Visa processed 106 million charge disputes globally in 2025—a 35% jump since 2019. Their new AI tools promise to automate decisioning across merchants, issuers and acquirers. For mid-market UK financial services firms, insurers and legal practices handling payment disputes or financial crime cases, this matters because Visa's infrastructure now expects them to integrate with AI-driven systems. The problem isn't that Visa built the tools. The problem is that most UK regulated firms assume they can simply plug them in and comply. They can't. The FCA Consumer Duty (PS22/9) requires firms to ensure third-party tools are auditable, explainable and fair. Visa's AI systems process sensitive financial data. Integration without proper governance creates liability, not efficiency.

This is part of a wider pattern: large infrastructure providers (Visa, payment processors, banking networks) are deploying AI faster than regulated entities can govern it. The EU AI Act now treats high-risk AI systems as regulated products. The ICO's UK GDPR guidance is tightening on algorithmic decision-making. The FRC's ISA UK auditing standards now require auditors to assess AI-driven controls. Meanwhile, mid-market firms are still trying to understand whether Harvey, Luminance or Copilot is the right fit for their specific regulatory context. Visa's tools will work brilliantly for processing disputes at scale. But they will not automatically comply with your regulatory obligations. The gap between vendor capability and regulated implementation is widening, not closing.

Here's what separates real AI governance from vendor optimism: Trovix doesn't believe your compliance team should discover integration problems after deployment. Trovix Audit exists precisely because firms need to map what AI systems are actually doing inside their workflows—not just trust the vendor's data sheet. When Visa's dispute tools hit your settlement processes, you need to know exactly which decisions are automated, which are flagged for human review, and whether the training data contains bias that disadvantages certain customer segments. Luminance and Harvey focus on document intelligence. They're smart tools for their lane. But they don't solve the governance layer. A payment processor's AI system is not a document—it's a live decision-maker touching client outcomes. That distinction matters under FCA CASS rules, PRA SS1/23, and SRA financial crime obligations.

The practical step: start now with a compliance audit of any third-party AI integration roadmap. Before Visa's tools (or any vendor system) touch your core processes, run a governance baseline. Identify which decisions must remain human-overseen. Map data flows for ICO GDPR compliance. Document model performance by customer segment to catch fairness drift. If your current approach is 'the vendor says it's safe, so it is,' you're already behind. Mid-market firms that move first on this will be better positioned when the FCA inevitably issues guidance on third-party AI risk. Those that wait will be managing enforcement cases.

Source: CNBC