than asserting comfort.

2.4Limitations

Three, stated plainly. First, this is research, not legal advice, and no attorney–client relationship arises from it; a firm should obtain its own counsel’s review before relying on any of it operationally. Second, perimeter questions are facts-and-circumstances determinations; this paper maps the doctrine and the design levers, but a specific deployment can always present a fact pattern that moves it across a line. Third, the AI-specific layer is moving — the UK is openly reconsidering its perimeter, the EU adjusted its AI Act timeline in June 2026 — so the map carries an as-of date (August 2026) and a commitment to versioned updates.

3.1The bands

Two lines separate the bands. The signal line (A→B) matters mainly in the strict-outlier jurisdictions (§9.2–9.3) and for MAR’s disclosure duties. The advice line (B→C) is the one that changes a product’s legal nature in the US and EU — and it is crossed by personalization, in any of three recurring forms the case law and rules identify: (i) tailoring — output computed from the person’s circumstances, holdings, or objectives; (ii) presented suitability — output framed as appropriate for that person; (iii) targeted delivery — person-specific selection or push of otherwise generic content, the “call to action” factor in the U.S. recommendation analysis.^5,15

3.2The design rule: person-invariance

Restated as an engineering specification: output must be a pure function of (instrument, timeframe, market state, published methodology) — never of (user identity, holdings, balance, risk profile, or behavior). If two strangers ask the system about the same chart at the same moment, they must receive the same analysis. This single invariant keeps the product in Band B across the US and EU perimeters simultaneously, because it negates all three personalization forms at the architecture level rather than the policy level. Section 11 develops the corollaries: what the invariant permits (user-initiated queries on user-chosen symbols; user-configured watchlist alerts, §11.1), what it forbids (holdings-aware ranking, profile-conditioned phrasing), and how to prove it (versioned model/prompt configs; invariance test suites in the audit log).

3.3Interactivity is the genuinely novel question — and it is narrower than it looks

The doctrinal categories were built for newsletters, terminals, and software; an AI that converses feels different. The honest analysis is that interactivity changes the risk only through the three personalization channels above. A conversational interface that answers instrument-level questions with person-invariant analysis is a faster terminal. The same interface becomes an adviser the moment it ingests “I hold 500 shares at 42, should I sell?” and answers that question. The regulators circling this exact seam in 2026 — the FCA’s perimeter report on general-purpose AI advice tools and the Mills Review’s warning that “personalised recommendations or continuous adaptive prompts” can cross into regulated advice — frame it the same way.^10,22 The product answer is refusal-and-reframe behavior at the conversation layer (§11.2): the system declines the personal question as asked and returns the impersonal analysis it is built to give.

3.4Why disclaimers don’t move the line

Every regime surveyed applies substance over form. A label cannot convert Band C conduct into Band B: U.S. law looks at what was actually communicated and how it was targeted, not the footer;^15,23 the district court in the Vartuli litigation found personalized advice partly from the “specificity and immediacy” of software-generated trade instructions notwithstanding the vendor’s framing;³ ESMA’s copy-trading briefing classifies services by what the firm actually does with signals, not what it calls them;¹⁷ and Australia’s statute expressly captures statements “reasonably regarded as intended to influence.”²⁴ Disclaimers still matter — they are evidence of how a reasonable recipient would understand the communication, they are required furniture in several regimes (§5.3, §6.4), and their absence is indefensible. But in this paper’s architecture they are the last control, not the first. The first is §3.2.

4.1Where ORIN-class output lands

A subscription platform that analyzes stock charts plainly satisfies the definition’s three prongs (securities analysis; regular business; compensation), so status turns on the exclusion — exactly as it did for the newsletter industry that has operated under Lowe for four decades. The load-bearing features are the Lowe factors themselves: disinterested (the platform does not trade against users, take payment for coverage, or route order flow); general circulation (the same analysis engine, offered to all subscribers on the same terms); impersonal (the §3.2 invariant). On-demand delivery deserves precision: Lowe’s “timed to specific market activity” concern addressed person-specific timing — a promoter releasing tips to move a position — not responsiveness to markets as such; financial publishing has always reacted to the tape. What the doctrine cannot be stretched to cover is output computed from the person. That is the line, and it is architectural.

