The New Statesman's April report that large language model text has entered UK acts of parliament should alarm every regulated firm in Britain. If government — with its resources and visibility — can deploy foreign AI models into policymaking without adequate safeguards, the assumption that mid-market law firms, insurers, accountants and financial advisers have this under control is naive. The issue is not that AI was used. It is that £476 million in government AI contracts since 2022 has not produced governance frameworks strong enough to prevent unvetted algorithmic text from shaping law. Under the SRA Code, FCA Consumer Duty PS22/9, and soon the EU AI Act's UK-aligned provisions, regulated firms are accountable for every output that touches client advice or regulatory submissions. Governance drift at government level signals a systemic problem: the industry is building capability faster than it is building accountability.

This is part of a wider pattern. Firms have spent two years acquiring AI tools — Luminance for contract review, Harvey for legal drafting, Microsoft Copilot for general knowledge work — often without asking whether their deployment meets regulatory requirements. The pressure is understandable: competitors are moving fast. But the New Statesman story exposes the cost of speed without structure. When government uses uncontrolled foreign LLMs in spending review analysis, it creates precedent and culture. Junior civil servants and junior lawyers see this and assume it is safe. It is not. The risk is not that AI hallucinates or makes mistakes — that is manageable with human review. The risk is that firms adopt AI tools without understanding their own accountability, leaving them exposed to regulatory action, professional negligence claims, and reputational damage when (not if) something fails in a way that harms a client.

Trovix's view is blunt: governance must come before deployment, not after. Most firms we encounter have it backwards. They buy the tool, run a pilot, then ask compliance questions. That model worked when tools were optional extras. It does not work now, because AI is becoming core infrastructure for intake, drafting, analysis and client communication. The difference between a firm using Harvey responsibly and one using it carelessly is not the software — both are fine tools. The difference is whether the firm has defined: what instructions go to the model, who reviews outputs, what audit trail exists, which client work is off-limits, how to test for bias, and how to document compliance with SRA, FCA or PRA standards. Trovix Audit exists precisely because firms need a governance dashboard before they deploy, not months after. The government story shows what happens without one.

If you are a partner or compliance officer in a mid-market firm, treat this as urgent. Conduct an audit of every AI tool currently in use: who is using it, on what work, with what review process, and with what record-keeping? Then apply the same test to planned deployments. If you cannot document compliance with your regulator's standards before launch, do not launch. Use Trovix Audit or equivalent governance framework to build a control environment, and use Trovix Watch to track regulatory changes in real time — the EU AI Act is coming, and standards will tighten. The government has already shown you what negligence looks like. Do not repeat it.

Source: New Statesman