OpenAI announced this week that it is building AI plugins for finance, legal, and banking roles—joining the race with Anthropic and others to own the professional services stack. For mid-market UK law firms, insurers, and financial services businesses, this matters because it will reshape vendor conversations and budgets over the next 12 months. But the headline conceals a harder truth: OpenAI is optimizing for model power and market speed, not for the regulatory reality that governs your business. The FCA Consumer Duty PS22/9, SRA Code, FRC ISA UK, and PRA SS1/23 do not care whether your AI comes from a consumer-grade tech company or a compliance-native vendor. What they care about is explainability, auditability, and accountability. OpenAI's playbook—train larger models, wrap them in domain-specific features, ship fast—has never aligned with how regulated firms actually need to deploy AI.

This story is the latest chapter in a pattern we've watched for three years. Consumer AI companies (OpenAI, Anthropic, Google) move upstream into professional services. Point-solution startups (Harvey, Legora, Luminance) claim they are 'compliance-aware.' Meanwhile, mid-market practices are caught between genuine pressure to automate and genuine uncertainty about what governance actually looks like. The EU AI Act is now enforceable. The ICO has published its practical AI governance guidance. Lloyd's Blueprint Two requires algorithmic transparency from underwriting systems. The regulatory environment has hardened, but the vendor narrative hasn't caught up. Most AI tools in legal and finance still treat compliance as a box-ticking exercise bolted onto the product, not as the core architecture.

Here is Trovix's honest view: buying a legal or finance AI plugin from a general-purpose model company is not the same as buying an AI integration partner who understands UK regulated practice. OpenAI, Anthropic, and their imitators are brilliant at scale and speed. They are not structured to handle the granular compliance work that a law firm, insurance firm, or accountancy practice actually needs. When you deploy an AI agent in your matter intake process or your underwriting workflow, you need to know: What data is it touching? How is it making decisions? Can you explain its output to the FCA or SRA? Can you audit a specific decision six months later? Can you handle a data breach or algorithmic failure without collapsing your PI insurance claim? These are not features you bolt on. They are questions that have to be answered during design, integration, and governance. Trovix Aria and Trovix Sift are built on this principle: the model is one part of the system. The integration architecture, the data handling, the audit trail, and the human-in-the-loop checkpoint are the other parts. We deliberately do not pretend that larger models solve compliance problems. They don't.

What should you do now? First, do not confuse AI capability with AI readiness. OpenAI's tools will be capable. That is different from saying they will be safe to deploy in your firm without significant work on your side—work that OpenAI will not do for you. Second, when evaluating any AI vendor in the next 12 months, ask three non-negotiable questions: Can you show me the data governance model? Can you produce an audit trail of every decision the AI made in my system? And if something goes wrong, whose liability is it? If the vendor cannot answer clearly, walk away. Third, start now with Trovix Watch to monitor how the FCA, SRA, and ICO are interpreting AI governance in your sector. Regulation is moving faster than most vendors are. Finally, remember that AI integration is not a software purchase. It is a change to your business process, your risk profile, and your governance model. Build it that way, or you will pay for it later.

Source: Bloomberg News