4.2The interactive-tool question

4.3If registered anyway: the two rules that bite

Registration is not ruin; it is a different operating mode with two consequential rule-sets. The Marketing Rule (206(4)-1) conditions any use of hypothetical performance — which includes backtested pattern statistics presented promotionally — on policies ensuring relevance to the intended audience and disclosure of criteria and assumptions.²⁷ And the fiduciary duty attaches to the advisory relationship as a whole. Separately, the internet adviser exemption (Rule 203A-2(e), tightened in 2024 to firms advising exclusively through an operational interactive website) resolves only where to register (SEC vs. states), not whether — a common founder confusion worth killing here.²⁸

4.4The 2024–2026 SEC record: claims, not capability

Three data points define the Commission’s current posture toward AI in the advice stack, and all three concern representations rather than the technology. (i) Enforcement: the first AI cases, March 18, 2024, charged Delphia (USA) Inc. and Global Predictions, Inc. under Advisers Act §§206(2) and 206(4) — including the Marketing Rule — for claiming AI capabilities they could not substantiate; $225,000 and $175,000 penalties, censures, cease-and-desist.¹⁸ The SEC’s Cyber and Emerging Technologies Unit (announced February 2025) now houses AI-related fraud.⁶ (ii) Rulemaking: the July 2023 “predictive data analytics” conflicts proposal — the one rule that would have imposed AI-specific eliminate-or-neutralize duties on broker-dealers and advisers — was formally withdrawn on June 12, 2025 with thirteen other proposals; any future effort must restart from scratch.²¹ (iii) Posture: the Commission stood up an internal AI Task Force under a Chief AI Officer (August 1, 2025) and, in Chairman Atkins’s March 2026 FSOC remarks, framed AI oversight through existing frameworks, disclosure accuracy, and the agency’s own tooling — explicitly not through new AI conduct rules.⁶

5.1The embedded-widget analysis

Apply the 01-23 factors to the three ways brokers actually deploy chart intelligence. (a) Client-pull: the customer opens a symbol and requests analysis; output is person-invariant. This is the electronic-library/screener pattern the guidance treats as non-recommendation — the customer selected the security; the firm supplied analysis of it. (b) Broadcast alerts: the same setup alert to every subscriber of a user-configured watchlist remains customer-driven selection. (c) Firm-push targeting: the broker (or the tool on its behalf) selects setups for a customer — from holdings, behavior, or profile — and pushes them. That is targeted, security-specific, call-to-action content: the recommendation analysis bites, and with it Reg BI’s care obligation, which the broker cannot meet for a stream of machine-generated trade ideas it has not evaluated per-customer. Mode (c) is therefore not a feature request to accommodate; it is one to refuse, or to gate behind the broker’s own advisory program.

5.22214’s lesson even where it doesn’t squarely apply

Pattern analytics are not literally outcome-probability simulations, so 2214 may not formally capture every ORIN surface — but it is the SEC-approved template for how a member firm makes an interactive analytical tool compliant, and 2210(d)(1) expressly carves 2214-conforming tools out of the projection prohibition.^7,29 The commercial move is to ship the 2214 stack by default: a methodology-and-limitations disclosure block rendered in the widget; the results-may-vary and hypothetical legends; a selectivity statement (ORIN’s engine favors no instrument and takes no issuer or order-flow revenue — a disclosure incumbents entangled with broker economics cannot make as cleanly); and template files the broker can hand to FINRA’s Advertising Regulation department on day one.

5.3What the broker’s examiners will ask for — and the vendor should have pre-built

• Communications compliance: 2210-reviewed language templates for every output class; no predictions of performance outside the permitted exceptions; balanced risk statements adjacent to every setup.
• Supervision artifacts: per-output logs (input chart, model/prompt version, output, timestamp), exportable to the firm’s books and records under SEA 17a-4 — FINRA’s 2026 report makes output-logging an expected control, and the vendor that provides it natively removes the deployment’s hardest internal objection.¹⁴
• Model governance file: methodology description, validation and benchmark results (WP-01), change log, known failure modes — the third-party-risk documentation FINRA’s report expects firms to obtain from vendors.¹⁴
• Configuration proof: attestation plus test evidence that holdings-aware targeting (mode (c)) is disabled — the person-invariance suite of §11.1 doubles as the exam exhibit.

6.1Reading the cases as a product specification

The 2000 software cases are the closest thing U.S. law has to an AI-signals precedent, and they resolve three things a founder needs settled. First, labels are irrelevant to CTA status: selling analysis of futures markets for money is the definition; ORIN in futures/FX is a CTA in the statutory sense, full stop — the operative question is only the 4.14(a)(9) exemption.^2,12 Second, the exemption is exactly the person-invariance rule: its two conditions — no account direction, no tailoring to particular clients’ positions or circumstances — are §3.2 written by the CFTC in 1987. Third, mechanical obedience is a separate cliff: Vartuli turned on a system marketed to be obeyed without judgment. Product language that says “just follow the signals” walks toward that holding; language and UX that force a human decision per trade — ORIN’s decision-support frame, with explicit approve/reject — walk away from it.³

6.2The NFA/promotional layer for broker distribution

Futures and forex intermediaries distributing ORIN output are NFA members, and NFA Compliance Rules 2-29 (and 2-36 for forex dealer members) govern their promotional material: no deceptive or misleading claims, balanced presentation of profit potential and risk, prescribed treatment of hypothetical performance with the mandated disclaimer — which is precisely the category that backtested pattern statistics fall into when used promotionally. CFTC Reg 4.41 imposes the parallel advertising rules on CTAs themselves, exempt or not.¹² The vendor deliverable mirrors §5.3: pre-cleared claim language, the hypothetical legend wired into every backtest surface, and a substantiation file per claim.

6.3The 2024–2026 CFTC record

The Commission’s AI posture matches the SEC’s: technology-neutral application of existing law, with enforcement aimed at fraudulent AI claims. The January 2024 request for comment and customer advisory (warning that “AI won’t turn trading bots into money machines”) were followed by the December 5, 2024 inter-divisional staff advisory to registrants: no new obligations, but an expectation that regulated entities assess AI risks and update policies, procedures, and controls under the existing CEA framework — and continued monitoring through routine oversight.^8,19 Enforcement against fake AI-bot return schemes has been steady in parallel, and the FTC’s Operation AI Comply (September 2024) extends the same claims-substantiation pressure to non-registrant marketing — the regime that governs sales to unregulated prop firms.²⁰

6.4Prop firms: light perimeter, full marketing law

Most CFD/futures evaluation businesses sit outside intermediary regulation because participants trade simulated or proprietary capital — which is why the niche’s data is so conflicted (WP-06). For ORIN this means the advice perimeter is largely quiet inside an eval environment, but three obligations remain fully live: truthful marketing (FTC Act §5 substantiation for any AI-performance claim);²⁰ the hypothetical-performance discipline of §6.2 wherever futures-style results are shown; and contractual clarity that ORIN output is analytics, not a pass-guarantee — because the epidemic failure mode in that market is outcome-promising, and the neutral-vendor position is the entire ORIN Labs brand.

7.1MiFID II: what “investment advice” actually requires

Two drafting consequences deserve emphasis. Element (3)’s presented-as-suitable limb means phrasing alone can cross the line: “a setup that fits you” converts generic content into advice even with no data about the user. And element (4) means channel design matters: one-to-one delivery of instrument-specific opinions invites the inference that (3) is satisfied. The green-language taxonomy of §11.3 encodes both.

7.2The nearest precedent: signals and copy trading

EU regulators have already classified the adjacent product category. ESMA’s 2012 Q&A (Question 9) established that automatic execution of trade signals with no client intervention constitutes portfolio management — a licensed activity; and its March 30, 2023 supervisory briefing on copy trading (ESMA35-42-1428) builds the full classification: qualification depends on who exercises investment discretion, with client-confirmed signal-following potentially amounting to investment advice (if personal) or reception/transmission, and with firm-level expectations on marketing, product governance, suitability/appropriateness, remuneration, and the qualification of signal providers. ESMA has since applied the same logic mutatis mutandis under MiCA.^16,17 The read-across for AI is direct: analysis → user decides keeps ORIN in content; analysis → system executes is portfolio management and belongs to whoever holds the license.

7.3MAR: the recommendation regime that plausibly reaches ORIN — and that ORIN should embrace

The Market Abuse Regulation operates on content producers directly, licensed or not. Art. 3(1)(35) defines an investment recommendation as information recommending or suggesting an investment strategy concerning one or several financial instruments or issuers, intended for distribution channels or the public; Art. 3(1)(34) extends the producing-persons category beyond firms to “experts” — persons who repeatedly propose investment decisions and present themselves as having financial expertise. Art. 20(1) requires objective presentation and conflict disclosure, and Delegated Regulation (EU) 2016/958 specifies the machinery: producer identity; separation of fact from interpretation; reliable, indicated sources; disclosed valuation methodology and its assumptions; the meaning of the recommendation (direction, horizon, risk); date and time of prices; and — for firms and experts — a list of all recommendations disseminated in the preceding twelve months, plus proportion-of-directions summaries and conflict statements.³⁰

Whether a mass-distributed AI system issuing directional setups on MAR-scope instruments is a 2016/958 “producer” has not been addressed by ESMA or any NCA — the question simply predates the product category. But the elements are uncomfortably easy to satisfy: repeated, strategy-suggesting, instrument-specific, publicly distributed, expert-branded. Incumbent chart-signal vendors distribute exactly this content across the EU with none of the 2016/958 apparatus.

7.4The distributing firm’s duties: ESMA’s May 2024 statement

For the embedded scenario, ESMA’s public statement of May 30, 2024 on AI in retail investment services is the controlling supervisory expectation: MiFID II obligations are technology-neutral; the firm’s responsibility is undiminished when the AI is a third-party tool — explicitly including tools used without formal adoption; management bodies own the decisions; acting in the client’s best interest, organisational requirements, conduct of business, record-keeping, and — where AI feeds advice or portfolio management — suitability all apply to the AI-assisted process.⁹ The commercial translation is identical to §5.3: the EU broker can only discharge these duties if its vendor supplies the governance file, the output logs, the QA/monitoring surface, and the training material. ESMA wrote ORIN’s enterprise feature list.

7.5DORA: the procurement layer

Since January 17, 2025, the Digital Operational Resilience Act makes ORIN, as an ICT third-party service provider to EU financial entities, part of each broker client’s regulated third-party risk framework: contractual minimums under Art. 30 (service descriptions and SLAs, data locations, access/audit and cooperation rights, incident assistance, exit and termination provisions), inclusion in the firm’s register of information, and visibility into material subcontracting — which for ORIN means the upstream model APIs.³¹ A DORA-ready contract template and a subprocessor disclosure sheet are therefore not legal niceties; they are deal-velocity instruments that remove weeks from EU procurement.

8.1Role mapping

Under Regulation (EU) 2024/1689, ORIN placing its own system on the EU market is a provider of an AI system built on general-purpose models; the GPAI-specific obligations (applicable since August 2, 2025) sit with the upstream model providers unless ORIN modifies a model in ways that make it the provider of the modified model. Broker clients deploying ORIN inside their platforms are deployers — and, for their own use of AI, carry the Art. 4 AI-literacy duty (applicable since February 2, 2025) that ORIN’s training materials help discharge.³²

8.2Risk classification: the argument, made once, in writing

The high-risk category that drives the Act’s heavy obligations is enumerated, and the financial-sector entries in Annex III are two: creditworthiness assessment/credit scoring of natural persons, and risk assessment and pricing in life and health insurance. Investment analysis, trading decision support, and investment advice appear nowhere in Annex III; the co-legislators considered the financial sector and drew the line at credit and insurance.³² An AI chart-analysis system is therefore not a high-risk AI system under the use-based list, and — absent tailoring that would trigger financial-services law first (§7.1) — the Act’s binding demands on ORIN reduce to the transparency and literacy layers below. This one-paragraph classification memo, countersigned by counsel, belongs in the DORA/procurement pack: it is the answer to the “what about the AI Act?” question that now appears in every EU vendor questionnaire.

8.3What is live as of August 2026: Article 50

The Digital Omnibus on AI — proposed by the Commission on November 19, 2025, politically agreed May 7, 2026, endorsed by Parliament June 16 and given final Council approval June 29, 2026 — deferred the high-risk apparatus: Annex III obligations move from August 2, 2026 to December 2, 2027 (Annex I embedded systems to August 2, 2028), with grandfathering for systems already on the market. What the Omnibus did not defer is Article 50 transparency, which became applicable on schedule on August 2, 2026 — the week this paper is dated.^33,34 For ORIN that means, operative now: users interacting with the conversational surface must be informed they are dealing with an AI system (obvious-from-context carve-outs notwithstanding, design for explicit disclosure); and generated content should carry machine-readable AI-provenance marking where the marking obligations for synthetic content apply to the output format. Neither is burdensome; both are brand-consistent for a lab whose thesis is open methodology — label the AI, sign the outputs.

8.4Timeline, consolidated

9.1United Kingdom: the perimeter under live review

UK law draws the familiar line: “advising on investments” (RAO Art. 53) captures advice on the merits of buying or selling a particular investment given to a person as investor; generic market commentary and information sit outside, though the financial-promotion regime (FSMA s.21) still disciplines how anything is marketed to UK persons.³⁵ The FCA’s stated AI approach is principles-based — no bespoke AI rules; existing frameworks plus the Consumer Duty.³⁵ What makes the UK the jurisdiction to watch is 2026: the March 26, 2026 perimeter report flags general-purpose AI tools offering financial advice or recommendations as an emerging risk that may not fit the current perimeter and asks government whether the boundary should move; and the Mills Review (July 6, 2026) recommends, among its priorities, revisiting the advice/guidance boundary — warning specifically that personalised recommendations or continuously adaptive prompts from AI systems can resemble regulated advice, and urging a rapid review of AI models operating outside the perimeter.^10,22 Translation for ORIN: the UK lawful lane today mirrors the EU’s Band B, but it is the one surveyed jurisdiction where the line itself is in play — monitor quarterly, and keep the §11.2 refusal behavior tight precisely because “adaptive prompts” is the named concern.

9.2Australia: the strict outlier

The Corporations Act regulates both bands: “financial product advice” (s.766B) is any recommendation or statement of opinion intended, or reasonably regarded as intended, to influence a decision about a financial product — split into personal advice (provider considered the client’s objectives/situation/needs, or a reasonable person might expect it to have) and general advice (everything else). The decisive difference from the US/EU: carrying on a business of giving even general advice requires an AFS licence (s.911A), plus the s.949A general-advice warning.²⁴ Band B content that is lawful unlicensed in New York and Limassol requires licensing (or distribution under a licensee’s authorization) in Sydney. Geo-gating and licensee-partnered distribution are the Australian entry patterns — a market-sequencing fact, not a product change.

9.3Singapore, briefly

Singapore’s Financial Advisers Act similarly licenses “advising others” on investment products as a regulated financial advisory service — research and analysis distribution generally requires a licence or an applicable exemption, again stricter than the US/EU treatment of the impersonal band.³⁶ Same entry pattern as Australia: partner or gate.

9.4US state AI statutes: a marketing-and-disclosure layer, not an advice layer

The 2024–2026 state AI wave (Utah’s AI disclosure act; Colorado’s AI Act, effective June 30, 2026 after deferral, aimed at “consequential decisions” such as the provision of financial or lending services; Texas’s TRAIGA from January 1, 2026; California’s generative-AI transparency statutes) governs disclosure and specified harms rather than investment-advice status; a person-invariant analysis tool is unlikely to make “consequential decisions” about consumers in the statutory sense. The obligations that plausibly touch ORIN are AI-interaction disclosure and provenance — already required by the §8.3 posture — but this layer is fast-moving and thresholds vary; it belongs on the counsel-review checklist, not in the architecture.³⁷

Both category leaders run the same three-part posture. Structural: B2B-only distribution — Trading Central states plainly that its insights are not sold directly to individual investors but reach them through brokerage platforms, and frames its research as encouraging “self-directed decision-making rather than giving direct financial advice”;³⁸ Autochartist likewise reaches traders overwhelmingly through broker integrations. Substantive: impersonal output — pattern events and technical views computed from market data, not from the recipient; Band B by construction. Verbal: the disclaimer — Autochartist’s public terms characterize everything supplied as “general market commentary and not … investment advice,” not a solicitation, with independent-advice and past-performance warnings.³⁹

Read against §§4–7, the structure and substance are the real compliance work — they are person-invariance and broker-borne obligations, arrived at commercially. What the posture omits is everything this paper adds on top:

• No published perimeter analysis. The “not advice” conclusion is asserted, never argued. In procurement, the broker’s compliance team is left to build the argument themselves — or stall the deal.
• No exported compliance kit. ESMA 2024 and FINRA’s 2026 report place governance, logging, and QA duties on the distributing firm for third-party AI;^9,14 the incumbent integration pattern predates both and ships none of it.
• No MAR-grade transparency. No public methodology adequate for 2016/958, no recommendation history, no outcome record — the exact absence that makes the “research” label decorative.
• A latent tension as products personalize. Category marketing increasingly gestures at personalization and AI; every step in that direction erodes the impersonal substance that the disclaimer depends on. Substance over form cuts both ways — it protects the genuinely impersonal and strips cover from the quietly tailored (§3.4).

11.1Rule 1 — Person-invariance, enforced and proven

Output is a pure function of (instrument, timeframe, market state, published methodology version). Permitted: user-initiated queries on user-chosen symbols; alerts on user-configured watchlists (the user selects the universe; the engine analyzes it identically for everyone). Prohibited: any feature that reads holdings, balances, P&L, risk profiles, or behavioral history into the analysis or its ranking, and any per-user selection of which setups to surface. Proof: an invariance test suite in CI — identical (instrument, timestamp, config) inputs across synthetic user identities must produce byte-identical analytical output — with results written to the audit log. This artifact converts the paper’s central legal argument into an exam exhibit for §4, §5.1, §6, and §7.1 simultaneously.

11.2Rule 2 — Refusal-and-reframe at the conversation layer

The chat surface declines Band C questions as asked and returns the Band B analysis it exists to give. “I hold 500 shares at 42 — should I sell?” → the system states it doesn’t give personal advice, then supplies the impersonal read of the chart’s structure and levels. Enforced in the system prompt, verified by red-team suites (holdings bait, suitability bait, “what would you do in my position”), logged when triggered. This is the specific control for the seam the FCA named in 2026^10,22 and for element (3) of the MiFID test.⁵

11.3Rule 3 — The output-language taxonomy

11.4Rule 4 — MAR-grade transparency as the voluntary global default

Adopt Delegated Regulation 2016/958’s elements everywhere, unforced: published methodology with assumptions and limitations; producer identity and timestamped price bases on every output; fact/interpretation separation in the template; conflicts statement (no order-flow, issuer, or coverage revenue); and the public 12-month recommendation history with outcomes.³⁰ One standard, worldwide, above every requirement in every other surveyed regime — which collapses per-jurisdiction content engineering, pre-answers the open MAR question (§7.3), substantiates marketing claims with a standing audit trail (§4.4, §6.3), and creates the trust surface no incumbent has (§10). The lab publishes benchmarks; the product publishes its record. Same thesis.

11.5Rule 5 — Ship the broker’s compliance case

The exported kit, versioned like the product: model-governance file (methodology, WP-01 validation, change log, failure modes); per-output audit logs with 17a-4/record-keeping exports;¹⁴ 2210/2214-pattern disclosure blocks rendered in-widget with filing-ready templates;^7,29 supervision dashboard (volumes, refusal events, drift and accuracy monitors) mapping to FINRA-2026 and ESMA-2024 expectations;^9,14 AI-literacy training pack (AI Act Art. 4);³² DORA Art. 30 contract rider and subprocessor sheet;³¹ and the AI Act classification memo (§8.2). Versioned and supplied as part of the integration, because a broker cannot supervise what it has no record of.

11.6Rule 6 — Surface-by-surface risk map

11.7Rule 7 — The red lines, named once

11.8Rule 8 — The obligation split, contractualized

This paper is a doctrinal map and a design specification. It is not legal advice, not an opinion of counsel, and not a substitute for jurisdiction-specific engagement before launch decisions; ORIN Labs is the research arm of a vendor in this category and discloses that interest. Perimeter determinations are facts-and-circumstances; the open questions flagged in §4.2, §7.3, and §9.1 are genuinely open, and the paper’s conclusions are strongest exactly where its design rules are followed strictly. The regulatory layer is in motion — the UK perimeter review and the post-Omnibus AI Act calendar are the two watch items with named 2026–2027 dates — and this document therefore carries a version number, an as-of date (August 2026), and a standing corrections policy at tryorin.xyz/labs. Published status under the methodology charter means the paper is released and citable as it stands; it does not convert research into an opinion of counsel, and no reader should treat it as one. Where the record moves, the affected findings are revised or withdrawn against a new version number rather than silently amended — the correction history is part of the citation.